Privacy Policy

When you create a BlastMeet account, we collect: • Your email address and account credentials • Your name, age, and location (city/region) • Profile photos you choose to upload • Your preferred music genres and top artists (selected by you) • Your connection mode preferences (Music Friends/Discover, Events, Bandmates) The current updated app does not collect or display dedicated sexual-orientation or “interested in” fields. This statement is limited to the current updated app: legacy stored values may remain, and older clients or APIs that have not yet been retired may still transmit, expose, or otherwise process those values. It is not a representation that those values have been erased or are not processed anywhere in BlastMeet's systems. When you connect a streaming service, we access: • Your top artists and genres from Spotify or Apple Music • This data is used solely to build your compatibility profile

BlastMeet connects to third-party streaming services (Spotify, Apple Music, etc.) solely to build your music profile and calculate compatibility scores with other users. We do not sell your listening data to advertisers. Your full streaming history is never shared with other users — only your selected top artists and genres are displayed on your profile. You may disconnect any streaming service at any time from your profile settings. Disconnecting removes your streaming data from our systems within 30 days.

We use the information we collect to: • Help you use Music Friends/Discover to discover people through shared favorite artists, genres, and music compatibility • Connect you with compatible users based on music taste and location • Display your profile to potential connections in your area • Send you request and message notifications • Process subscription payments through RevenueCat and the App Store / Google Play • Improve the app's discovery experience • Respond to your support requests Music Friends/Discover is not based on sexual orientation or gender-partner preferences. Location, age, eligibility, and safety measures still apply. BlastMeet does not guarantee requests, matches, replies, or any other connections. Legal basis (EU/EEA users): We process your data under Article 6(1)(b) GDPR (performance of a contract — providing the connection service you signed up for) and, where required, Article 6(1)(a) GDPR (your explicit consent given at registration).

By uploading a photo, you grant BlastMeet LLC a non-exclusive, royalty-free license to display it within the app for the purpose of connecting you with compatible matches. You retain full ownership of your photos. Do not upload photos of other people without their explicit consent.

We share limited information with other users: • Your display name and age • Your top genres and artists • Your profile photo • Your distance from them (not your exact location) We never share: • Your exact GPS coordinates • Your full streaming history • Your email address or payment information • Your account activity with third-party advertisers

We retain your account data for as long as your account is active. If you delete your account: • Your profile is removed from the discovery feed immediately • Your messages are deleted within 24 hours • Your streaming service data is removed within 30 days • Other anonymized, aggregated app analytics may be retained indefinitely; marketing website page-view counters have the separate 90-day limit described below To delete your account and all associated data, go to Settings → Delete Account in the app. This triggers our automated erasure pipeline.

BlastMeet uses the following third-party services: • Spotify / Apple Music — music profile data (with your authorization) • Supabase (EU region) — secure database and authentication infrastructure. Supabase is SOC 2 Type II certified. Data Processing Agreement available at supabase.com/dpa. • RevenueCat — subscription management (no card data stored by us). RevenueCat is GDPR-compliant; see their DPA at revenuecat.com/gdpr. • Apple App Store / Google Play — payment processing All third-party processors are contractually bound to handle your data in accordance with GDPR and applicable law.

We implement industry-standard security measures including: • Encrypted data transmission (TLS 1.2+) • Row-level security on all database tables • Secure authentication via Supabase Auth • No storage of payment card details (handled by Apple/Google) • Regular security reviews However, no system is completely secure. Please use a strong, unique password for your account.

BlastMeet is not intended for users under 18 years of age. We do not knowingly collect personal information from anyone under 18. All users are required to confirm they are 18 or older at registration. If we become aware that a user is under 18, we will terminate their account immediately. BlastMeet does not permit discrimination, harassment, or targeting based on sexual orientation, gender, race, ethnicity, religion, disability, age, or any other characteristic protected by applicable law.

Depending on your location, you may have the right to: • Access the personal data we hold about you • Correct inaccurate information • Request deletion of your data • Opt out of certain data processing To exercise these rights, contact us at [email protected] or use the in-app tools in Settings.

If you are located in the European Union, European Economic Area, or United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR) and UK GDPR: • Right of access (Art. 15) — request a copy of all data we hold about you. Use Settings → Download My Data in the app to get an instant export. • Right to rectification (Art. 16) — correct inaccurate profile data directly in the app, or contact us. • Right to erasure / "right to be forgotten" (Art. 17) — request permanent deletion of all your personal data. Use Settings → Delete Account for immediate erasure. • Right to restriction of processing (Art. 18) — ask us to pause processing while a complaint is resolved. • Right to data portability (Art. 20) — receive your data in a machine-readable format. Use Settings → Download My Data. • Right to object (Art. 21) — object to processing based on legitimate interests. • Right to withdraw consent (Art. 7) — withdraw consent at any time by deleting your account or contacting us. To exercise any of these rights, email [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority (e.g. ICO in the UK, CNIL in France, BfDI in Germany).

We rely on the following legal bases under GDPR Article 6: • Contract performance (Art. 6(1)(b)) — processing necessary to provide the BlastMeet matching service you registered for, including profile display, matching, and messaging. • Consent (Art. 6(1)(a)) — where you have given explicit consent at sign-up (e.g., processing your music taste data and location for matchmaking). You may withdraw consent at any time. • Legitimate interests (Art. 6(1)(f)) — fraud prevention, security, and service improvement, where these interests are not overridden by your rights. As described in Section 1, the current updated app does not collect or display dedicated sexual-orientation or “interested in” fields, but legacy stored values and processing through older clients or APIs may remain while those systems are not yet retired.

BlastMeet's primary infrastructure is hosted in the EU (Supabase Frankfurt region). When data is transferred outside the EU/EEA — for example, to RevenueCat or Apple — we ensure appropriate safeguards are in place, including: • Standard Contractual Clauses (SCCs) approved by the European Commission • Adequacy decisions where applicable You may request details of any specific transfer safeguards by emailing us.

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page and, for material changes, notify you via email or an in-app notice. Your continued use of the app after changes are posted constitutes your acceptance of the revised policy.

Data Controller: BlastMeet LLC [email protected] For GDPR requests, EU/UK users may also contact our data protection contact at the same address. We aim to respond to all requests within 30 days.

On the published BlastMeet marketing website, we count page views to understand which public pages are used and which broad sources bring traffic. These are page-view counts, not unique visitor counts. The browser sends only an allowlisted public page path (without a query string or fragment) and a broad source category, such as Google, Bing, Facebook, Instagram, Reddit, Direct/Unknown, or Other website. A referrer's hostname is examined only in the browser to choose a category; the hostname, full referrer URL, and its query parameters are not sent to the analytics endpoint. We store daily totals by public page and source category in our Replit-hosted PostgreSQL database, using UTC calendar days. This analytics feature does not store individual visit records, user or account identifiers, IP addresses, user agents, or device fingerprints, and does not create or send cookies or browser-storage identifiers. It is separate from hosting/security processing needed to serve requests and from other app features. The tracker does not run in development previews and skips collection when your browser signals Global Privacy Control or Do Not Track. The endpoint also respects those request headers. Automated-traffic filtering and rate limits reduce, but cannot eliminate, inaccurate counts. Daily page-view counters are kept for the current UTC day and the preceding 89 days. Older counters are deleted when traffic is recorded or reports are read and by hourly cleanup while the API is running; cleanup also runs on startup. We retain one non-identifying timestamp indicating when page-view counting first began. Administrator-only reports also show aggregate counts of marketing waitlist signups from our existing waitlist records. Those records are separate from page views and are not linked to browsing activity. The page-view counter's 90-day retention limit does not delete waitlist signup records.