Privacy Policy

This Privacy Policy explains how Codex Collective LLC collects, uses, shares, retains, and protects personal information when you use urTrax. It also explains choices and privacy rights that may apply based on where you live.

Codex Collective LLC is generally the controller or business responsible for personal information processed through urTrax. Stripe independently processes certain payment and identity information under its own privacy terms.

Depending on how you use urTrax, we may collect:

• account information, such as name, display name, email address, password credentials in protected form, country, birth date or age range;
• parent or guardian information and records of consent for younger users;
• profile information and account preferences;
• purchase, subscription, customer-support, cancellation, and refund information;
• artist information, including artist or business name, releases, audio files, artwork, metadata, ownership information, tax details, and payout status;
• communications you send to support, privacy, security, legal, or copyright channels; and
• information submitted when reporting content, disputing a transaction, or appealing an enforcement decision.

Stripe processes payment-card, bank-account, identity-verification, tax, fraud-prevention, and payout information. urTrax may receive limited information such as payment status, card brand and last four digits, billing country, Stripe account identifiers, payout status, disputes, and risk indicators. urTrax does not intend to store full payment-card numbers.

We may collect operational data necessary to provide and secure the Service, such as IP address, a pseudonymous browser identifier, device and browser type, operating system, language, timestamps, requested pages or files, authentication events, crash information, security logs, and cookie or session identifiers. For introductory-offer eligibility and fraud prevention, we may also derive pseudonymous network identifiers and receive signals indicating that a connection uses a VPN, proxy, relay, Tor exit, or hosting provider.

At launch, urTrax does not use third-party behavioral advertising, third-party marketing analytics, precise-location tracking, or cross-context behavioral profiling. If that changes, we will update this Policy and provide consent or opt-out controls where required.

We use personal information to:

• create, authenticate, maintain, and secure accounts;
• provide subscriptions, music access, downloads, purchases, artist uploads, sales, and payouts;
• process payments, prevent fraud, handle disputes, and maintain transaction records;
• determine eligibility for the one-time introductory membership price and prevent repeated or abusive use of it;
• verify age, parental authority, artist identity, ownership, tax status, or payout eligibility;
• communicate about transactions, accounts, policy updates, support, and security;
• protect users, children, artists, rights holders, urTrax, and the public;
• investigate abuse, infringement, fraud, security incidents, and violations of our policies;
• debug, maintain, and improve the reliability and accessibility of the Service using necessary operational information;
• comply with tax, accounting, sanctions, legal-process, reporting, and regulatory requirements; and
• establish, exercise, or defend legal claims.

Where law requires a legal basis, we rely on one or more of the following:

• Contract: processing necessary to provide an account, subscription, purchase, sale, payout, download, or requested support.
• Consent: processing based on permission, including verified parental consent where required. Consent can be withdrawn, subject to lawful limits.
• Legitimate interests: securing the Service, preventing fraud, maintaining operations, protecting rights, and improving reliability, after considering the interests and rights of affected people.
• Legal obligation: tax, accounting, sanctions, child-safety, consumer-protection, regulatory, and lawful-process requirements.
• Vital interests or public interest: when applicable to urgent safety or legally recognized public-interest needs.

We may share personal information with:

• Stripe, to process payments, verify sellers, prevent fraud, and deliver payouts;
• network-intelligence and fraud-prevention providers, to assess introductory-offer eligibility and suspicious connection signals;
• infrastructure, hosting, storage, email, customer-support, cybersecurity, and professional-service providers that process information under appropriate obligations;
• artists or buyers when necessary to complete a transaction, resolve a dispute, or meet tax or consumer-law requirements, while limiting the information disclosed;
• authorities, courts, regulators, rights holders, or other parties when we reasonably believe disclosure is legally required or necessary to protect safety, rights, funds, or the Service;
• a buyer, investor, successor, or adviser in connection with a proposed or completed financing, merger, reorganization, sale, or insolvency, subject to appropriate safeguards; and
• other parties at your direction or with your consent.

Artist names, release information, artwork, music, prices, and other information intentionally published through an artist page may be publicly visible. Do not publish personal information you do not want publicly available. Accounts belonging to children must use age-appropriate privacy defaults and should not display real-world contact details.

urTrax is a general-audience music service that may offer age-appropriate access to younger users. We do not knowingly allow a child below the locally applicable digital-consent age to create an ordinary independent account.

Where parental consent is required, we will seek notice and verifiable consent from a parent or legal guardian before collecting personal information beyond what law permits for limited purposes. Parents and guardians may request access to, correction of, or deletion of a child’s personal information and may withdraw consent by contacting rob@urtraxapp.com.

For child users, we apply or intend to apply safeguards including data minimization, high-privacy defaults, limited public visibility, no targeted advertising, limited profiling, restricted purchases and seller features, and retention only as reasonably necessary. We will not condition a child’s participation on providing more personal information than is reasonably necessary for the relevant activity.

If we learn that personal information was collected from a child without required authorization, we will take reasonable steps to delete or appropriately restrict it. Contact us with the subject line Child Privacy Request.

At launch, urTrax uses cookies or similar local technology only where reasonably necessary for authentication, security, session continuity, preferences, checkout, fraud prevention, and core operation. We do not currently use advertising cookies or third-party marketing analytics.

Where required, nonessential technology will remain disabled until valid consent is obtained. Browser settings may block cookies, but blocking essential cookies can prevent login, checkout, or other core functions.

We retain personal information only for as long as reasonably necessary for the purposes described above, including while an account is active and afterward when needed for completed purchases, artist licenses, tax and accounting rules, fraud prevention, disputes, copyright records, backups, safety, and legal claims.

We retain a raw signup IP address for no more than 14 days while signup-risk processing is pending, then remove it and retain keyed pseudonymous account, device, exact-address, and network signals used to prevent repeat claims of the introductory price. After account deletion, we also retain a pseudonymous authentication-subject tombstone so a still-valid session cannot recreate the deleted account. A prior claim associated with the same pseudonymous signup address makes that address ineligible for the introductory price again, including on a shared connection; this does not prevent purchase of a membership. These signals are not used for advertising.

Retention periods vary by record type and jurisdiction. We consider the amount, sensitivity, purpose, legal requirements, and risk of harm. When information is no longer needed, we delete, anonymize, or securely isolate it, subject to backup cycles and lawful exceptions.

Codex Collective is based in the United States, and personal information may be processed in the United States and other countries where our service providers operate. Those countries may have different privacy laws.

Where required, we use recognized safeguards for international transfers, such as adequacy decisions, contractual protections, Standard Contractual Clauses, the UK Addendum, or another lawful mechanism. Users may contact us for information about applicable safeguards.

Depending on where you live, you may have rights to:

• know whether we process your personal information and obtain access to it;
• correct inaccurate information;
• delete information;
• receive a portable copy of certain information;
• restrict or object to certain processing;
• withdraw consent;
• opt out of sale, sharing, targeted advertising, or certain profiling;
• appeal our refusal of a privacy request; and
• complain to a privacy or data-protection authority.

Colorado residents may have rights under the Colorado Privacy Act, including rights of access, correction, deletion, and portability and rights to opt out of certain targeted advertising, sale, or profiling. urTrax does not currently sell personal data or process it for targeted advertising. Requests and appeals may be sent to rob@urtraxapp.com.

Residents of California and other states may have additional rights and disclosures concerning categories of personal information, sources, purposes, recipients, retention, and sensitive information. The categories described in Sections 2–5 are collected for the business and commercial purposes stated there.

urTrax does not knowingly sell or share personal information of users under 16 for targeted advertising and does not currently sell or share any user’s information for cross-context behavioral advertising. If our practices change, we will provide required notices and controls before applying the change.

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. No system is completely secure, and we cannot guarantee that unauthorized access, loss, or misuse will never occur. See our Security page for more information and contact rob@urtraxapp.com to report a suspected issue.

We may update this Policy as the Service, law, or our providers change. We will post the updated Policy and revise the effective date. We will provide additional notice or obtain consent for material changes where required.