FLIGHT RULES

Privacy Policy

EFFECTIVE DATE: SEPTEMBER 11, 2026 · LAST UPDATED: NOVEMBER 8, 2026

Mach Groove is an iOS app by LMDx Tech that moves playlists between Apple Music, YouTube Music, and YouTube — as songs, live versions, karaoke, music videos, or live performance videos. Same playlist, different vibe. This policy says plainly what we collect, where it lives, how long we keep it, and how to delete it. The short version: we collect almost nothing, we track nothing, and we never sell anything.

What we collect

When you sign in with Apple or Google, we collect only what your account needs:

• Your email address — so your Mach Groove account exists and we can tell it apart from everyone else's. (With Sign in with Apple, this can be Apple's private relay address.)
• Your name and profile picture link, if your sign-in shares them — to label your account in the app. You can change the name on your pilot card in Profile: tap EDIT → Edit Name.
• Your @handle, if you claim one: the name you pick for yourself (lowercase letters, numbers, and underscores). It shows on your pilot card and on things you choose to share, like a mission log or a support email. You can change it anytime on your pilot card: tap EDIT → Change Handle.
• A user ID (a random identifier created for your account when you sign in) — how the app proves to our servers that a request is really yours.

That's the whole list. Your playlists and transfers stay on your phone — we don't keep a copy of what you transferred or what's in it, unless you send us a mission log for support (see below).

What we never collect

• No tracking. No analytics SDKs, no crash-reporting SDKs, no advertising identifiers, no fingerprinting. The App Store "Do you track users?" answer is No, and it's true.
• No listening surveillance. We see the playlists you choose to transfer, only while you transfer them. We don't monitor what you play.
• No audio. Mach Groove moves playlist information (titles, artists, catalog IDs) — it never copies, downloads, or streams music.
• No sale of data. Not to anyone, not ever. No ads, no data brokers.

Where your data lives

• On your device: the sign-in tokens for your connected music services (in the iOS Keychain), your transfer history, lifetime stats, transfer logs, and preferences like theme. None of this leaves your phone, except a mission log you send to support (below).
• On our servers: your email, name, profile picture link, user ID, @handle (if you claimed one), and the date your account was created; mission logs you send to support (next); and a keyed hash on song-catalog reports (below). Nothing else.
• Mission logs you send to support: when you open the support email or share sheet for a mission, the app sends that mission's full log (the playlist and song names, the matches it tried, and the app version) to our servers, tied to your account, so we can see what happened. Only LMDx support can read it, and it's deleted automatically 30 days after it's sent.
• Shared song catalog: the app reports song-catalog facts (for example, "this YouTube video and this Apple Music song are the same recording") to make everyone's matches faster. These are facts about songs, not about you. To spot bad or abusive reports, each report is stored with a keyed one-way hash of your user ID, not the ID itself, and not your email or name. We don't store the hash with your account record or use it to identify you, and we delete each report after 30 days.
• Google Firebase: the app uses Firebase (from Google) for sign-in, for checking that requests come from the genuine app, and for turning features on or off remotely. To do that, Firebase creates an identifier for this install of the app. It isn't linked to advertising and isn't used to track you.

Your music-service connections

• Apple Music: authorized through iOS itself (like Camera or Location) — we never hold a credential. Revoke in iOS Settings.
• YouTube Music: authorized via Google Sign-In on your device. Disconnect anytime in the app.

Disconnecting a service in the app (or revoking it at the service) cuts Mach Groove's access immediately.

YouTube API Services

Mach Groove uses YouTube API Services. By using the YouTube features you also agree to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy. Mach Groove caches YouTube API data (like search results) for no more than 30 days, keyed to songs — not to you. You can revoke Mach Groove's access to your Google/YouTube data at any time at myaccount.google.com/permissions.

How Mach Groove uses Google user data

Mach Groove asks Google for two kinds of access, and uses each only for the feature you asked for:

• Sign in with Google (your email address, name, and profile picture, plus a Google account identifier): used only to create your Mach Groove account, keep you signed in, and show who's signed in. Stored on our servers until you delete your account.
• YouTube (manage your YouTube account): used only when you start a transfer, to (1) read your own YouTube playlists and the songs in the one you choose, (2) search YouTube's catalog for each song you're moving and check it can play, and (3) create a new playlist in your account and add the songs you chose. That's all we do with it — we don't upload, delete, comment, rate, subscribe, or change anything else on your account.

YouTube data stays on your phone: search results are cached on the device for no more than 30 days and then deleted, and YouTube data is never stored on our servers. We don't sell Google user data, use it for advertising, share it with third parties, or use it to train AI or machine-learning models. People don't read it, except with your permission (for example, a log you choose to send to support), for security, or where the law requires.

Mach Groove's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How we protect your data

• Encrypted in transit: every connection between the app, our servers, and Google, Apple, and your music services uses HTTPS (TLS).
• On your phone: sign-in tokens for your connected services live in the iOS Keychain, readable only by Mach Groove, only while your phone is unlocked, and never synced to other devices. Google's sign-in session is kept by Google's own Sign-In library, also in the Keychain.
• On our servers: our database runs on Google Cloud and is encrypted at rest. Our server reaches it with a Google-managed identity instead of a stored password, and that identity holds only the permissions it needs. Secrets are kept in Google Secret Manager, never inside the app.
• Every request is checked: our server only answers requests carrying a valid sign-in token for your account and proof that they come from the genuine Mach Groove app (Firebase App Check). You can only ever read or delete your own account.
• Limited access: only LMDx administrators can reach our production systems, and every administrator account requires two-step verification.
• Minimal by design: we keep as little as possible (see above), and deleting your account removes it.

If a security incident ever affected your data, we'd tell you and the relevant authorities as the law requires.

How long we keep it

• Email, name, profile picture link, user ID, @handle, and account creation date: as long as your account exists; deleted when your account is deleted.
• A handle you changed away from: held for you for 30 days so nobody else can take it and pose as you, then released. Deleting your account releases it right away.
• Mission logs you send to support: deleted automatically 30 days after you send them.
• Everything on your device: yours — deleting the app deletes it.
• YouTube data: never stored on our servers; the app's on-device YouTube cache deletes entries after 30 days.
• Shared song catalog: song facts (like matching Apple Music IDs) are kept with no personal data. The keyed hash stored with each report is deleted after 30 days, including after you delete your account.

Deleting your account and data

Delete your account anytime in the app: Profile → Delete Account. That deletes your account record (email, name, user ID, @handle, and any handle being held for you) and everything tied to it on our servers (except a mission log you sent to support, which is deleted within 30 days of sending), removes Mach Groove's access to your Apple or Google sign-in, and clears the app's data from your phone. Playlists you already created in Apple Music or YouTube stay in those apps.

Can't get into the app? Email support@mach-groove.app from the address you signed in with and we'll delete your account and confirm when it's done. Deleting the app from your phone also removes everything stored on the device.

Launch alerts (this website)

If you sign up for launch alerts on mach-groove.app, we store the email address you give us and which platforms you asked about (iOS/Android), solely to send you launch news. Stored on our own infrastructure, never shared or sold, deleted after the launch announcements wrap or anytime you ask at support@mach-groove.app.

This website

mach-groove.app is a static site; our hosting and font providers may log standard request data (like IP addresses) to serve it. The site sets no cookies and runs no analytics.

Children

Mach Groove is not directed at children under 13, and we don't knowingly collect data from them.

Changes

If this policy changes, the new version is posted here with an updated date. Material changes to what we collect will be called out in the app.

Contact

LMDx Technologies LLC · support@mach-groove.app · Using the app is also covered by our Terms of Service.