Maestrom

MAESTROM PRIVACY POLICY

Last Updated: October 23, 2026

Sistem Robotik Yazılım Hizmetleri Ltd. Şti. ("Company", "we", "us", "our") takes your privacy seriously. This Privacy Policy outlines the types of personal data we collect, process, and protect when you use the Maestrom mobile application and associated web backend services.

Data Controller: Sistem Robotik Yazılım Hizmetleri Ltd. Şti.

Address: BEŞEVLER MAH YILDIRIM CAD KARYA GÜÇLÜ İŞ MERKEZİ NO254 KAT2 B7 16110 NİLÜFER BURSA

Email: legal@maestrom.live

---

1. PRINCIPLES OF DATA COLLECTION

We process personal data in compliance with the Turkish Personal Data Protection Law No. 6698 (KVKK), the General Data Protection Regulation (GDPR) and applicable local data privacy laws. We act under the principle of data minimization; we collect only what is strictly necessary to run, secure, and operate the Application.

---

2. LEGAL BASES FOR PROCESSING

Your personal data is processed on the following legal bases (KVKK Art. 5 / GDPR Art. 6):

---

3. DATA WE COLLECT AND PROCESS

3.1. Account Credentials: We collect your email address, password hash, or phone number for authentication via Firebase Authentication.

3.2. Profiles & Customizations: Your chosen display name, selected stage role (Maestro, Musician, Solo), and any team affiliation names.

3.3. Transaction and Subscription Status: Subscription statuses (Pro / Free) and purchase receipts are verified using RevenueCat. We do not store or process payment card details.

3.4. Crash Reports and Diagnostics: Diagnostic logs and crash details are monitored via Firebase Crashlytics to optimize application performance. IP addresses and unique device identifiers are processed in a PII-filtered (pseudonymized) format.

3.5. Stage Synchronization Metadata: Live session codes, currently broadcasted song IDs, and connected instrument states are processed in Firestore during active sessions to facilitate synchronization.

3.6. Local Profile Photo (Device-Only): Any profile picture selected via the camera or gallery is saved locally in your device's document directory and monitored locally via MMKV. The actual image is never uploaded to our servers or Firestore, remaining fully within your device.

3.7. Usage Statistics (Firebase Analytics): To understand which features are used, screen views and key actions (e.g., sign-up, creating songs/setlists, downloading packs, starting or joining a stage, the subscription screen) are counted anonymously. This data is not matched to your account (name, email, user ID); it is associated only with a random, app-specific installation identifier. No advertising identifier (IDFA/AAID) is collected; only coarse, country/city-level location is derived from your IP address, and the IP address is not stored. In the European Union, the European Economic Area, the United Kingdom and Switzerland, statistics are collected only with your explicit consent; elsewhere they are on by default. You can turn them off at any time in Settings › "Share usage statistics".

3.8. Account Usage Information: To support you and improve the app, your account stores: device platform (iOS/Android), operating system version, device type (phone/tablet), app version, app and device language, the country from your device's region setting (location services are not used), your last selected role and the date you last used the app.

3.9. Support Messages ("Write to us"): Problems, requests and questions you send from the app are stored together with your name, email address, app version and device information, and are used only to answer you.

---

4. THE USE OF LOCAL NETWORK TRAFFIC

When operating in Local Network WiFi synchronization mode, all data packets (song IDs, cues, transpositions) flow directly between device IP addresses using a local raw TCP server (`react-native-tcp-socket`). This local network traffic is transient, remains completely within your private router network, and is never transmitted to, monitored by, or stored on our external servers.

---

5. DATA RETENTION PERIOD

5.1. Active Account Data: Account and transaction records are kept in Firebase Firestore for as long as your account remains active.

5.2. Session Clearances: Temporary live session codes and connected client metadata are permanently wiped after the Host terminates the session.

5.3. Full Account Deletion: When you invoke the "Delete Account" function in the Application Settings, your profile document and authentication records are permanently erased from Firestore and Firebase Auth servers within 24 hours.

5.4. Usage Statistics and Support Messages: Usage statistics are kept in Google Analytics for up to 14 months. Support messages are kept for up to 2 years after your request is answered; you can ask for them to be deleted when you delete your account.

---

6. THIRD-PARTY DATA DISCLOSURE

We do not sell, trade, or rent your personal data to advertisers, analytics brokers, or marketing third parties. We disclose data only to essential cloud infrastructure partners for functional service delivery:

---

7. INTERNATIONAL DATA TRANSFERS

To operate the Application, some of your data may be processed by our infrastructure partners Google LLC (Firebase/Google Cloud) and RevenueCat, Inc., whose servers may be located outside Türkiye (e.g., in the USA). Such transfers are carried out, pursuant to KVKK Art. 9 and Chapter V of the GDPR, (i) only to the extent necessary to provide the service, (ii) under those providers' Standard Contractual Clauses (SCCs) and technical/organizational safeguards, and (iii) where required, based on your explicit consent. These providers are obligated to process your data solely to provide the services they render to us.

---

8. NO USER TRACKING POLICY

We do not track your location, browsing history, or activity across other apps or websites. The Application does not utilize cross-app tracking SDKs, and our iOS tracking configuration is set to `false` in accordance with Apple's App Tracking Transparency regulations.

---

9. CHILDREN'S PRIVACY

Maestrom is not directed to children under 13 and does not knowingly collect personal data from them. If we learn that we have collected data from a child under 13, we will delete it as soon as possible.

---

10. YOUR RIGHTS AND CONTACT INFORMATION

Under KVKK Art. 11 and GDPR Arts. 13–22, you have the right to: (a) access your data, (b) request rectification, (c) request erasure, (d) object to processing, (e) request restriction of processing, (f) receive your data in a structured format (portability), (g) withdraw your consent at any time, and (h) lodge a complaint with the Personal Data Protection Authority (or the relevant supervisory authority in the EU). You may submit all requests to legal@maestrom.live.