Emthree

Privacy Policy

Last updated: 14/6/2026

1. Who we are

Emthree ("we", "us") is operated by DBR Ltd., based in United Kingdom. For any privacy question or request, contact us through our contact form.

We are the data controller for the personal data described below.

2. The short version

  • Your audio files are never uploaded. Emthree reads them locally in your browser to extract tags and album art; the audio never reaches us.
  • If you use Emthree without an account, your playlists are stored only in your browser. We don't receive them.
  • If you create an account (for Pro), we store your email and your synced playlist data (names, file paths and track tags — not audio).
  • We use privacy-respecting analytics that record usage counts and timings only — never your file paths, folder names or track titles.

3. What we collect, and why

a) Anonymous use (no account) Nothing is sent to us. Your scanned library cache and saved playlists live in your browser's local storage (IndexedDB) on your own device. We have no access to them.

b) Account data (Pro users) When you create an account we process:

  • Email address — to create and secure your account and to contact you about the service. (Authentication is handled by our authentication provider, Supabase.)
  • Synced playlist data — playlist names, the file paths of your tracks, and track tags (title, artist, album, year, genre, duration). This is stored so your playlists sync across your devices and are backed up. We do not store your audio files or their contents.

Legal basis: performance of our contract with you (providing the Pro service).

c) Analytics We use PostHog to understand how Emthree is used — for example how many tracks were scanned, how long a scan took, whether an export succeeded, and which browser was used. These events contain counts, durations and technical flags only. We deliberately exclude file paths, folder names and track titles. Anonymous visitors are not given a stored profile.

Legal basis: our legitimate interest in understanding and improving the service.

d) Payment data — (activates with payments) When you purchase Pro, payment is processed by [PAYMENT PROCESSOR — e.g. Lemon Squeezy / Stripe / Paddle]. We do not receive or store your full card details. We receive confirmation of payment and limited billing information needed to manage your subscription. See the processor's own privacy policy for how they handle card data.

e) Contact form When you message us through our contact form, we process the name, email address and message you provide, solely to respond to you. Submissions are delivered to us by email through Resend (our email-delivery provider). We keep these messages only as long as needed to handle your enquiry.

Legal basis: our legitimate interest in responding to enquiries.

4. Cookies and local storage

  • Essential: an authentication token to keep you signed in (account users only), and IndexedDB storage for your local library cache and playlists. These are required for the service to function.
  • Analytics: as described above.

We do not use advertising cookies or sell data to advertisers.

5. Who we share data with (our processors)

  • Supabase — account authentication, database and hosting of synced playlist data. (Region: [SPECIFY REGION].)
  • PostHog — product analytics. (Region: EU.)
  • Resend — delivery of contact-form messages to us by email.
  • Lovable — serving and hosting the application.
  • [PAYMENT PROCESSOR] — payment handling (activates with payments).

We do not sell your personal data.

6. International transfers

Where a processor is located outside the UK/EEA, we rely on appropriate safeguards (such as Standard Contractual Clauses or an adequacy decision).

7. How long we keep data

  • Account data: for as long as your account is active. If you delete your account, we delete your synced playlist data and email.
  • Analytics: retained for up to 12 months, then aggregated or deleted.
  • Local (anonymous) data: controlled entirely by you — clearing your browser storage removes it.

8. Your rights

If you're in the UK or EEA, you have the right to access, correct, delete, restrict or object to the processing of your personal data, and to data portability. You can exercise these through our contact form. You also have the right to complain to a supervisory authority — in the UK, the Information Commissioner's Office (ICO) at ico.org.uk.

Anonymous users can exercise most of these directly: your data is in your browser, and clearing it deletes it.

9. Children

Emthree is not directed at children under 16, and we do not knowingly collect their personal data.

10. Changes to this policy

We'll update this page when our practices change and revise the "last updated" date. Material changes affecting account holders will be notified by email.

11. Contact

DBR Ltd. — reach us through our contact form.