Privacy Policy

Last updated: October 3, 2026

1. Introduction

CatchIt! ("we", "our", "us") operates the CatchIt! Discovery application for macOS, the CatchIt! Listen application for iOS, and the catchit.io website (collectively, the "Service"). This Privacy Policy explains how we collect, use, and protect your information when you use our Service.

2. Information We Collect

We collect the following types of information:

  • Account information: Name, email address, and user ID, collected through Supabase authentication (email and password, or Google or Apple sign-in).
  • Music metadata: Track titles, artist names, album names, genres, ISRC codes, track classifications, and any notes you add.
  • Audio recognition results: When you use Shazam recognition, audio fingerprints are processed by Apple's ShazamKit framework. We store only the resulting metadata (song title, artist, etc.), not the audio itself.
  • Device information: Device model and app version, stored alongside your discoveries for troubleshooting purposes.
  • Billing information:If you start a trial or subscribe, we store your subscription status, plan, trial and billing dates, and payment history (amounts and dates). Card details are entered on Stripe's checkout page and handled by Stripe; we never see or store your full card number.
  • Usage analytics:How you use the Service — pages visited on our website (including referrer and campaign parameters), sessions, forms started and submitted (not what you type into them), page performance, clicks on key buttons such as sign-up and download links, and in-app actions such as classifying or playing a track — together with device type, operating system, and approximate location derived from your IP address. It also includes account and subscription milestones: account created, trial started, plan confirmed, cancellations, and payments including the amount paid. Collected via Amplitude (see Section 5). When you first visit our website, we remember the page you landed on, the referring site, and any campaign parameters in your browser's local storage and a first-party ci_ft cookie (1 year), so we can tell which channels bring new accounts.
  • Referral program:If you join through a referral link or code, we store the link between your account and the referrer's, the code used, timestamps, and the identifiers of any Stripe account credit issued as a reward. The referrer sees your first name, a masked email address, and your referral status — never your full email or payment details. Visiting a referral link sets a first-party ci_ref cookie (90 days) so the referral survives signup; it is cleared once your account is created. See the Referral Program Terms.

Note: Our database schema contains location fields, but we do not currently collect or populate any location data.

3. How We Use Your Information

  • Provide, maintain, and improve the Service.
  • Authenticate your identity and manage your account.
  • Synchronize your data between your local device and the cloud.
  • Understand how the Service is used — in aggregate and per account — so we can improve it, measure how people find our website, and measure how many trials turn into paid subscriptions.
  • Process payments and manage your subscription.
  • Protect sign-up from bots and abuse (see Cloudflare Turnstile in Section 5).
  • Respond to your support requests.
  • Issue referral rewards and prevent referral abuse (see Section 2, "Referral program").

We do not use your data for advertising, and we do not sell it to third parties.

4. Data Storage and Security

  • Local storage: Your data is stored locally on your device in a SQLite database (offline-first architecture).
  • Cloud sync: Data is synchronized to Supabase cloud servers over HTTPS, protected by Row Level Security policies.
  • Temporary audio files: Audio processed for recognition is protected by multiple layers of security and automatically deleted after processing.
  • Logout: Signing out clears your keychain entries, caches, preferences, and local database.

5. Third-Party Services

We use the following third-party services to operate the Service:

  • Supabase — Authentication and cloud database. Privacy Policy
  • Apple ShazamKit — Audio recognition. Privacy Policy
  • Spotify — Music search and playback. Privacy Policy
  • Apple Music / MusicKit — Music search and playback. Privacy Policy
  • Amplitude — Product and marketing analytics. Receives usage events (e.g. page views on our website, actions taken in the app), device and browser information, and approximate location derived from your IP address, linked to your user ID once you sign in. From our servers it also receives your account and subscription status (e.g. trial started, plan confirmed, canceled), trial end date, and the amounts of payments you make — but never your card details. On our website, Amplitude uses cookies to recognize returning visitors. We do not send Amplitude your music library, playback audio, or personal notes. Privacy Policy
  • Stripe — Payment processing and subscription billing. Stripe collects and processes your card details directly; we receive your subscription status and payment records, not your card number. Privacy Policy
  • Cloudflare Turnstile — Bot protection on our sign-up form. Turnstile checks signals from your browser and device to tell people from automated sign-ups. Privacy Policy
  • Resend — Sending account and service emails (e.g. confirmation and welcome emails); receives your email address and the message content. Privacy Policy
  • Vercel — Hosting for the catchit.io website, which processes standard request data such as your IP address. Privacy Policy

We do not use advertising networks, and we do not share your data with third parties beyond the services listed above.

6. Permissions

  • Microphone (iOS): Used solely for Shazam audio recognition in CatchIt! Listen.
  • Background processing (iOS): Used for background data synchronization.

7. Data Retention and Deletion

We retain your data for as long as your account exists. When you delete items within the app, they are marked as deleted and retained temporarily for synchronization purposes, then permanently removed. Referral records are deleted with the accounts they link; Stripe retains its own records of any account credit as financial records.

To request full account deletion and removal of all your data, email us at support@catchit.io. Local data is removed when you sign out or uninstall the app.

8. Children's Privacy

The Service is not intended for users under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us at support@catchit.io and we will take steps to remove it.

9. International Data Transfers

Your data may be processed in any country where our service providers operate. By using the Service, you consent to the transfer of your information to countries outside your country of residence, which may have different data protection rules.

10. Your Rights

Depending on your location, you may have the following rights:

  • Access, rectification, and erasure of your personal data.
  • Data portability — receive your data in a structured format.
  • Restriction and objection to certain processing of your data.
  • Right to know and delete (California residents under CCPA).

We do not sell your personal information. To exercise any of these rights, contact us at support@catchit.io.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects when the latest changes were made. Your continued use of the Service after any changes constitutes acceptance of the updated policy.

12. Contact Us

If you have any questions about this Privacy Policy, contact us at support@catchit.io.