Privacy Policy

1. Who we are

Digger is a music-discovery service run from Israel by an independent operator (“we”, “us”). We decide why and how your personal data is used, which makes us the “controller” under the GDPR. Contact us at [email protected].

2. What Digger does

You send Digger a link, text, image or voice note, through our web app or our Telegram bot. Digger works out which track or DJ set it is, finds it in music stores, and saves it to your private library (your “crate”). Digger also reads public radio tracklists so you can follow shows and stations.

3. Data we collect

• Account data: your email address (used for sign-in codes), and, if you link Telegram, your Telegram user ID and username.
• Content you send: links, text, images and voice or audio clips, and the tracks, notes, tags, collections and follows you create.
• Connected services: if you connect a music service, the access tokens it gives us. We store them encrypted.
• Usage data: counts of saves and lookups so plan limits work, and your plan status.
• Technical data: your IP address and device details in server logs and for rate limiting, error reports, and product analytics events.
• Cookies and similar storage: see our Cookie Policy.
• Payments: when paid plans are on sale, Lemon Squeezy collects your card and billing details. We receive only your subscription status and a customer reference, never your card number.

We do not read your other Telegram chats or contacts, and we do not read your listening history on connected services.

4. How we use it and why

• To run Digger, identify tracks and keep your library (contract: providing the service you asked for).
• To sign you in and keep your account secure and free of abuse (legitimate interests).
• To enforce plan limits and handle subscriptions (contract).
• To measure and improve the product and fix errors (legitimate interests).
• To meet legal duties such as tax records and responding to lawful requests (legal obligation).
• For optional features such as connecting a service, when you choose to turn them on (your consent).

We do not sell personal data and we do not use your content to train AI models.

5. Images, audio and voice notes

Media you send is checked, then processed to recognise the music or read text in it. Images may be sent to Anthropic as a downsized copy for text reading. When a photo of a cover has no readable text, a downsized copy may be sent to SerpApi for a Google Lens image search, which returns matching pages; the upload expires after a short time. Short audio windows may be sent to AudD for recognition, and AudD states it discards the audio after fingerprinting. When AudD recognises nothing in an Instagram video, one short window of its audio may also be sent to ACRCloud for a second recognition attempt.

We schedule the original files for deletion 24 hours after processing finishes, and no later than 7 days if processing never finishes. Working copies that support the result are deleted within 30 days. Files that fail our checks are deleted within 24 hours. The tracks and notes found from your media stay in your library until you delete them.

6. Who we share data with

We use the service providers below to run Digger. Each receives only what it needs for its job and acts on our instructions or under its own privacy terms. Some are used only when the related feature is switched on.

We may also disclose data if the law requires it, or to protect Digger and its users from fraud or abuse. If the business is ever sold or merged, your data may move to the new owner under this policy.

7. Your public crate and share links

Your library is private by default. You can choose to make your crate public under a handle, or create a share link for a track or collection. Anything you make public or share can be seen by anyone with the link, and may be copied by others, so share only what you are happy to show. You can turn sharing off at any time.

8. International transfers

We are based in Israel, and our hosting is in the United States, so your data is processed outside your country. Israel is recognised by the European Commission as providing an adequate level of data protection. For transfers to providers in the United States and elsewhere we rely on adequacy decisions such as the EU-US Data Privacy Framework where the provider is certified, or on standard contractual clauses.

9. How long we keep data

• Account, library and connection data: until you delete your account.
• Sign-in codes: valid for 10 minutes. Sign-in sessions last up to 30 days.
• Uploaded media: as described in section 5.
• Error logs and analytics: kept for a limited period needed for debugging and product decisions.
• Billing records: kept as long as tax and accounting law requires, mostly by Lemon Squeezy.
• Backups: deleted data may remain in routine backups for a short time before it is overwritten.

10. Your rights

Depending on where you live, you can ask to access, correct, export, delete or restrict the use of your personal data, object to some uses, withdraw consent, and not be subject to solely automated decisions with legal effect (we make none).

• Export: download your data from the export feature in the app.
• Delete: delete your account in Settings. This permanently removes your account, library, connections and usage records. It does not remove tracks already saved into your own accounts on other services.
• Anything else: email [email protected]. We reply within 30 days.

If you are in the EU or UK you may complain to your local data protection authority. In Israel you may contact the Privacy Protection Authority. We would appreciate the chance to fix the problem first.

11. Israeli law

We handle personal data in line with Israel’s Protection of Privacy Law, 5741-1981, and its regulations, including keeping your data secure and honouring your right to review and correct it.

12. Security

We encrypt connection tokens at rest, use HTTPS, remove secrets from error reports, and limit access to production data. No system is perfectly secure. If a breach puts your rights at risk, we will tell you and the regulators as the law requires.

13. Age

Digger is not for anyone under 16. If you believe a child has an account, email us and we will delete it.

14. Changes to this policy

We will post any change here with a new date. For a material change we will also tell you in the app or by email before it takes effect.

15. Contact

Questions or requests: [email protected]. See also our Terms of Service and Cookie Policy.