Privacy Policy

This Privacy Policy explains what personal data the Khmer Beat website and progressive web app at khmerbeat.com, and the Khmer Beat Android app — published on Google Play as Khmer Song Lite - Music Player — (together, the "Service") collect, why, and what choices you have. "Khmer Beat" and "Khmer Song Lite - Music Player" refer to the same product; this Policy uses "Khmer Beat" throughout. It applies to the Service operated by the Khmer Beat team ("Khmer Beat", "we", "us"). You can use most of the Service — browsing and streaming — without an account and without giving us any personal data. Some parts of this Policy apply only to the Android app, and are labelled as such.

1. Data we collect

Account data

When you create an account we collect your email address and display name, and an avatar image URL if you set one. Your password is handled by our authentication provider (Supabase); it is stored hashed and we never see it. If you sign in with Google or Facebook, that provider gives us your email address and basic profile information (such as your name and profile picture) in line with your account settings with that provider.

Content you create

Playlists you make (title, description and any cover image you upload), the songs you like, and the artists you follow. To make library pages load quickly we store a copy of the relevant track or artist title and artwork URL alongside these records.

Listening activity

When you are signed in, the Service records a play‑history entry (a track identifier and a timestamp) so features such as "recently played" work across sessions. A "recently played" list is also kept only in your browser and is not sent to us unless you are signed in.

Device and technical data

Local storage in your browser. The website and progressive web app save small preferences on your device: theme, language, layout preferences (sidebar, crossfade), volume, your last player session (last track, queue and position), the local "recently played" list, and your Supabase sign‑in session token. These stay in your browser.
No analytics trackers on the web. The website and progressive web app use no analytics trackers and set no cookies of their own for tracking.
Advertising on the website (Google AdSense). The website may show ads served by Google AdSense. Google and its partners may use cookies or similar identifiers to serve and measure ads, including personalized ads based on your visits to this and other websites. Where the law requires consent (for example in the EEA, UK and Switzerland) we ask for it before ads that use such identifiers load, and you can change your choice at any time. You can also opt out of personalized advertising at Google Ads Settings or learn how Google uses data from sites that use its services at policies.google.com/technologies/partner-sites. Ads are never shown inside the account, sign‑in or settings screens.
Provider logs. Our infrastructure providers (Cloudflare and Supabase) automatically log technical information such as IP address, browser/user‑agent, request time and requested URLs, to run the Service, keep it secure and prevent abuse.

Android app: analytics, crash reporting, ads and notifications

The Android app uses Google Firebase and, for ads, Google AdMob and the Meta (Facebook) Audience Network. Unlike the website and progressive web app, the Android app does show ads and does use analytics.

Analytics (Firebase Analytics). Usage data such as which screens and features you use, and basic device/app info (device model, OS version, app version, language, approximate location derived from IP), so we can understand how the app is used and improve it.
Crash and performance reporting (Firebase Crashlytics). When the app crashes or hits an error, we receive a crash report (stack trace, device model, OS version, app version) to help us find and fix bugs.
Advertising (Google AdMob and Meta Audience Network). The Android app shows ads served by Google AdMob and the Meta Audience Network. These partners may collect your device's advertising ID and other device/app information to select, serve and measure ads, and to limit how often you see the same ad. You can reset or limit ad personalization for your device at any time in Android Settings → Privacy → Ads.
Push notifications (Firebase Cloud Messaging). If notifications are enabled, Google's messaging infrastructure delivers them to your device using a device‑level messaging identifier managed by Google, not by us.
Local audio files. With the audio-files permission you grant, the app can read music files already stored on your device (for example, previously downloaded songs) in order to play them. We do not upload the contents of these files anywhere.

2. How we use data

authenticate you and keep you signed in;
save and display your playlists, liked songs, follows and listening history;
personalize what you see — like a "For You" selection of songs — based on your own plays, likes and follows. This stays private to your account: we never show your individual activity to other users, and when we use other users' activity to help compute your suggestions, it's only in aggregated, anonymized form (e.g. "N other people who liked similar songs also liked this one" — never anyone's identity or their list of songs);
provide, maintain and improve the Service and its features;
keep the Service secure and detect, prevent and investigate abuse or fraud;
respond to your questions and requests;
comply with legal obligations.

3. Legal bases

Where data‑protection law requires a legal basis, we rely on: performance of our agreement with you (providing the Service); our legitimate interests (securing and improving the Service); your consent (for Google or Facebook Sign‑In, Android app analytics and ad personalization where applicable, and any optional communications); and compliance with legal obligations. You can withdraw consent at any time — on Android, ad personalization can be limited in Android Settings → Privacy → Ads.

4. How data is shared

Service providers. Supabase — database, authentication and file storage (its infrastructure runs on Amazon Web Services). Cloudflare — hosting, content delivery, DNS and TLS. Google — if you choose Google Sign‑In, and, on the Android app only, Firebase (analytics, crash reporting, push notifications) and Google AdMob (ads). Meta / Facebook — if you choose Facebook Sign‑In, and, on the Android app only, the Meta Audience Network (ads).
No sale of data. We do not sell your personal data. The website and progressive web app may show Google AdSense ads as described above. The Android app shows ads through Google AdMob and the Meta Audience Network, which may collect device identifiers (such as your advertising ID) for ad selection and measurement, as described in "Android app: analytics, crash reporting, ads and notifications" above.
Legal and safety. We may disclose data if required by law or to protect the rights, property or safety of users, the public or Khmer Beat.
Business transfer. If the Service or its assets are transferred, data may be transferred as part of that transaction, subject to this Policy.

5. International transfers

Our providers operate globally, so your data may be processed in countries outside Cambodia, including the United States and the European Union. Those providers apply recognised transfer safeguards (such as Standard Contractual Clauses) where applicable.

6. Retention

We keep your account and library data for as long as your account is active. Play‑history records are kept on a rolling basis. Data stored in your browser stays until you clear it — signing out removes the session token; you can clear the other keys through your browser settings or "Clear site data". When you delete your account, we delete or anonymise your personal data within 30 days, except where we must retain limited records to meet legal obligations.

7. Your choices and rights

Depending on where you live, you may have the right to access, correct, delete, export, object to or restrict processing of your personal data, and to withdraw consent.

Within the app you can already:

edit your display name and avatar in your profile;
create, rename and delete playlists, and remove tracks from them;
remove songs from Liked Songs and unfollow artists;
sign out, which clears the local session on that device.

To access or export all of your data, or to delete your whole account, email support@khmerbeat.com from your account email address. We will respond within 30 days. You may also lodge a complaint with your local data‑protection authority.

8. Security

Each user's rows are protected by database row‑level security, so you can only read and write your own data. All traffic is served over HTTPS with HSTS, and the app enforces a strict Content‑Security‑Policy. Only the public "publishable" API key is used in the browser — never a privileged key. No method of transmission or storage is completely secure, but we work to protect your data.

9. Children

The Service is not directed to children under 13 and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact us and we will delete it.

10. Do Not Track

The website and progressive web app do not track you across other websites or services, so a browser "Do Not Track" signal does not change anything about how they behave. The Android app's ad partners (Google AdMob and the Meta Audience Network) may use your device's advertising ID for ad personalization across apps, which you can limit at any time in Android Settings → Privacy → Ads.

11. Changes to this Policy

We may update this Policy from time to time. We will change the "Last updated" date above and, for material changes, give notice through the Service.

12. Contact

Questions or requests about your privacy: support@khmerbeat.com or piseysen@gmail.com.