Privacy Policy
Effective date and last updated: 3 November 2026
This policy explains how the Saints of the Broken — Find Your Song app (the website at music-saintsofthebroken-com.lovable.app and its Android/home-screen versions) handles information.
Who is responsible
The app is provided by Saints of the Broken, a music project created by Lydonlee Farrugia in Malta, who is the controller of the information described here. Contact: thesaintsofthebroken@gmail.com.
Using the app without an account
You do not need to sign up or sign in to choose a mood, receive a song, read the free library chapters, browse merchandise or read the daily healing words.
What we collect and why
- Usage events. When you use the app, it sends events to our server such as a page visit, the mood you chose, the song shown, which listening platform you tapped (for example Spotify, Apple Music, YouTube or Amazon Music), taps on Amazon purchase links, and taps on official merchandise products (including the product and the page it was tapped from). We use this to understand which songs and moods help people and to improve the app.
- Session identifier. These events include a random identifier created in your browser for the current session. It is not your name or email, but it can link events from the same session.
- Campaign information. If you arrive through a link containing campaign tags (UTM parameters such as source, medium or campaign), those tags are stored with the events so we know which links people use.
- Technical data. Like any website, our hosting and infrastructure providers may process technical information such as your IP address, browser type and request times in order to deliver pages and keep the service secure.
- App accounts. Public email/password sign-up is available for accounts intended for team and administrator access through our managed account service. Account information includes your email address and authentication records. Signing up does not grant administrator access; only authorised team accounts can manage the catalogue. Public music discovery does not require an account.
Contact messages
If you use the Contact Us form, we receive your name, email address, chosen subject and message. Our server sends them by email to our team (through our email delivery provider) and keeps a copy in our database, together with a scrambled, non-reversible code derived from your network address that is used only to limit repeated sending and spam. We use your message only to read and reply to it. Sending a message does not add you to any mailing list or newsletter. Contact messages are retained and deleted manually, as described below.
About moods and feelings
The moods you choose (such as Heartbreak or Healing) may reflect personal feelings. We use them only to suggest a song and to count, in aggregate, which moods are chosen. We do not use them to diagnose, profile or make decisions about you, and the app is not a health or counselling service.
Stories
This app does not collect written stories. The “Turn My Story Into a Song” option opens the official Saints of the Broken website in a new tab, where its own terms and privacy practices apply.
Storage on your device
The app stores small items in your browser’s session or local storage: the session identifier and campaign tags (cleared when you close the tab), which songs and merchandise you have already been shown (so you see new ones), and your last-read chapter in the free library. These stay on your device. You can remove them by clearing your browser’s site data.
Purchases and external services
The app does not process payments. Merchandise, e-books and support memberships are sold through our official Shopify store; tapping those links takes you to Shopify, which handles checkout and your purchase details under its own privacy policy. Earlier versions offered an optional Shopify customer sign-in to read purchased chapters; this feature has been retired and purchased books are now delivered by Shopify.
Links to Spotify, Apple Music, YouTube, Amazon and Amazon Music, Facebook, Instagram, Google Drive (app download) and our official website open services we do not control. Their own privacy policies apply once you visit them.
Service providers
We use Lovable (app hosting, built on cloud infrastructure) and its managed database and storage service to run the app and store usage events. Product information and images are loaded from our Shopify store. These providers process data on our behalf or as independent services under their own terms.
Sharing
We do not sell your information. We share it only with the providers above as needed to run the app, or where required by law.
Security
The app is served over HTTPS, usage events are written only through our server, and team tools are restricted to authorised accounts. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
Retention and deletion
We do not currently run a fixed automatic deletion schedule or promise a fixed processing deadline. Usage events are retained while needed to understand app usage; the retention period and removal of records are handled manually rather than automatically. Because events are tied only to a random session identifier, we may be unable to identify your events; contact us and we will help where reasonably feasible.
You can request permanent deletion of your app account and associated personal data, or request deletion of data associated with you where feasible, without signing in or having the app installed. Email requests are handled manually after support verifies ownership through the account email. Never share your password. Support follows up about the request and outcome.
Records may need to be retained where legally required or reasonably necessary for security, fraud prevention, compliance or legal claims; support will explain applicable limits. Immediate removal from backups is not guaranteed. Shopify store customer accounts, purchases and subscriptions are separate and must be handled by the external store’s support; we do not delete third-party accounts through this app-account process.
Your rights (EU / GDPR)
Depending on where you live, including in the European Union, you may have the right to access, correct, delete or restrict the use of your information, to object to processing, and to data portability. We rely on our legitimate interest in running and improving the app for usage events. To make a request, email thesaintsofthebroken@gmail.com. You may also complain to a data protection authority; in Malta this is the Information and Data Protection Commissioner (IDPC).
Children
The app is not directed at children under 13 and we do not knowingly collect information from them.
Changes
We may update this policy. The date at the top shows when it last changed.
Contact
Privacy questions or requests: thesaintsofthebroken@gmail.com