Privacy Policy

1. Who We Are

The data controller responsible for your information is FourMeasure, Inc., 500 Oleander Drive, Hallandale Beach, FL 33009. For any privacy question or request, contact support@fourmeasure.com.

2. Information You Provide

• Account information: an email address or a phone number. A password is optional and depends on how you sign up: accounts created with a phone number or with Google/Apple have no password unless you add one. You may also add a recovery email address, or link a Google or Apple account, so you have more than one way back in.
• Your phone number, if you provide one. A verified phone number is stored as a sign-in identity for your account. We also store a one-way keyed hash of it (a scrambled form that cannot be reversed back into the number), which is what lets the "find friends" feature below work. See the note on being found by phone number below.
• Profile information: username, display name, bio, profile photo/avatar, your "top items" (favorite songs/albums), and your favorite genres.
• Date of birth (to confirm you meet our minimum age and for age-appropriate features).
• Content you create: posts, reviews, ratings, comments, reactions, and the contents of direct messages (including any images or media you attach).
• Photos you upload: if you add a photo background to a review, we collect and store the image you capture. Review backgrounds are taken with the in-app camera, and we do not support video. Profile pictures and images you attach to direct messages can also be chosen from your photo library, which the app asks your permission to open; we receive only the specific images you pick, never your library as a whole. We strip embedded metadata, including EXIF location (GPS) data, from every image on upload, before it is stored. Photos added to reviews may be screened automatically for explicit content and may be rejected. If you turn on saving reviews to your camera roll, the app writes a copy of the finished review card (your photo with the song title, artist, rating, and cover art shown on it) to your device's photo library. That copy is made on your device and stays there: turning this on sends us nothing and creates no new information we hold about you. You can turn it off at any time in Settings. (See our Community Guidelines.)
• Reports and communications: reports you submit about content or users, and messages you send to support, including through the contact form on our website.
• Referral Program applications. If you apply to our Referral Program on our website, we collect the information you enter in the application: your full name, email address, country of residence, what you are applying as, whether you are an artist, whether you are in college or university (and if so, your school and year), the social media accounts and usernames you choose to share, your estimated audience reach, and, if you provide it, your FourMeasure username. You also confirm that you are 18 or older and that you understand applying does not guarantee acceptance or payment. You do not need a FourMeasure account to apply. We do not ask for bank details, tax identification numbers, identity documents, or your home address when you apply.
• Partner Program. If we accept you as a partner, when you set up your partner account on our website we collect your legal first and last name, your date of birth (to confirm you are 18 or older), which version of the Partner Program Terms you accepted and when, and the payout account you give us: a PayPal email address, a Venmo username, or a Zelle email address or phone number. We keep a record of what you earn and of every cash-out request: the amount, where it was sent, and what happened to it. If you would be paid more than $1,900 in a calendar year, we ask separately for tax information (such as IRS Form W-9) before paying more. We do not collect bank account or card numbers.
• Referral codes. If you enter a referral code when you sign up, we record the code and link your account to the person who referred you, so we can run our Referral Program and prevent abuse. If that person is one of our partners, they can see your username and profile photo, which setup steps you have completed (a profile photo, a first post, following 4 accounts), whether you posted 7 days in a row within your first 14 days, whether your sign-up counts toward their rewards and, if not, the reason, and how much it earned them. They cannot see your phone number, email address, date of birth, or messages.
• Contacts (only if you choose to). On the "find friends" step you can ask us to check whether people already in your phone's address book are on FourMeasure. This is optional: you can skip the step, decline the permission, or turn it off later in your device settings, and the rest of the app works either way. If you do turn it on, the app sends us the phone numbers from your address book. We convert each one to a one-way keyed hash, compare those hashes against the phone numbers of existing accounts, and show you the matches. We use the numbers only for that comparison: we do not store the numbers you send us, we do not keep the hashes, and we do not create a record of, or send anything to, people in your contacts who are not already FourMeasure users. We never sell or share contact data, and we do not use it for advertising. Contacts are not shared with any third party.
• Being found by your phone number. The "find friends" feature works in both directions. If you have verified a phone number, anyone who has that number in their address book and uses this feature will be shown your account, and there is currently no setting to turn this off. Only people who already have your number can find you this way; your number is never shown to them, and it is never revealed to anyone who does not already have it. If you would prefer not to be discoverable this way, do not verify a phone number, or contact us at support@fourmeasure.com.
• Microphone, only for song recognition, only when you tap. On iPhone, you can tap to identify a song that is playing near you. Only then does the app ask for microphone permission and listen, and it stops as soon as it has an answer, you close the screen, or you leave the app. Recognition is done by Apple's ShazamKit: Apple's service receives a short audio signature to find the match. FourMeasure never receives, records, or stores any audio; we receive only the song that was matched, to show it to you. You can decline or revoke the permission in your device settings; the rest of the app works either way.

3. Information We Collect Automatically

• Device and instance identifiers: a Firebase Cloud Messaging push token (to deliver notifications) and a first-party Firebase analytics app-instance identifier, both associated with your account. Meta's SDK (see "Advertising measurement" below) also creates its own random identifier for the app installation. We do not collect advertising identifiers (Apple's IDFA or Android's Advertising ID).
• A device identifier we generate. The app creates a random identifier for your phone and stores it on the device. Unlike the identifiers above, it is stored on your device independently of any account: it is not cleared when you log out, and on iOS it can survive reinstalling the app. We receive and use it in two ways:
  • Notifications: when your device registers for notifications, so that if more than one account signs in on the same phone we send a notification once instead of once per account. This copy is attached to the notification settings of whichever account is signed in, and is deleted when that account is deleted or another account signs in on that phone. It is also attached to records of whether a notification was delivered and opened, which we keep for up to 90 days.
  • Sign-up: we record the identifier of the device an account was created on, and keep it for as long as the account exists. We use it to prevent abuse of our Referral Program (for example, many accounts created on one phone to claim rewards), to count sign-ups in our internal metrics, and to avoid suggesting that you follow other accounts created on your own phone.
  Both are deleted when your account is deleted. We do not use this identifier for advertising, and we do not use it to track you across other companies' apps or websites.
• Your device's time zone (for example, "America/New_York"), sent when your device registers for notifications. We use it to send time-sensitive notifications at a sensible hour where you are, and to work out daily streaks. It tells us roughly what part of the world you are in; it is not precise location.
• Log and usage data: IP address, device/user-agent information, timestamps, and actions taken in the app (e.g., posts viewed, features used).
• Approximate location (no GPS): we do not collect precise or GPS location, and the app does not request location permission. Our analytics provider (Google/Firebase) derives an approximate location (such as country or city) from your IP address for analytics. We also use and retain your IP address to secure your account, manage your active sessions, and help prevent fraud.
• Analytics and diagnostics (mobile SDKs):
  • Firebase Analytics (Google): a fixed set of product-interaction events (such as sign-up, login, post created, follow, and which songs or albums you view or rate) keyed to your internal account identifier, not your name, email, or phone. On Android, Google Play also tells Firebase how the app was installed (the install referrer).
  • Firebase Crashlytics (Google) and Sentry: crash and error diagnostics: stack traces, device state, and the app screen or server address where the error happened (which can include text you typed into search). These may be linked to your internal account identifier. They never include your password, sign-in codes or tokens, your contacts, or the contents of your messages.
• Advertising measurement (Meta SDK): we advertise FourMeasure on Meta's services, such as Instagram and Facebook. To learn which of those ads lead people to install and open the app, the app includes Meta's software development kit (SDK). It automatically sends Meta a small set of app events (that the app was installed, and when it is opened) together with technical information, such as your device model, operating system and app version, mobile carrier, screen size, language, time zone, IP address, and the random identifier the SDK creates for the app installation. It may also send Meta crash reports about the SDK itself. We do not send Meta your name, email, phone number, username, account identifier, posts, messages, or music activity, and the SDK does not collect advertising identifiers (Apple's IDFA or Android's Advertising ID). Meta uses this information to report to us how our ads perform, and handles it as described in Section 6 and in Meta's Privacy Policy.
• Partner website sign-in: if you sign in to the partner area of our website, we set one sign-in cookie that keeps you signed in for up to 7 days and is removed when you sign out. The sign-in page uses Google reCAPTCHA (through Firebase) to block automated abuse; it collects device and browser information as described in Google's Privacy Policy.
• No ads in the app, and no cross-app tracking: the app does not display ads and does not present Apple's App Tracking Transparency prompt. We do not track you across other companies' apps or websites. On iOS, Meta's SDK follows your device's tracking permission, and because the app never asks for it, tracking is treated as not permitted.

4. Information From Third Parties

• Single sign-on: if you sign in with Google or Apple, we receive basic profile information from them (such as your email, name, and avatar) per your settings with that provider.
• Connected music providers: if you connect a music account (e.g., Spotify, Apple Music), we receive information needed to provide the integration, which may include your now-playing/listening activity (when you enable that feature) and access tokens. We store provider access and refresh tokens encrypted and use them only to provide the features you enabled.
• Phone verification: when you verify a phone number, our verification provider (Firebase Phone Authentication) confirms the number to us.

5. How We Use Information

We use information to: create and secure your account; provide and personalize the Service (feeds, profiles, recommendations, messaging); deliver notifications; enable features you turn on (such as music-provider integrations); maintain safety and integrity (moderation, abuse prevention, enforcing our Community Guidelines); analyze and improve the Service; measure how well our own advertising for FourMeasure performs on other services; communicate with you about the Service; review Referral Program applications, decide whether to accept them, and contact applicants about their application; and comply with legal obligations. Where required by law, we rely on legal bases including performance of our contract with you, your consent (which you may withdraw), our legitimate interests (such as security and improving the Service), and compliance with legal obligations. For Referral Program applications, we rely on steps you ask us to take before entering into an agreement with you, and on our legitimate interest in running the program.

6. How We Share Information

We do not sell your personal information for money, and we do not share it for cross-context behavioral advertising. We share information only as follows:

• With other users: your profile and the content you choose to share are visible to others according to your settings. If your account is private, your content is limited to approved followers. Direct messages are visible to participants in the conversation. If a direct message is reported, that message becomes visible to our moderation team so the report can be reviewed; only the reported message is shown, not the surrounding conversation.
• Service providers (sub-processors) who process data on our behalf under contract. Each is bound by that contract to protect your information to at least the standard described in this Policy, to use it only for the purposes we specify, and never to sell it. The providers we use are:
  • Amazon Web Services (AWS): cloud hosting, file/media storage (S3), content delivery (CloudFront), automated image content-safety screening (Rekognition), and transactional email (SES).
  • Google / Firebase: push notifications (FCM), phone-number verification (Phone Authentication / SMS, with reCAPTCHA on our website's partner sign-in), product analytics (Firebase Analytics), crash diagnostics (Firebase Crashlytics), email, and data storage and analysis (BigQuery).
  • Sentry: crash and error monitoring/diagnostics.
  • Spotify and Apple Music: music catalog lookups (the text you search for and your country, with no account information), and the integration described in Section 4 if you connect those accounts.
  • Apple: song recognition (ShazamKit), only when you tap to identify a song.
  • Giphy: GIF search within comments and messages.
  • Formspree: receiving and storing messages and applications submitted through the contact and Referral Program forms on our website, and delivering them to our team by email.
• With the partner whose referral code you entered: the setup progress described under "Referral codes" in Section 2.
• Payment services (partners): when we pay a partner, we send the amount to the PayPal, Venmo, or Zelle account they gave us, and that service processes the payment under its own terms and privacy policy.
• Advertising measurement (Meta): Meta Platforms, Inc. receives the limited app-event information described in Section 3 so we can measure our ads on Facebook and Instagram. We turn on Meta's "Limited Data Use" setting, which applies to people in California and the other U.S. states where Meta offers it: for those people, Meta processes this information only as our service provider and does not use it to target ads. For people elsewhere, Meta may also use it as described in its own Privacy Policy. Meta never receives your name, contact details, account identifier, or anything you post or send in the app.
• For legal and safety reasons: to comply with law or valid legal process, enforce our Terms, or protect the rights, safety, and security of users, the public, or FourMeasure.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

7. Your Choices and Rights

• Access, update, and delete: you can view and edit your profile in the app, and you can delete your account at any time from the app, which removes your account and associated personal data (subject to limited retention described below).
• Notifications: you can control push notifications in your device and app settings.
• Connected accounts: you can disconnect a music provider at any time.
• Advertising measurement: you can see and manage how Meta uses information it receives from apps and websites in your Facebook or Instagram Accounts Center, under "Your activity off Meta technologies". On iOS, the app does not ask for tracking permission; you can stop every app from asking in Settings > Privacy & Security > Tracking. On Android, you can delete your advertising ID in your device's privacy settings (the app does not collect it). You can also use the Digital Advertising Alliance's AppChoices tool.
• Contacts: finding friends from your contacts is optional. You can skip it, decline the permission, or revoke it at any time in your device settings. Because we do not store the numbers or hashes from your address book, there is nothing left for us to delete when you revoke it.
• Privacy (GDPR/EEA/UK): if you are in the European Economic Area or the UK, you have rights to access, rectify, erase, restrict, or object to processing of your personal data, to data portability, and to withdraw consent. You may also lodge a complaint with your local supervisory authority.
• Privacy (California/US state laws): if you are a California resident (or in a U.S. state with similar laws), you have rights to know, access, correct, and delete your personal information, and to not be discriminated against for exercising them. We do not sell personal information, and we do not "share" it for cross-context behavioral advertising: the only advertising partner we use, Meta, receives limited app-event data to measure our own ads, and we turn on Meta's Limited Data Use setting so that for residents of California and the other covered states Meta processes it only as our service provider. For that reason we do not offer a separate opt-out of sale or sharing.

To exercise any right, contact support@fourmeasure.com. We will verify your request and respond as required by law. You may use an authorized agent where permitted.

Privacy Officer. Maximus Vickers is our designated Privacy Officer, the person responsible for overseeing our compliance with applicable data-protection laws. You can reach our Privacy Officer at support@fourmeasure.com.

8. Data Retention

We keep personal information for as long as your account is active or as needed to provide the Service, and afterward only as necessary to comply with legal obligations, resolve disputes, enforce our agreements, and for reasonable backup/security purposes. When you delete your account, we delete or de-identify your personal data within 30 days, except where a longer retention period is legally required. Application security and server logs (such as IP addresses) are retained for up to 90 days and then automatically deleted; the IP address recorded when an account is created is cleared after the same 90 days. Infrastructure logs held by our hosting provider may be retained separately under that provider's retention settings.

Sign-in and verification records. Signing in, verifying a phone number or email address, and confirming a sensitive change all create short-lived records (such as a one-time code or a confirmation token) so we can check the step was completed. These expire quickly, typically within minutes, and cannot be used again afterward. They are deleted when your account is deleted, and expired ones are cleared automatically.

Moderation and enforcement records. When we take a moderation or enforcement action (for example removing content, or suspending or banning an account), we keep a record of that action, including which staff member took it (or that it was automatic) and why. These records are retained after an account is deleted, for safety, abuse-prevention and legal purposes, so that enforcement history is not erased by deleting and re-creating an account.

Phone number fingerprints. When a phone number is added to an account, we also store a one-way, keyed hash of it (a scrambled fingerprint that can't be turned back into the number) with the date it was first used and the internal ids of the first two accounts that used it. We keep this fingerprint after the account is deleted, so the same phone number can't be used to create new accounts and claim referral or other rewards again. It is used only for that kind of abuse prevention.

Photos. Photos you upload are stored for as long as your account exists. If you replace or remove a photo, the image may remain in our storage and in content-delivery caches for a period afterward. When you delete your account, photos attached to your posts are deleted from our storage; copies may persist in caches for a period after removal.

Partner Program records. We keep a partner's earnings and payment records, their accepted terms, name, and date of birth for as long as they are a partner and then for up to 7 years after their last payment, as needed for tax, accounting, and legal purposes. If the partner deletes their FourMeasure account, these records are kept for the same period. A record of a referral that earned a partner money keeps the referred account's username at the time, even if that account is later deleted.

Referral Program applications. We keep an application for as long as we need it to review it and, if you are accepted, to set up and manage your participation, and afterward only as required by law. If your application is not accepted, we delete it within 12 months of our decision. Because you can apply without an account, deleting a FourMeasure account does not delete an application. To have your application deleted sooner, email support@fourmeasure.com from the address you applied with.

9. How We Protect Information

We use technical and organizational measures to protect your information, including encryption in transit, hashing of passwords, and encryption at rest for sensitive items such as connected music-provider tokens. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security.

Photos are served publicly. Photos attached to posts are delivered from a public content-delivery network. Anyone with the direct link to an image may be able to view it, even if the post it belongs to is later restricted, made private, or removed.

10. Children's Privacy

The Service is for users 16 and older. We do not knowingly collect personal information from children under 16. If you believe a child under 16 has provided us personal information, contact support@fourmeasure.com and we will take steps to delete it. If the date of birth on an account shows that its owner is under 16, we suspend the account until their 16th birthday; it can be deleted at any time on request. If you are between 16 and the age of majority where you live, use the Service only with a parent or guardian's consent.

The Referral Program is open only to people 18 or older. Applicants must confirm their age when they apply, and we delete any application we learn was submitted by someone under 18. Partners give their date of birth when they set up their partner account, and we check it against the one on their FourMeasure account.

11. International Data Transfers

We operate primarily in the United States, and your information may be processed in the United States and other countries that may have different data-protection laws than your own. Where required, we use appropriate safeguards (such as Standard Contractual Clauses) for cross-border transfers.

12. Third-Party Links and Services

The Service may link to or integrate third-party services. Their use of your information is governed by their own privacy policies, not this one. Review the privacy policies of any music provider or other service you connect.

13. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will provide notice (for example, in the app) and update the "Last updated" date. Your continued use of the Service after changes take effect constitutes acceptance.

14. Contact Us

Questions or requests about this Policy or your information: support@fourmeasure.com, or FourMeasure, Inc., 500 Oleander Drive, Hallandale Beach, FL 33009.