Emthree

Privacy Policy

Last updated: 26/08/2026

1. Who we are

Emthree ("we", "us") is operated by DBR Ltd., based in United Kingdom. For any privacy question or request, contact us through our contact form.

We are the data controller for the personal data described below.

2. The short version

  • Your audio files are never uploaded. Emthree reads them locally in your browser to extract tags and album art; the audio never reaches us.
  • If you use Emthree without an account, your playlists are stored only in your browser. We don't receive them.
  • If you create a free account, we store your email and your synced playlist data (names, file paths and track tags — not audio).
  • We use privacy-respecting analytics that record usage counts and timings only — never your file paths, folder names or track titles.

3. What we collect, and why

a) Anonymous use (no account) Nothing is sent to us. Your scanned library cache and saved playlists live in your browser's local storage (IndexedDB) on your own device. We have no access to them.

b) Account data (signed-in users) When you create an account we process:

  • Email address — to create and secure your account and to contact you about the service. (Authentication is handled by our authentication provider, Supabase.)
  • Synced playlist data — playlist names, the file paths of your tracks, and track tags (title, artist, album, year, genre, duration). This is stored so your playlists sync across your devices and are backed up. We do not store your audio files or their contents.

Legal basis: performance of our contract with you (providing the account and sync features).

c) Analytics We use PostHog to understand how Emthree is used — for example how many tracks were scanned, how long a scan took, whether an export succeeded, and which browser was used. These events contain counts, durations and technical flags only. We deliberately exclude file paths, folder names and track titles. Anonymous visitors are not given a stored profile.

Legal basis: our legitimate interest in understanding and improving the service.

d) Payments Our order process is conducted by our online reseller Paddle.com, which acts as the Merchant of Record for all orders. When you make a Supporter contribution, Paddle collects and processes your payment and billing details directly. We do not receive or store your card details. From Paddle we receive confirmation of payment plus limited order information (order/transaction reference, amount, currency, product, and the email address used at checkout) so we can manage your account or supporter status, provide support, and meet our record-keeping obligations. Paddle also uses this data for payments, tax compliance and invoicing. See Paddle's own privacy notice for how they handle payment data.

Legal basis: performance of our contract with you, and compliance with our legal obligations (tax and accounting records).

e) Contact form When you message us through our contact form, we process the name, email address and message you provide, solely to respond to you. Submissions are delivered to us by email through Resend (our email-delivery provider). We keep these messages only as long as needed to handle your enquiry.

Legal basis: our legitimate interest in responding to enquiries.

4. Cookies and local storage

  • Essential: an authentication token to keep you signed in (account users only), and IndexedDB storage for your local library cache and playlists. These are required for the service to function.
  • Analytics: as described above.

We do not use advertising cookies or sell data to advertisers.

5. Who we share data with

  • Paddle — our Merchant of Record for the sale of our products: checkout, payments, invoicing, refunds and sales-tax compliance.
  • Supabase — account authentication, database and hosting of synced playlist data. (Region: EU.)
  • PostHog — product analytics. (Region: EU.)
  • Resend — delivery of contact-form messages to us by email.
  • Lovable — serving and hosting the application.
  • Professional advisers — our accountants and, where necessary, legal advisers.
  • Authorities — where we are required to disclose data by law.

We do not sell your personal data.

6. Security

We use appropriate technical and organisational measures to protect your data, including encryption in transit (HTTPS), encryption at rest with our hosting provider, and access controls limiting who can reach account data.

7. International transfers

Where a processor is located outside the UK/EEA, we rely on appropriate safeguards (such as Standard Contractual Clauses or an adequacy decision).

8. How long we keep data

  • Account data: for as long as your account is active. If you delete your account, we delete your synced playlist data and email.
  • Analytics: retained for up to 12 months, then aggregated or deleted.
  • Order and payment records: retained for 7 years where required by tax and accounting law, then deleted.
  • Local (anonymous) data: controlled entirely by you — clearing your browser storage removes it.

9. Your rights

If you're in the UK or EEA, you have the right to access, correct, delete, restrict or object to the processing of your personal data, and to data portability. You can exercise these through our contact form. You also have the right to complain to a supervisory authority — in the UK, the Information Commissioner's Office (ICO) at ico.org.uk.

Anonymous users can exercise most of these directly: your data is in your browser, and clearing it deletes it.

10. Children

Emthree is not directed at children under 16, and we do not knowingly collect their personal data.

11. Changes to this policy

We'll update this page when our practices change and revise the "last updated" date. Material changes affecting account holders will be notified by email.

12. Contact

DBR Ltd. — reach us through our contact form.