Privacy policy

Last updated: 10 November 2026

Melodik is a free game. No ads, no subscriptions and we don't sell personal data. We only store what's needed for your account, your points and the leaderboard to work.

1. Who processes your data

Melodik is an independent project based in Managua, Nicaragua. For anything related to this policy you can write to soporte@melodik.es.

2. What data we collect

• Account: email address, password (hashed by Supabase Auth, never in plain text), display name, public handle (@user), avatar, age range and country.
• Game activity: games played, answers, points, streak and leaderboard position.
• Technical data: IP address and user agent in our hosting provider's logs, and the session cookie needed to keep you signed in.

We don't ask for a phone number, postal address, ID document or payment details. If you choose to sign in with Google, we receive your name, email and profile picture from Google.

3. What we use it for

• Creating and maintaining your account, and signing you in.
• Building games, calculating points on the server and showing the leaderboard.
• Preventing abuse: multiple accounts, automation and score manipulation.
• Answering your support or data-rights requests.

The legal basis is performing the service you ask for when you create an account and, for security and abuse prevention, our legitimate interest in keeping the game running.

4. What we don't do

• We don't sell or rent personal data.
• We don't show ads or use advertising trackers.
• We don't use third-party analytics tools or build commercial profiles.
• We don't send marketing email.

5. Cookies

We only use Supabase's session cookie (its name starts with sb-), which is strictly necessary to keep you signed in. There are no advertising, analytics or social media cookies. If you delete that cookie you get signed out; your saved data is not affected.

6. Who it's shared with

• Supabase: database and authentication. Stores your account, profile and games.
• Vercel: application hosting and technical access logs.
• Google: only if you choose “Continue with Google” to sign in.

The music catalogue is queried from Deezer by our servers: Deezer doesn't receive your personal data, only anonymous song searches. These providers may store data outside Nicaragua, under the contractual safeguards that apply to their services.

7. How long we keep it

For as long as your account exists. If you ask us to delete it, we remove your profile, your games and your avatar within 30 days at most, except for anything we must keep by law. Hosting logs are kept according to their usual configuration, normally around 30 days.

8. Your rights

You can request access to your data, its rectification, erasure, restriction of or objection to processing, and portability by writing to soporte@melodik.es from your account email. We reply within 30 days at most. You can also complain to the data protection authority in your country.

9. Security

All traffic is encrypted with HTTPS. Passwords are stored hashed and never displayed. The database applies row-level security (RLS), so each user can only read and change their own data.

10. Minors

Melodik is for people aged 13 and over. If we detect an account belonging to someone younger, we delete it. If you are a parent or guardian and believe a minor gave us data, write to us and we'll sort it out.

11. Changes to this policy

If we change something relevant, we update the date in the header and let you know inside the app before it takes effect.

12. Contact

Questions, requests or complaints: soporte@melodik.es.