Privacy Policy

Information we collect

This may include account and profile information, seller details, purchases and order records, support and copyright submissions, technical or device information, and information required to operate downloads and marketplace features.

Google Sign-In: information we access and why

Google Sign-In is an optional way to register or sign in to a Remix District buyer or seller account. When you select Continue with Google and authorize access, we request the openid, email and profile permissions. Google returns basic profile information; our sign-in process reads your email address, name and profile picture URL. We do not receive your Google password. We do not request access to your Gmail messages, Google Drive files, contacts, calendars or other Google Workspace content.

• Email address: identify and create or locate your Remix District account for the buyer or seller role you selected, and provide account-related communications.
• Name: populate your account profile. Sellers choose a separate public artist name during registration.
• Profile picture URL: supply an initial account avatar. A subsequent Google sign-in does not replace a profile photo you have already saved.

We associate these details with your Remix District user ID, account role and authentication method. Your account is used to manage purchases, downloads, seller releases, earnings and support. Google-derived identity information is not used to access additional Google services on your behalf.

For a Google Sign-In privacy question or deletion request, use our Support form or email support@remixdistrict.com. The retention, sharing, security and deletion sections below expressly apply to information obtained from Google.

Google data storage and sign-in tokens

We store your Google-derived email address, name and profile picture URL in the Remix District account database hosted on MongoDB Atlas. This information remains associated with your buyer or seller account; signing out or disconnecting Google does not automatically erase the account record.

The backend exchanges the one-time Google authorization code for an access token and uses that token to retrieve your basic profile over HTTPS. The sign-in implementation does not save Google access tokens or refresh tokens in the account database and does not request continuing access to Google data while you are offline.

For a new seller who still needs to choose an artist name, the basic profile is temporarily carried in a signed registration token that expires after five minutes. After successful sign-in, Remix District issues its own signed session token. That token expires after 24 hours and may be renewed while you remain signed in. Your browser stores the Remix District session token, account ID and role locally; signing out removes those session values.

Sharing and permitted use of Google user data

We use Google-derived account information to provide and maintain the Remix District features described in this policy. We do not sell or rent Google user data, disclose it to data brokers, or use it for advertising, credit decisions, lending, surveillance, or training general-purpose artificial intelligence or machine-learning models.

• Infrastructure providers process information needed to operate the service: Railway runs our API, MongoDB Atlas stores account records, and Vercel serves the website. These services may process account information or technical request information needed for their functions.
• Our email provider, Resend, processes recipient addresses and message content when we send account, transaction or support emails. Payment providers process the checkout information needed to carry out purchases; using Google Sign-In does not grant them access to your Google account.
• Authorized Remix District administrators may access account information to provide support, administer buyer and seller accounts, investigate fraud or security incidents, and handle disputes or legal obligations. We may disclose relevant information when required by applicable law or a valid legal process.
• Seller artist names and profile images are public marketplace information. If a seller keeps the Google-supplied avatar, that image can appear publicly. Buyer usernames may be derived from the email address at registration; the public purchase feed uses a masked username with the purchased release title.

We do not provide service providers with your Google password or ongoing access to your Google account. Our use of information received from Google APIs follows the Google API Services User Data Policy, including applicable Limited Use requirements. Google information is not used for a new purpose outside this policy without the required disclosure and consent.

How we use information

• Operate accounts, purchases, downloads, seller tools, earnings, and withdrawals.
• Confirm payments and maintain transaction records.
• Prevent fraud, abuse, duplicate transactions, and unauthorized access.
• Provide support and handle copyright or marketplace disputes.
• Maintain analytics, reliability, security, and platform operations.
• Comply with legal obligations and valid rights-holder requests.

Payments

Payments may be processed by third-party payment providers such as Maya. Payment providers process payment credentials under their own terms and privacy practices. Remix District receives the transaction information necessary to confirm and manage orders.

Marketplace information

Seller aliases, profile images, public social information, releases, genres, and other catalog information may be intentionally displayed publicly as part of the marketplace.

Service providers

Information may be processed by providers supporting hosting, database infrastructure, file storage, payments, email, analytics, security, and other operations necessary to run Remix District.

Cookies & local storage

Remix District may use browser storage and similar technologies to maintain sessions, preferences, cart state, interface settings, and other functionality.

How we protect your information

These protections apply to Google-derived account information and other personal information processed by Remix District:

• Encryption in transit: the public website and API use HTTPS, and the sign-in server communicates with Google over HTTPS. MongoDB Atlas requires encrypted TLS connections to the database.
• Encryption at rest: our MongoDB Atlas database uses the provider's default encryption for stored data. This is infrastructure encryption; it does not mean public profile information is hidden from marketplace visitors.
• Access controls: protected application functions require signed, expiring session tokens. Role and account-status checks restrict administrative and seller functions. Administrative account management requires an administrator role.
• Credential handling: Google client credentials stay on the server. Google-only accounts do not have a local Google password stored by Remix District. Passwords for native email/password accounts are stored as salted bcrypt hashes.

No system can guarantee absolute security. Keep your Google account, email and devices secure, sign out on shared devices, and report suspected unauthorized account access to support@remixdistrict.com. Never include passwords, session tokens or Google access tokens in a support request.

Data retention and deletion

Google-derived email, name and profile picture information is retained with your account while it is needed to provide access to your account and its marketplace records. We do not automatically delete buyer or seller accounts merely because they are inactive, signed out, or disconnected from Google. Deletion is handled through the request process below.

Google access and refresh tokens are not retained in the account database. A pending seller registration token expires after five minutes. Remix District session tokens expire after 24 hours unless renewed; signing out clears the session values from your browser.

Account deletion and transaction-record retention are separate. Order and payment records, download entitlements, seller earnings and payouts, support correspondence, fraud or security evidence, and dispute or copyright records may need to be retained after an account request so that we can resolve outstanding transactions, protect other users' purchases, investigate abuse, or comply with legal obligations. Retention depends on the record and the reason it remains necessary; there is no single automatic deletion period for every category.

A deletion request is reviewed for the specific account and records involved. We explain any information that must remain and the reason for retaining it when responding. Removal from the active account does not necessarily remove copies already present in provider logs, support email or recovery copies at the same moment. Such copies remain subject to the relevant operational and retention requirements; revoking Google access alone is not a deletion request.

Request access, correction or deletion

To request a copy or correction of your personal information, deletion of Google-derived information, or closure of your Remix District account, email support@remixdistrict.com or open our Support form. Select Account and use the subject Google Sign-In privacy request or Account deletion request. Include your account email, whether you are a buyer or seller, and the information or account you want us to review. You can contact Support without signing in.

We verify that the request concerns your account before making changes. We may ask you to reply from the registered email address or provide relevant account or transaction details. Do not send your password, payment-card credentials or authentication tokens. Support will confirm the scope of the request, explain any records that must be retained, and coordinate the account changes. Account closure can affect sign-in, downloads, published seller releases and access to earnings records; we review those dependencies before taking action.

You can also revoke Remix District's Google connection in your Google Account under connections to third-party apps and services. Revocation stops that Google authorization but does not delete information already held by Remix District. If Google is your account's sign-in method, contact Support before disconnecting it. Signing out, deleting browser storage and revoking Google access do not themselves erase purchases or close the Remix District account.

Available privacy rights depend on your location and applicable law. You may contact us to ask about or exercise those rights. We will not ask you to create a replacement account to submit a privacy request.

Facebook Page automation

When you comment a configured keyword on a selected Facebook post or Reel from Remix District or an approved artist Page, our automation may send one private Messenger reply and a public reply to your comment. We process the Page, post, comment and commenter identifiers, the displayed commenter name, comment content, timestamps, and reply status or error information to match the request, provide the reply, prevent duplicates, and investigate delivery problems.

Automation records are stored using Cloudflare and are available to authorized Remix District administrators. Approved artists or their Page managers can authorize a Page connection; Page credentials and temporary authorization choices are encrypted in Cloudflare storage and are never shown in the admin dashboard. Campaign management remains restricted to Remix District administrators. Disconnecting the app through Facebook revokes connected artist Page access; a Facebook data-deletion request removes the associated artist Page automation records held by Remix District. Meta processes Facebook comments and Messenger messages under its own privacy practices.

Processed webhook payloads are eligible for removal after two days. Completed and other closed delivery records are eligible for removal 90 days after they were created. Pending, in-progress, and unresolved delivery records are retained until they can be completed or reviewed; scheduled cleanup may take additional time.

Facebook data deletion

To request deletion of Facebook-related automation data held by Remix District, open our Support form, select the Account category, and use the subject Facebook data deletion. Include your Facebook profile or comment link, the relevant Remix District or approved artist Page post or Reel link, and the approximate date of the interaction so we can locate the records. Provide a contact email for follow-up. Do not send your Facebook password or access tokens.

We may ask for information needed to verify that the request concerns your data before removing the associated automation records. Deleting these records does not automatically delete comments or messages stored by Facebook or Messenger; use Facebook or Messenger controls to manage those copies.

Changes to this policy

We update this policy when our service or data handling changes and display the revised date here. If we intend to access additional Google data or use it for a new purpose, we will provide the required notice and obtain the required consent before that new access or use. Privacy questions and requests can be sent to support@remixdistrict.com.