RHYME ROYAL — Privacy Policy

Version 1.8

This policy explains what Rhyme Royal collects, why, and what you can do about it. Rhyme Royal is operated by Giuseppe Di Salvatore, carrying on business as Lone Ones Music Group, in British Columbia, Canada.

This version covers the Rhyme Royal iPhone app as well as the website. Where something applies only to the app, it says so.

Questions or requests: support@rhymeroyal.com

1. What We Collect

You give us:

Account details — email address, handle, display name, password (stored hashed; we never see it).
Profile content — avatar, bio, links, and anything else you add.
Uploads — your verses, and beats if you are a producer.
Your unmixed vocal, if you record in the app. When you record over a beat on your phone, we keep the bare vocal recording as well as the finished mix. This is what lets you change the sound of a verse afterwards without performing it again, and lets you download your own vocal to mix elsewhere. Nobody else can hear it — not the crowd, not your opponent. Your opponent hears the finished verse, the same as everyone else. Only you and, where necessary for moderation, we can access the bare recording. You can delete it by deleting the verse.
Producer details — legal name, country, and store links, if you register as a producer.
Support messages you send us.

Created by using the platform:

Battles, votes, comments, chat messages, and Royal Rating history.
Agreement records — when you accept terms, we store the version, timestamp, IP address, and browser user agent as proof of acceptance.
Whether you played both verses — for each battle, we record a single yes/no: have you played both sides. It is written the moment you have heard both, so that listening properly still counts if you come back hours or days later to vote. It is not a play log. We do not store which verse you played, when, how many times, or how far through you got — only that both have been heard. It exists because a vote cast without hearing both sides counts for less, and that shouldn't depend on you staying on the page. Visible only to you and to us.
Vote integrity data — when you vote, we store a one-way scrambled code derived from your IP address and browser. We do not store the IP address itself with your vote, and the code cannot be turned back into it. It exists solely so we can detect coordinated voting — several accounts operated by one person, or a group agreeing to vote for each other. It is never used for advertising or tracking you around the internet, and it is visible only to us.
Beat downloads — when you download a beat, we record which beat, when, and which account did it. We use it to follow up with people taking part in a challenge, and to tell a producer how many people took their beat. A producer only ever sees a number, never who you are. Visible only to us.
Voice rooms you opened or were invited to — the room, not the conversation. No voice room is ever recorded. Section 4 covers this in full, including the one thing about private rooms you should know before you use them.
Basic technical data — IP address, browser type, and pages requested, through standard server logs.
Notification tokens. If you turn notifications on, we store the code your browser or phone gives us so we can send them. In the app this is an Apple push token; on the web it is a browser push subscription. It identifies a device, not you personally, and it is used for nothing except delivering the notifications you asked for. It is never used for advertising, tracking, or building a profile. Turning notifications off removes it.

From payment:

If you buy Royal Pro or Founding Royal on the website, Stripe processes the payment. We receive a customer reference, subscription status, and renewal date. We never receive or store your full card number.
If you subscribe inside the iPhone app, Apple processes the payment through your App Store account. We receive a subscription identifier and its status. We never receive your card details, your Apple ID, or your name from Apple.

In the app, we do not collect:

your location;
your contacts, photos, or calendar;
any advertising identifier. The app contains no advertising or analytics SDKs.

The microphone is used only while you are recording a verse, and only after you allow it.

2. Why We Use It

To run your account and the platform.
To display battles, votes, rankings, and profiles.
To process payments and manage subscriptions.
To send service email — password resets, account confirmations, and notices such as beat review decisions.
To send notifications you switched on, to the device you switched them on from.
To see which beats are being taken up, and to follow up with people who started a challenge.
To prevent fraud, vote manipulation, and abuse.
To meet legal and accounting obligations.

We do not sell your personal information. We do not run third-party advertising networks on Rhyme Royal.

We do not use your uploads to train generative AI models, and we do not license them to anyone else for that purpose.

3. What Is Public

Rhyme Royal is a public platform. The following are visible to anyone:

your handle, display name, avatar, bio, and links;
your battles, verses, and lyrics you post;
your Royal Rating, record, and ranking;
your comments and Lounge messages;
your votes — the battle page shows who voted and which side they backed;
producer pages and beats.

Private: your email address, your direct messages, your payment details, your agreement records, vote integrity data, your unmixed vocal recordings, and your notification tokens.

Voice rooms are neither. Nothing said in one is published, and nothing said in one is kept. But a private voice room is not private from moderators — see Section 4, which explains exactly what that means before you decide to use one.

Also private, for a while: a verse recorded to answer a direct challenge stays sealed until the person you challenged posts theirs. Nobody can hear it or read its lyrics in the meantime — including them. Nobody should have to write against a verse they have already heard.

Votes are public in the sense above — the battle page shows who voted and which side they backed. How much a vote counts toward the final result may vary: we reduce the weight of votes that show signs of coordination or manipulation. We do not disclose which votes were affected, because doing so would tell someone gaming the system exactly what to change.

Direct messages are private between sender and recipient and enforced at the database level — but they are not end-to-end encrypted, and we can access them if required to investigate abuse or comply with the law.

4. Voice Rooms

Rhyme Royal has live voice rooms — the open Voice Lounge, and private rooms a member can open and invite people into.

Nothing said in a voice room is recorded. There is no recording, no transcript, and no automated listening. The audio passes through the server that connects the call and is not written anywhere. When the room empties, there is nothing left of it. If someone asks us for a copy of what was said in a voice room, there is nothing to give them.

What we do keep is the room, not the conversation: its name, who opened it, who was invited, when it was opened and when it closes. Plus any moderation record — a mute, a removal, a ban, or a room closed by staff, with the reason. We do not keep a log of who joined a room or how long they stayed.

A private room is private from other members. It is not private from moderators. A moderator or an administrator can enter a private room they were never invited to. When they do that:

they do not appear in the room. Not in the member list, not as a voice. The people in the room are not told, and cannot tell;
they cannot speak. Oversight is listening only — the microphone is not granted. A staff member who wants to take part has to be invited like anyone else, and then they are simply in the room, visible, the same as you;
the visit is recorded before they are let in: who entered, which room, whose room, and when. If that record cannot be written, they are not let in;
a closed room stays closed to them. Once a room's time is up it is gone to everyone, staff included. This is a way to see a conversation that is happening, not a key to one that already finished.

In the open Voice Lounge none of this applies — staff are ordinary participants there, listed and audible like everybody else.

We do it this way because a room nobody can see is where cheating, harassment and exploits get organised, and there is no way to moderate a platform with a blind spot in the middle of it. We would rather write it down than let you assume otherwise.

So: treat a private voice room the way you would treat a back room at a venue. It isn't being taped, and it isn't broadcast — but staff can walk in.

5. Who We Share It With

Only the services needed to operate:

Supabase — database, authentication, and file storage.
Vercel — application hosting.
Stripe — payment processing.
Resend — transactional email delivery.
Cloudflare — DNS, and bot protection on sign-up and log-in.
LiveKit — the server that carries live voice. It relays the audio between the people in a room and receives your account identifier and display name so the room can show who is in it. It does not record. No audio is stored by them or by us.
Apple — push notification delivery, and payment processing for subscriptions bought inside the app. Apple receives the notification token and the message, not your account details.
Meta Platforms — advertising measurement on our public pages, as described in Section 6.

Each processes data on our behalf under their own terms. We may also disclose information where legally required, or to protect the rights and safety of users.

These providers may process and store data outside Canada, including in the United States.

6. Cookies and Advertising

Necessary cookies. These keep you logged in and maintain your session. The site does not work without them.

Advertising measurement. We advertise Rhyme Royal on Meta (Facebook and Instagram). To see whether those ads bring people who actually sign up, we use the Meta Pixel on our public pages. It sets a cookie and tells Meta that a visit or a sign-up happened.

What Meta receives is the page you were on, that a sign-up occurred, your IP address and browser details. It does not receive your MC name, your email address, your verses, or anything you do inside your account.

You can stop this by blocking third-party cookies in your browser, by using any tracker-blocking extension, or through your Meta ad preferences. Blocking it does not affect anything on Rhyme Royal — every part of the site works the same.

We do not sell personal information, and we do not use this data to build profiles of you for anyone else.

7. How Long We Keep It

Account data — while your account is open.
Battles and votes — retained after account closure where another artist took part, since removal would delete their work and others’ votes.
Agreement records — retained as long as needed to evidence the agreement.
Payment records — retained as required by tax and accounting law.
Beat download records — deleted with your account.
Unmixed vocal recordings — kept while the verse exists; deleted when you delete the verse or close your account.
Notification tokens — deleted when you turn notifications off, when the device stops accepting them, or with your account.
Voice room audio — not kept at all. It is never written down in the first place, so there is nothing to retain or delete.
Voice room records — the room's name, who opened it, and who was invited are kept after it closes, as the record of a moderation decision is kept. Deleted with your account.
Server logs — a short rolling period.

8. Your Rights

You can:

see and edit most of your information in your profile;
request a copy of your personal information;
ask us to correct anything inaccurate;
delete your content and close your account;
download your own unmixed vocal from any verse you recorded in the app;
turn notifications off at any time, on the device or in your phone's settings;
withdraw consent to non-essential communications.

Email support@rhymeroyal.com and we will respond within a reasonable period. Depending on where you live, you may have additional rights under laws such as PIPEDA (Canada), the GDPR (Europe/UK), or applicable US state privacy laws.

9. Children

Rhyme Royal is not intended for children under 13. We do not knowingly collect information from anyone under 13. If you believe a child has given us information, contact us and we will delete it.

10. Security

Passwords are hashed, traffic is encrypted in transit, and access to data is restricted at the database level so users can only reach what they are entitled to. No system is perfectly secure, and we cannot guarantee absolute security.

11. Changes

We may update this policy. Material changes will be announced on the platform, and each version is archived.

Contact: support@rhymeroyal.com