Privacy Policy - K-Pop Today

Operated by Soundica. Effective 2026-09-09. Version 1.4.

This policy explains what information the K-Pop Today application (the "App") processes, why, and your rights under applicable laws including the EU/UK GDPR, the California Consumer Privacy Act (CCPA/CPRA), Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec's Law 25, the Korean Personal Information Protection Act (PIPA), Japan's APPI, Singapore PDPA, Brazil's Lei Geral de Proteção de Dados (LGPD), India's Digital Personal Data Protection Act, 2023 (DPDP Act), and the Australian Privacy Act.

1. Data we collect

The App is designed to work without a user account and without tracking identifiers. Specifically:

• No account, no login, no email. We do not require you to sign up.
• No advertising identifiers. We do not read the Android Advertising ID.
• No analytics SDKs, no crash-reporting SDKs by default. If a future version adds optional analytics, you will be asked for consent first.
• No contacts, no location, no microphone, no camera, no SMS, no call logs. The App does not request these permissions.

2. Data processed when you use the App

• News feed requests. On phones, tablets, and Android Automotive, when the App refreshes the feed it sends requests directly to each publisher's RSS feed (Seoulbeats, Billboard K-pop, The Bias List, Variety K-pop, Rolling Stone K-pop, and similar K-pop and entertainment outlets across the language pools you select). Those requests contain only a generic app User-Agent and (inevitably at the transport layer) your device's public IP address, which the publishers may log under their own privacy policies. On FORVIA AOSP head units the App instead reads a pre-assembled feed from the Soundica backend (hosted on Cloudflare); that request contains only the feed name, a generic app User-Agent, and your device's public IP address at the transport layer. We do not store IP addresses or request logs beyond what Cloudflare retains for security / abuse-prevention purposes (typically short-lived, see Cloudflare's policy).
• Discovery via Google News. The App may also discover headlines through Google News topic and region queries (public RSS). The same transport-level note applies: the request carries a generic app User-Agent and your device's public IP address. Google's own privacy practices apply to their servers. Social-media and user-generated-content sources are blocked.
• Images and articles. When you view a story thumbnail, your device fetches the image from the original publisher's CDN. The App does not embed or open the publisher's website: articles are presented as a headline plus a short attributed snippet only. Publisher CDNs may log the image fetch under their own privacy policies.
• Article image lookup (phone version). Many publisher feeds do not include a picture. To find one, the phone version of the App sends the web addresses of the articles currently on screen to a Soundica image-lookup service (a Cloudflare Worker at img.soundica.app). The service fetches the article's public page, reads its standard preview-image tag, and returns the picture's address; where a headline was discovered through Google News, the service first resolves the Google News link to the publisher's own address. The request contains only the article addresses, a generic app User-Agent, and your device's public IP address at the transport layer. No account, device identifier, or reading history is attached, and nothing ties a request to you. Resolved picture addresses are cached on the service for up to 30 days, keyed by the article address only; tracking parameters (utm, fbclid, gclid and similar) are stripped before caching. The image itself is still downloaded by your device directly from the publisher's CDN; Soundica does not relay or store the picture. The Android Automotive and FORVIA head-unit versions do not use this service.
• Publisher logos. Most publisher logos are bundled inside the App. Where a logo is not bundled, the App may request it from a Soundica logo service (img.soundica.app), which fetches the publisher's publicly available site icon, caches it on Soundica's edge network for up to 30 days, and serves it to the App. The request contains only the publisher's website address, never your identity, location, or reading history. Logos are shown unmodified and solely to identify the source of a headline.
• Text-to-Speech. Text is synthesized by the TextToSpeech engine installed on your device (typically Google Speech Services). We never receive or store the text or audio. Depending on your device's TTS settings, the engine vendor may process text on its own servers to provide higher-quality voices; that processing is governed by the engine vendor's privacy policy, not ours.
• Narration on FORVIA head units. The Appning by FORVIA head-unit version has no on-device speech engine. For that version only, Soundica pre-generates spoken audio of the public headlines and summaries on its servers and stores the audio files on Cloudflare R2 object storage; the App streams them like any other media file. This audio is generated from publisher content, not from anything you say or type, and the request carries only the file name, a generic app User-Agent, and your device's public IP address at the transport layer.
• Settings. Your in-app preferences (reading speed, autoplay and read-aloud toggles, selected category or language, one-time hint flags, appearance mode, and, on head units, the selected country or market) are stored locally in app-private storage and never leave your device.

3. Legal basis (EU/UK GDPR)

Under GDPR Art. 6(1)(b) the limited processing described above is necessary to deliver the service you have asked for (showing news, reading it aloud). No consent banner is required because we do not set tracking cookies, we do not use the data for profiling, and we do not share it with advertising partners.

4. Data retention

Because the App stores nothing about you on our servers, we have nothing to retain. Cached RSS/JSON on the edge is keyed by source URL only and never by user. Local settings stay on your device until you uninstall the App.

5. International transfers

Our backend runs on Cloudflare's global edge network. Requests are served from the geographically nearest Cloudflare data centre, which may be outside your home region. Because no personal data is stored, no Standard Contractual Clauses or transfer impact assessments are needed for the App itself.

6. Your rights

Depending on your jurisdiction, you have the right to access, correct, erase, restrict, object to processing, and request portability of your personal data. Since we do not hold any personal data about you in the first place, requests to access or delete will usually be answered with "we have no data linked to you." You always have the unconditional right to delete the App from your device, which removes all locally-stored settings.

You may contact Soundica at admin@soundica.app to exercise these rights. You also have the right to lodge a complaint with your local data-protection authority (e.g. ICO in the UK, CNIL in France, PIPC in Korea, PPC in Japan).

7. Children

The App is not directed to children under 13 (under 16 in some EU member states, under 14 in Korea). We do not knowingly collect information from children.

8. Third-party content

News headlines, thumbnails and summaries displayed in the App are retrieved from publicly available RSS feeds and public APIs published by independent outlets (allkpop, Soompi, Wikinews, public Reddit JSON, etc.). Only the headline and a short attributed snippet are shown inside the App; tapping an article opens the publisher's own website in your device's browser, at which point that publisher's own privacy policy applies.

9. Security

All network traffic between the App and our backend is encrypted with TLS (HTTPS). Clear-text traffic is blocked at the OS level via an Android Network Security Configuration. The App requests only the minimum permissions needed (Internet access, foreground-service playback, optional notifications).

10. Changes

If this policy changes materially, we will update the "Effective" date and, where required by law, prompt you in-app.

11. Contact

Soundica: admin@soundica.app