Privacy

What We Collect

When you log in, we store your email address, email verification time, and the minimum account details needed to identify you in Unlox.

When you connect SoundCloud for a gate, we store the SoundCloud account information required to identify that account in Unlox: your SoundCloud id, username, profile URL, and avatar URL when SoundCloud provides it.

We also store SoundCloud OAuth tokens server-side so Unlox can complete the actions you request, such as following an artist, liking a track, resolving a SoundCloud track URL, or refreshing an expired token. We do not expose those tokens to artists or fans.

For artist gates, we store the track file you upload, the file name, file type, file size, title, slug, optional description, SoundCloud track or artist ids, gate requirements, friend link records, and basic timestamps.

For fan downloads, we store only what is required to unlock and deliver the file: the gate, the connected SoundCloud user when a SoundCloud gate is used, the friend link when a friend link is used, an expiring download token, whether the download token was used, and basic timestamps.

What We Do Not Do

• We do not sell personal information.
• We do not run behavioral advertising or cross-site ad tracking.
• We do not give artists a list of fan identities by default. Artists see operational gate stats such as downloads.
• We do not ask for more SoundCloud data than the app needs to authenticate users and perform the requested gate actions.

How We Use Data

We use data to authenticate artists and fans, create and host gates, verify SoundCloud like or follow actions, generate friend links, deliver downloads, prevent misuse, provide support, and maintain the security and reliability of Unlox.

Cookies

Unlox uses a signed, HTTP-only session cookie to keep you logged in and to protect the SoundCloud authorization flow. We do not use advertising cookies.

Service Providers

Unlox uses SoundCloud for account authorization and requested SoundCloud actions, Cloudflare Workers and R2 for hosting and private file storage, and Supabase for the application database. These providers process data only as needed to operate the service.

Retention and Deletion

Download tokens expire quickly. SoundCloud gate download tokens currently expire after 30 minutes, and friend-link download tokens currently expire after 24 hours. Artists can ask us to delete their account, gates, and uploaded files. Fans can ask us to delete their connected SoundCloud account record and stored OAuth tokens.

We may keep limited records when required for security, abuse prevention, legal compliance, or to preserve aggregate product statistics that no longer identify a specific person.

Your Choices

You can disconnect Unlox from your SoundCloud account through SoundCloud. You can also contact us to request access, correction, deletion, or export of personal information associated with your Unlox email account or connected SoundCloud account.