Privacy notice
Last updated 18 October 2026 · Terms of use
Yipo is a free music discovery service at yipo.app. To work, it needs your e-mail address (to sign you in) and the music you like (to make suggestions). It shows no ads, uses no third-party trackers or analytics services, and never sells your data or gives it to anyone for their own purposes. Usage statistics are kept only if you agree.
1. Who is responsible for your data
The data controller is the operator of Yipo, a private individual in Hungary. For anything about your data, write to hello@yipo.app. Yipo has no data protection officer, as the law doesn't require one for a service of this kind.
2. What is processed, why, on what legal basis, and for how long
| Data | Purpose and legal basis | How long |
|---|---|---|
| E-mail address and the name you choose | Signing you in and identifying your account. Performing our agreement with you (GDPR Art. 6(1)(b)). | Until your account is deleted. |
| Sign-in codes and session tokens | Checking that the address is yours and keeping your devices signed in. Only one-way scrambled (hashed) copies are stored. Art. 6(1)(b). | Codes: 15 minutes, in memory. Sessions: until you sign out, or a year without use. |
| Your taste and library: the artists you pick, artists and play counts from a listening history you import, likes, saves, ratings, "not for me" choices, your settings and your current feed, and for artists you discover, their Deezer fan count when you found them | Making suggestions for you and showing the same library on all your devices. Art. 6(1)(b). | Until your account is deleted. |
| Community likes: an artist, a score (liked, saved, not for me), when you gave it, and a scrambled code made from your account number with a secret key, so the votes are stored without your account number, name or e-mail address | Showing everyone, as counts only, the artists Yipo's listeners like: "Upcoming stars" in the app and the public monthly list "The Underground 50" at yipo.app/underground. The code lets each account count once and change its own vote. An artist appears only with at least three accounts behind them, and only once enough accounts have voted, so no list shows one person's taste. Only signed-in accounts vote. Legitimate interest in offering this feature (Art. 6(1)(f)). | Until your account is deleted; then its votes are removed. A month's published Underground 50 shows only artists and counts, and stays as it was. |
| Notification subscription (only if you turn notifications on): the address your browser gives for notifications and the picks already sent | Sending you music picks a few times a day and, rarely, important news about Yipo (an outage, a change in these terms). Art. 6(1)(b). | Until you turn notifications off or your account is deleted. |
| Feedback you send: your text and mood, the screen you were on, your browser and device type, and your account's name and e-mail | Reading and answering it, and improving Yipo. Legitimate interest (Art. 6(1)(f)). | Two years, or until your account is deleted, whichever is sooner. |
| Usage statistics (only if you agree): which screens you open and for how long, what you tap, previews you start and how long you listen, saves and ratings, errors in the app, how long the app took to load, the app version, and about your device: browser and system, screen size, language, time zone, whether Yipo runs from your home screen, and the website or campaign link you came from | Understanding how Yipo is used and finding faults. Linked to your account. Your consent (Art. 6(1)(a), and for reading information from your device, the ePrivacy rules: Hungarian Act C of 2003, § 155(4)). Nothing is recorded before you answer, and nothing if you say no. | 13 months, then deleted. Withdrawing consent stops it at once; deleting your account deletes it at once. |
| Record of your consent: your answer, when you gave it and which wording you saw | Being able to show that you agreed, or that you took it back (GDPR Art. 7(1)). Legal obligation (Art. 6(1)(c)). | Until your account is deleted. |
| E-mails to you | Sign-in codes, and messages about the service itself: an outage, a change to these documents, a security problem. Art. 6(1)(b) and (c). Yipo sends no marketing e-mail. | Not kept after sending. |
| IP address | Stopping abuse: too many requests, guessing codes. Legitimate interest in keeping the service safe (Art. 6(1)(f)). | In memory only, for at most an hour. Never written to disk by Yipo. |
| Server logs: technical messages, errors, the pages and account numbers involved; never names, e-mail addresses or what you wrote | Keeping the service running and finding faults. Legitimate interest (Art. 6(1)(f)). | 30 days. |
Where the legal basis is legitimate interest, the operator has weighed it against your interests and keeps the data to the minimum the purpose needs. You can object to it at any time (section 7).
Giving your e-mail address is necessary to have an account: without it Yipo can't be used. Everything else is optional or comes from how you use the app.
Accounts not used for a year are deleted automatically, with everything in them. Listening history files you import are read on your own device; only the artists and play counts are kept, never the files.
3. Suggestions and profiling
Yipo works out what to suggest automatically from your taste and your reactions. This is profiling in the GDPR's sense, but it only decides which music you see. Yipo makes no decision about you that has legal or similarly significant effects (GDPR Art. 22).
4. Who sees your data
The operator can see the data above, to run Yipo, answer your requests and fix problems. Nobody else gets access to it, except these service providers, each only for the task named:
- Hosting: the server runs on a computer the operator owns, in Hungary.
- Cloudflare, Inc. (USA) carries every connection to yipo.app and protects the site from attacks. It sees your IP address and the requests while they pass through, and may keep technical records for a short time under its own terms.
- E-mail delivery: sign-in codes and service messages are sent through Brevo (Sendinblue SAS, France), which receives your address and the message.
- Notification services (only if you turn notifications on): picks reach your device through your browser maker's push service (Apple, Google, Mozilla or Microsoft). The message itself is encrypted so they can't read it; they see that a message is sent to your device.
- Deezer: covers and 30-second previews load from Deezer's servers straight to your device, so Deezer sees your IP address, as with any website. These requests contain nothing about your account, and Deezer sets no cookies through them. Artist and record information is fetched by Yipo's server, not your device.
- Music databases: Yipo's server looks up artists and records at Discogs, MusicBrainz, ListenBrainz and Apple's iTunes search. These lookups contain only artist and record names.
- Backups: the server's data is copied every night to storage the operator controls. Copies are kept for 30 days, so something you delete is gone from them within 30 days.
Buttons such as "Listen on Spotify" or "Share" open other services only when you tap them; their own privacy terms apply there.
Where a provider is outside the European Economic Area (for example in the United States), the transfer relies on the EU–US Data Privacy Framework or on the European Commission's standard contractual clauses agreed with that provider.
5. Storage on your device and cookies
To work, the app keeps on your device: your account number and sign-in token, a copy of your library and taste, your settings, where you were in your feed, and small technical notes (how loud previews are, how long loading usually takes). It also keeps your answer about usage statistics and which message banner you closed. All of this is strictly necessary for the service you asked for, so it needs no consent; it stays until you sign out, delete your account or clear your browser's data.
Yipo sets one cookie, yipo_app, when you open the app, so the front page takes you straight in next time. It holds no identifier and expires after a year. Yipo sets no other cookies for you, and no third-party cookies.
6. Security
Connections are encrypted (HTTPS). Sign-in uses one-time codes instead of passwords, and only scrambled copies of codes and tokens are stored. Access to the server and the admin tools is limited to the operator. If a breach puts your data at risk, the operator reports it to the data protection authority within 72 hours where the law requires, and tells you if the risk to you is high.
7. Your rights
You have the right to access your data and get a copy, to have it corrected, to have it deleted, to restrict its processing, to receive it in a machine-readable form and take it elsewhere (portability), to object to processing based on legitimate interest, and to withdraw your consent at any time without affecting what happened before.
Much of this you can do yourself in the app: You › Usage statistics gives or withdraws consent, and You › Delete my account deletes your account and everything linked to it from the server at once (from backups within 30 days). For anything else, including a full copy of your data or correcting your name or e-mail address, write to hello@yipo.app. You get an answer within one month; if a request is complex, this can be extended by two more months, and you will be told why. The operator may ask you to confirm that the request comes from you, for example from your account's e-mail address.
If you think your data is handled unlawfully, you can complain to the Hungarian data protection authority: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), 1055 Budapest, Falk Miksa utca 9–11, postal address 1363 Budapest, Pf. 9, ugyfelszolgalat@naih.hu, naih.hu; or to the authority where you live or work in the EU. You can also go to court; in Hungary the regional court (törvényszék) of your home or residence decides.
8. Age
Yipo is for people aged 16 and over. Someone younger may only use it with a parent's or guardian's permission. If you think a child under 16 uses Yipo without permission, write to hello@yipo.app and the account will be deleted.
9. Changes
If this notice changes, the date at the top changes too. If a change matters (new kinds of data, new purposes, new recipients), the app and an e-mail tell you before it applies. Where a change needs your consent, it is asked for again.