SingArena —

Privacy Policy

Last Updated: October 21, 2026

Effective Date: October 21, 2026

legal.bindingNotice legal.viewPolish

1. Introduction

SingArena ("Platform", "we", "us", or "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you access or use the SingArena platform, including our website, web application, Android mobile application (built with Capacitor and distributed via Google Play and other channels), desktop applications for Windows, macOS, and Linux (built with Electron as a wrapper around the web application), APIs, and all related services. SingArena is operated by TC Szabla LLC, a Wyoming limited liability company. This Privacy Policy is designed to comply with the United States privacy framework applicable to our operations, the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA) for California residents, the EU General Data Protection Regulation (GDPR) and the UK GDPR for users located in the EU/EEA and the United Kingdom (under the extraterritorial scope of Art. 3(2) GDPR), the Brazilian LGPD, the Canadian PIPEDA, the U.S. Children's Online Privacy Protection Act (COPPA) for users under 13, and other applicable data protection laws of the user's country of residence.

By creating an account or using the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and processing of your personal data as described herein. If you do not agree with this Privacy Policy, you must not use the Platform.

2. Data Controller

The data controller responsible for the processing of your personal data collected through the Platform is: TC Szabla LLC, 30 N Gould St Ste 23157, Sheridan, WY 82801, USA. For any questions regarding this Privacy Policy or our data processing practices, you may contact us at: info@singarena.com.

3. Categories of Personal Data Collected

We collect the following categories of personal data:

3.1 Account Information

3.3 Usage Data

3.4 Content Data

3.5 Communication Data

3.6 Social Data

3.7 Device Information

3.8 Payment Data

3.9 Advertising Data

4. Legal Bases for Processing

We process your personal data based on the following legal grounds:

5. How We Use Your Data

We use your personal data for the following purposes:

5A. Public Profile & Social Features

SingArena is a social platform. By creating an account, certain information about you is publicly visible to other users of the Platform:

You can manage certain visibility settings in your profile preferences. However, your username and avatar are always visible as they are essential for the social functionality of the Platform.

5A.1 Three-Tier Visibility Control for Sensitive Fields

Sensitive profile fields (date of birth, country, contact details, real first and last name) feature a three-tier visibility control: Public (visible to everyone), Friends only (visible only to users with an accepted friendship relationship) or Private (visible only to the account owner). New fields default to the most restrictive setting in line with the privacy by default principle (GDPR art. 25). Settings can be changed at any time under Profile → Settings → Privacy.

5A.2 Presence Status

The Platform displays user presence status (online / away / offline) to support messaging, gaming invitations and voice calls. Status is visible to authenticated users (and to friends on the friends list). It expires automatically after a period of inactivity. Status is not archived historically.

5A.3 Completing Your Real Name After Login

For accounts created before the introduction of first-and-last-name validation (or via Google OAuth without these fields), the Platform may display a one-time prompt asking you to complete this information. Providing it is optional (a "Later" button defers the request). Purpose: improving friend discoverability. Legal basis: GDPR art. 6(1)(b) (performance of contract — social features).

5A.4 Wallpapers and Home Screen Personalization

User-uploaded home screen wallpapers and personalization files (tile layout, equalizer profiles, theme, language, visualizer mode) are stored in a private Cloudflare R2 bucket or in your device's local storage. They are visible only to the account owner and are not shared with other users or advertising providers.

5B. Email Communication and Marketing

We send the following categories of emails from the mail.singarena.com domain:

Every non-transactional email contains an "Unsubscribe" link and a one-click List-Unsubscribe header in line with the 2024 Gmail/Yahoo bulk-sender requirements. Suppression lists are retained indefinitely to prevent delivery to addresses that have opted out.

6. Data Sharing and Disclosure

We do not sell your personal data. We may share your data in the following circumstances:

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide you with the Platform's services. Specific retention periods include:

After the applicable retention period, data is securely deleted or anonymized so that it can no longer be associated with you.

8. Your Rights

Under applicable data protection laws, including the GDPR, you have the following rights:

To exercise any of these rights, please contact us at: info@singarena.com.

9. Data Security and Access Control

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include, but are not limited to: encryption of data in transit (TLS/SSL); secure password hashing; Row-Level Security (RLS) policies enforced at the database level ensuring users can only access their own data; a dedicated user_roles table with a strict app_role enum (admin, moderator, user) and a SECURITY DEFINER server-side has_role() function used to authorize sensitive operations — privilege checks are never performed on the client to prevent escalation; isolation of sensitive personal fields from the publicly readable profile view; multi-factor session validation; access controls and authentication mechanisms; automated copyright screening (ACRCloud) with a zero-tolerance block-on-match policy; AI-powered content moderation (text and image) operating on a fail-closed principle; regular security assessments; and monitoring for unauthorized access. However, no method of transmission over the Internet or method of electronic storage is completely secure, and we cannot guarantee absolute security.

9.1. Communications Encryption (Chat & Calls)

Voice and video calls (1:1, Stage, Hangouts) use the WebRTC protocol with mandatory media encryption via SRTP (AES-128) and signalling encryption via DTLS. Call content is encrypted between participants — even when traffic is relayed through our TURN server (Metered.ca) or SFU (LiveKit), the relay operator cannot decrypt audio or video streams. In practice this provides end-to-end (E2EE) protection for 1:1 calls.

Text messages (DMs, group chats, squads, comments) and attachments (images, voice notes) are encrypted in transit (TLS 1.2/1.3) between your device, our backend, and our media storage (Cloudflare R2). On the server, messages are stored in plaintext (we do not provide end-to-end encryption for text messages). Access is restricted by RLS policies — only conversation participants can read a message. We do not read private messages; content may only be processed automatically for: (a) on-demand translation requested by the user (DeepSeek, with PII protection), (b) moderation of content reported to Trust & Safety, (c) compliance with legal obligations (e.g. valid law-enforcement orders).

You can delete your own messages at any time in 1:1 chat (long-press the message → "Delete"). Deletion is irreversible and removes the record from the database. To permanently remove your full message history together with your account, use the account deletion option in Settings.

10. International Data Transfers

Our primary infrastructure (database, authentication, server functions and audio storage) is operated by Supabase on Amazon Web Services in the United States (us-east-1, Northern Virginia), and SingArena is operated by a United States company. Your personal data is therefore processed in the United States and may also be processed in other countries, including by service providers such as Cloudflare (hosting, content delivery and storage), Stripe (payment processing), Google (advertising, push notifications, analytics, sign-in and app-store billing), Apple (sign-in, purchases and push notifications), PostHog (product analytics, EU), Sentry (error monitoring), LiveKit (real-time audio and video), ACRCloud (audio recognition), CloudConvert (audio transcoding), Metered.ca (WebRTC TURN relay), Resend (email delivery), DeepSeek (text generation, translation and moderation), OpenAI (image moderation), Runware (image generation), ElevenLabs (speech-to-text and text-to-speech), and Replicate (audio processing). Where such transfers occur, we ensure that appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission or other mechanisms recognized under applicable data protection laws, to ensure an adequate level of protection for your personal data.

11. Children's Privacy

The Platform is not directed to children under the age of thirteen (13). We do not knowingly collect personal data from children under thirteen. The registration process requires users to provide their date of birth, and accounts cannot be created for individuals under the age of thirteen. If we become aware that we have collected personal data from a child under thirteen without verification of parental consent, we will take steps to delete such data promptly.

Where data of minors is processed. If you are under 18, your data is handled in the same places as everyone else's. In plain terms: your account, profile, messages and recordings are stored in the United States (Supabase on Amazon Web Services, us-east-1 region). Some features also send data to AI services: messages you ask us to translate, your voice in pronunciation exercises (speech recognition), and content checked by our automatic moderation. These services may process the data in the United States or other countries. Section 10 describes how we protect these transfers.

12. YouTube Embedded Content

SingArena uses the YouTube IFrame Player API to embed and play music videos directly within the Platform. When you play a YouTube video on SingArena, Google (YouTube) may collect data about your interaction, including your IP address, device information, video viewing history, and cookies. This data is collected and processed by Google in accordance with the Google Privacy Policy.

By using SingArena, you agree to be bound by the YouTube Terms of Service. YouTube content is provided by YouTube, LLC, a subsidiary of Google LLC. SingArena does not host, store, or redistribute YouTube video content — all video playback is streamed directly from YouTube's servers via the official embedded player.

YouTube may use cookies and similar technologies to personalize content and ads shown during video playback. You can manage your Google ad preferences at Google Ads Settings.

13. Google AdSense Advertising

SingArena displays advertisements to users on the Free Plan through Google AdSense. Google AdSense uses cookies and web beacons to serve ads based on your prior visits to our Platform and other websites. Google may collect and use data including your IP address, browser type, device information, and browsing activity to provide personalized advertisements.

You can opt out of personalized advertising by visiting Google Ads Settings or by visiting aboutads.info. Premium subscribers do not see advertisements.

For more information about how Google uses data from sites that use their services, please visit Google's Partner Sites Policy.

14. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to operate and improve the Platform. For detailed information about our use of cookies, please refer to our Cookies Policy.

14a. Google Play & Android Mobile Application

Our Android application is distributed via the Google Play Store and is built using the Capacitor framework as a wrapper around our web application. This section provides additional disclosures required by Google Play's User Data Policy and the Data Safety form.

14a.1 Data Collected by the Mobile App

The Android app collects and processes the same categories of personal data described in Section 3 of this Policy, plus the following mobile-specific data:

14a.2 Android Permissions Requested

The app requests the following Android runtime permissions, each tied to a specific user-facing feature:

We do not request: precise location (GPS), contacts, SMS, call log, calendar, body sensors, or any background location access. You may revoke any permission at any time in Android Settings → Apps → SingArena → Permissions; the related feature will then be disabled.

14a.3 Google Play Data Safety Disclosures

For the Google Play Data Safety form we declare:

14a.4 Children & Google Play Families

SingArena is not directed to children under 13 and is not enrolled in the Google Play Families program. Our Play Store target audience is users aged 13 and over (with parental consent where required by local law, e.g. 16 in parts of the EU under GDPR Art. 8). The app contains user-generated audio and text content; explicit songs are flagged with the is_explicit metadata and may be filtered. Ads served on the Free Plan via Google AdSense are not targeted to children.

14a.5 In-App Subscriptions on Google Play

If you purchase the Premium subscription via Google Play Billing, the transaction is processed by Google and is subject to the Google Play Terms of Service. SingArena receives only the order confirmation needed to unlock Premium on your account; we do not see your payment card data. Cancel or manage subscriptions in the Google Play app: Profile → Payments & subscriptions → Subscriptions.

14b. Recent Feature Updates (May 2026)

The following features have been added or expanded since the previous version of this Policy:

The legal bases listed in Section 4 apply to these features. No new categories of processors have been introduced beyond those listed in Section 6.

14c. Recent Feature Updates (May 20, 2026)

Since the previous revision of this Policy, the following functionality has been added or expanded. No new categories of processors have been introduced beyond those listed in Section 6, except where expressly noted below.

The legal bases listed in Section 4 apply to these features. The only new sub-processor that may receive content as a result of these updates is DeepSeek (for Premium lyrics translation), which is already listed in Section 6.

14d. Recent Privacy Updates (June 17, 2026)

The following processing operations have been clarified or added since the previous revision. No new sub-processors beyond those listed in Section 6 are introduced, except where expressly noted.

14e. School Module (formerly "Coach"): Lessons, Workshops and Teaching Materials

The School module (shown in the app as "School", previously "Coach") lets users act as teachers ("Coaches") or learners ("Students") across a wide range of subjects — music and performance, foreign languages, school and academic subjects (for example mathematics, physics, chemistry, biology, computer science, history), visual and creative arts, and general life skills. Participation is optional and requires a separate role application. When you use the Coach module we process the following additional data:

Legal basis. Delivery of lessons, workshops, materials and recordings is processed on the basis of contractual necessity (Art. 6(1)(b) GDPR). Recording of a lesson is based on the consent of the participants (Art. 6(1)(a) GDPR) and can be declined. Fraud prevention, moderation and dispute handling rely on our legitimate interests (Art. 6(1)(f) GDPR).

Retention. Lesson bookings, homework and progress data are retained for as long as the Coach–Student relationship exists and for up to 24 months afterwards for dispute and accounting purposes. Lesson recordings are retained according to the retention policy of your plan (Free: not stored; Premium School and Premium All: 30 days; Premium All Max: 90 days plus up to 10 pinned recordings); recordings that are not pinned are deleted automatically once the retention window expires, and pinned recordings (limited in number for eligible plans) are kept until you unpin or delete them, subject to a 60-day grace period after a plan downgrade or expiry. Teaching materials are retained until the Coach deletes them or closes the Coach role.

Payments for lessons and workshops. Published prices are optional and informational. Payment arrangements are made directly between the Coach and Student or guardian, outside SingArena. SingArena does not process these payments or collect payment credentials, transaction identifiers, refund records or payout details for them. Any external payment service handles personal data under its own privacy policy.

Resigning from a role. You may resign from the Coach or Student role at any time from within the module. Resigning deactivates the role and hides the related public profile; it does not delete your SingArena account, which is deleted separately (see Section 7).

14f. Guardian Consent and the Guardian Dashboard

Where a user is a minor under the law of their country of residence, certain features (in particular paid lessons, 1:1 lessons with a Coach, and recorded sessions) require verifiable consent from a parent or legal guardian. SingArena uses an "email-plus" consent mechanism. No payment card, micro-charge or Stripe verification is used in this flow.

In connection with guardian consent we collect and process:

Guardian Dashboard. Once consent is granted, the guardian may access a read-only dashboard at /guardian and /guardian/student/:id. The dashboard displays only the minor's learning activity: upcoming and past lessons, practice history, homework and submissions, progress statistics and lesson recordings that relate to the linked minor. The guardian cannot read the minor's private messages, social content or unrelated account data, and cannot post or act on the minor's behalf. Guardian access is enforced at database level by row-level security tied to the verified guardian link.

Legal basis. Art. 6(1)(c) and Art. 8 GDPR (legal obligation to obtain parental consent for children's services), COPPA for users under 13, and our legitimate interest in retaining proof of consent.

Retention and withdrawal. The consent record (including the IP address and user-agent of the consenting guardian) is retained for the lifetime of the minor's account and for 24 months after its deletion, as evidence of lawful processing. A guardian may withdraw consent at any time from the guardian dashboard or by writing to info@singarena.com. Withdrawal takes effect immediately: the guardian link is removed, guardian dashboard access ends, and the minor loses access to the features that required consent. On request, the guardian's email address is erased from our systems once the consent record no longer needs to be evidenced; the guardian may also request erasure of their own personal data independently of the minor's account.

14g. Squad: Separate Identity, Channels and Events

Squad uses a separate identity from your main SingArena profile. When you first enter Squad you create a Squad identity (display name and avatar) that is stored independently of your SingArena nickname, avatar, first and last name. Inside Squad — including in text channels, voice channels, Stage channels, direct messages and moderation views — other members see only your Squad identity. Your SingArena identity is not shown, not linked, and not derivable by other members. Only the Platform Administration can associate the two identities, and only for security, abuse-handling and legal-compliance purposes.

Internal identity link. To deliver the separate-identity promise we keep an internal record that links your Squad identity to your SingArena account (the same account identifier). This link is never exposed to other members or third parties. It is visible only to the Platform Administration in the administration panel for moderation, abuse-handling, security and legal-compliance purposes (for example, to act on a report or to enforce a ban), and it appears in the copy of your data you receive when you exercise your GDPR right of access or portability (your data export contains both your SingArena profile and your linked Squad identity). Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in operating a safe service and fulfilling data-subject requests (Art. 15 and 20 GDPR).

LiveKit masking. Squad voice, Stage and hangout channels run over LiveKit. Access tokens issued for Squad rooms carry only the anonymised Squad identity, never your SingArena user name or profile data, so your main identity is not exposed to other participants or in room metadata.

In the Squad module we additionally process:

Inactivity pruning. A Squad owner may enable automatic removal of inactive members after a configurable period (14 to 365 days). If enabled, members with no measurable activity in that period are removed from the Squad and may receive a re-engagement notification before or after removal. Owners and moderators are never pruned. Pruning removes your membership and Squad-scoped state; it does not delete your SingArena account and does not affect your main profile.

Retention. Squad messages and channel content are retained while the Squad exists or until deleted by you, a moderator or the owner; disappearing messages are purged automatically on the schedule set for the conversation. Squad identity data is deleted together with your SingArena account.

14h. Duels, Battles and Competitive Integrity

1v1 Duels and Battles are optional competitive karaoke modes. In connection with them we process matchmaking data (mode, category, opponent, timestamps), performance scores computed on our servers, the outcome of each duel, streaks and duel badges, and the daily counters used to enforce session and experience-point limits.

Soundcheck. Before a Duel or Battle you are asked to complete a short microphone soundcheck. The soundcheck analyses your microphone signal locally in your browser or application and derives only a loudness value (RMS). No audio is recorded, transmitted or stored during the soundcheck. The result is cached on your device for approximately 30 minutes so that the check is not repeated for every match.

Fair play and anti-fraud. Scores, session limits, experience points and rewards are calculated exclusively on our servers and cannot be set or altered by the client application. We apply daily caps on karaoke sessions and on experience points, and we analyse activity patterns (for example repeated identical submissions, abnormal submission velocity, or multiple accounts operated from the same device) to detect manipulation of leaderboards and rewards. Detected manipulation may lead to score invalidation, loss of rewards, and enforcement action under the Terms of Service. This processing is based on our legitimate interest in maintaining a fair competitive environment.

14j. Mobile Advertising: AdMob and App Tracking Transparency (iOS)

In our mobile applications, advertisements shown to users on the Free Plan are served by Google AdMob (banner, interstitial and rewarded formats). AdMob may collect an advertising identifier, coarse device and app information, and ad interaction events, in accordance with the Google Privacy Policy. Advertisements are never shown during karaoke performances, audio playback or YouTube playback.

iOS App Tracking Transparency. On iOS, before any data is used to track you across apps and websites owned by other companies for advertising or measurement purposes, the application presents Apple's App Tracking Transparency (ATT) prompt and requests your permission. If you decline, the identifier for advertisers (IDFA) is not accessed and no cross-app tracking takes place; you will still see advertisements, but they will be non-personalised. You can change this choice at any time in iOS Settings → Privacy & Security → Tracking. On Android, an equivalent choice is offered through your Google advertising settings and, in applicable regions, through our consent management prompt.

We do not sell personal data. For California residents, the sharing of advertising identifiers with advertising partners may qualify as "sharing" for cross-context behavioural advertising under the CPRA; you may opt out as described in Section 8 or by declining the ATT prompt.

14k. Recent Privacy Updates (August 28, 2026)

14l. Recent Privacy Updates (October 2026)

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on the Platform and updating the "Last Updated" date. Your continued use of the Platform after the posting of changes constitutes your acceptance of such changes. We encourage you to review this Privacy Policy periodically.

16. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us at: info@singarena.com.

Data Controller: TC Szabla LLC, 30 N Gould St Ste 23157, Sheridan, WY 82801, USA.