Privacy

What We Collect

When you log in, we store your email address, email verification time, and the minimum account details needed to identify you in Unlox.

When you connect SoundCloud for a gated link, we store the SoundCloud account information required to identify that account in Unlox: your SoundCloud id, username, profile URL, and avatar URL when SoundCloud provides it.

We also store SoundCloud OAuth tokens server-side so Unlox can complete the actions you request, such as following an artist, liking a track, resolving a SoundCloud track URL, or refreshing an expired token. We do not expose those tokens to artists or fans. For fan gated-link unlocks, we discard the temporary SoundCloud token after the requested unlock action succeeds.

For artist tracks and links, we store the track file you upload, file name, file type, file size, title, slug, optional description, optional SoundCloud track or artist ids, link type, link token or slug, unlock requirements, expiration and use state, and basic timestamps.

For fan downloads, we store only what is required to unlock and deliver the file: the link used, the connected SoundCloud user when a SoundCloud step is used, an expiring download token, whether the download token was used, and basic timestamps.

What We Do Not Do

• We do not sell personal information.
• We do not run behavioral advertising or cross-site ad tracking.
• We do not give artists a list of fan identities by default. Artists see basic operational stats such as downloads.
• We do not ask for more SoundCloud data than the app needs to authenticate users and perform requested unlock steps.

How We Use Data

We use data to authenticate artists and fans, create and host tracks and links, verify requested SoundCloud like or follow actions, generate direct links, deliver downloads, prevent misuse, provide support, and maintain the security and reliability of Unlox.

Cookies

Unlox uses a signed, HTTP-only session cookie to keep you logged in, protect the SoundCloud authorization flow, and remember temporary download access after you complete a gate. We do not use advertising cookies.

Service Providers

Unlox uses SoundCloud for account authorization and requested SoundCloud actions, Cloudflare Workers and R2 for hosting and private file storage, and Supabase for the application database. These providers process data only as needed to operate the service.

Retention and Deletion

Download tokens expire quickly. Public gated-link download tokens currently expire after 30 minutes, direct-link download tokens currently expire after 24 hours, and timed links stop accepting new downloads when their link window expires. Artists can ask us to delete their account, tracks, links, and uploaded files. Fans can ask us to delete their connected SoundCloud account record or stored OAuth tokens.

We may keep limited records when required for security, abuse prevention, legal compliance, or to preserve aggregate product statistics that no longer identify a specific person.

Your Choices

You can disconnect Unlox from your SoundCloud account through SoundCloud. You can also contact us to request access, correction, deletion, or export of personal information associated with your Unlox email account or connected SoundCloud account.