Privacy Policy
Last updated: 26 October 2026 (version 2026-10-25)
Compose On is a service of Jsouce, operated by A. Hakan Keresteci, an individual developer based in Edirne, Türkiye ("we"). We are the controller ("veri sorumlusu") of the personal data described here. Contact: support@composeon.jsouce.com. Our postal address is provided on request and is shown on the App Store listing of the app.
Compose On is for people 18 and over and is not directed at children. If you think a child has an account, tell us and we will delete it.
What we collect
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Sign-in identifiers: email address (may be an Apple private-relay address), Firebase user id | Create and secure your account | Contract |
| Profile: username, display name, bio (and avatar, when available) | Show you in credits, comments, friends and profiles | Contract |
| Your content: songs and parts (the notes and settings), titles, comments, likes | Run the Service; this is the product | Contract |
| Friends, friend requests, blocks | Social features and safety | Contract; legitimate interests (safety) |
| Notifications: inbox entries and a push token (FCM) for each device you enable push on | Tell you about continuations, likes, comments, requests, removals | Contract; consent for push |
| Age and legal acceptance: that you confirmed you are 18+, which Terms and Privacy versions you accepted and when | Eligibility and proof of consent | Legal obligation; legitimate interests |
| Reports you file, and moderation decisions about you or your content (including what we removed, our statement of reasons, appeals) | Keep the Service safe; comply with the EU Digital Services Act | Legitimate interests; legal obligation |
| Technical data: IP address, device and app version, App Check attestation, request logs | Security, abuse prevention, reliability | Legitimate interests |
| Purchase status from Apple (we do not see your payment details); advertising identifiers and ad interaction data only if you allow tracking | Subscriptions, ads | Contract; consent |
We do not record or upload audio, contacts, photos or your location. Text you write is checked automatically by Google Cloud's Natural Language API to detect abusive content.
Who sees what
Your profile, published songs, credits and comments are public to other signed-in users inside the app. Share links open the app and the share web page does not show songs. Friends and blocks are visible only to the people involved. Your email is never shown to other users.
Who processes data for us
Google (Firebase Authentication, App Check, Cloud Messaging, Cloud Run, Cloud Tasks and Scheduler, Secret Manager, Cloud Natural Language), Neon (database hosting), Apple (Sign in with Apple, push delivery, in-app purchase), Google AdMob (ads). Each acts under a data processing agreement or its own controller terms. We do not sell your data.
Where it is stored
Our API and database run in the United States. If you are in the EEA, UK, Switzerland or Türkiye your data is transferred to the US under the providers' Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework, and, for users in Türkiye, with your explicit consent or another transfer mechanism that KVKK allows.
How long we keep it
- Account, profile and content: while your account exists.
- Deleting your account: it is scheduled for erasure after a 14-day grace period, during which you can restore it. Then we erase your profile, friends, blocks, comments, likes, devices and inbox, and delete your sign-in. Songs and parts you published stay in the song tree because other people's parts build on them; they show "Deleted user" and are no longer linked to you.
- Reports and moderation decisions: kept without your account details for 3 years to document how we handle abuse and to meet legal obligations.
- Server logs: 30 days. Backups age out within 35 days.
Your rights
Depending on where you live (GDPR/UK GDPR, the Turkish Personal Data Protection Law No. 6698 (KVKK), CCPA/CPRA and similar laws) you can access, correct, delete, port and object to processing of your data, and withdraw consent. In the app: Profile → Settings → Export my data downloads everything we hold about you as JSON; Settings → Delete account erases it; Settings → Moderation notices shows decisions about you and lets you appeal. For anything else write to support@composeon.jsouce.com; we answer within one month. You may complain to your data protection authority. California residents: we do not sell personal information. With your permission, ads may be personalised using your advertising identifier, which you can turn off in iOS Settings, and we do not discriminate for exercising your rights.
Turkey (KVKK)
For users in Türkiye, the data controller is A. Hakan Keresteci (contact above). We process your data to create your account and run the Service, to keep it safe and to meet legal obligations. Under Article 11 of KVKK you may ask whether we process your data, request information about it and its purposes, learn who receives it in Türkiye or abroad, ask for correction or erasure, ask that these be notified to recipients, object to results produced only by automated analysis, and claim compensation for loss from unlawful processing. Write to support@composeon.jsouce.com. You may also complain to the Personal Data Protection Board (KVKK).
Security
Data is encrypted in transit; access to production data is limited and logged. No system is perfectly secure; tell us at support@composeon.jsouce.com about any vulnerability.
Changes
If we make a material change we will ask you to accept the new version in the app.