Privacy Policy
1. Introduction & Scope
Sammich Labs LLC ("Sammich Labs," "we," "us," or "our"), a limited liability company organized under the laws of the State of Michigan, USA, respects your privacy and is committed to transparent, minimal data practices.
This Privacy Policy explains how we collect, use, process, store, and protect information across:
- Our corporate website at https://sammichlabs.com;
- All Sammich Labs LLC mobile applications for iOS and Android, including our consumer content/link parsing utilities, structured personal library organizers, and document export tools;
- Our connected music and media organization utilities for iOS and Android integrating with Spotify, Apple Music, and YouTube Music; and
- Any related software utilities, indie games, and customer support channels operated by Sammich Labs LLC (collectively, the "Services").
We never sell your personal data, we never serve third-party cross-app behavioral tracking ads inside our paid utility apps, and we never use your personal music libraries or private user data to train artificial intelligence (AI) or machine learning (ML) models. You can permanently delete your account and all associated data at any time in-app or via https://sammichlabs.com/delete-account.
2. Account Authentication & Connected Platforms
Across Sammich Labs LLC mobile applications, content/link parsing utilities, and connected music/media services, we support industry-standard OAuth and native platform authentication to synchronize your saved items across devices, verify subscription entitlements, and connect to third-party services at your explicit request:
2.1 Sign in with Apple & Google Sign-In (Firebase Auth)
When you create an account in a Sammich Labs mobile application using Sign in with Apple or Google Sign-In, we receive your unique authentication identifier (UID), email address (including Apple's Private Email Relay address if you choose "Hide My Email"), and optional display name. We use this strictly to authenticate your session, associate your cloud data with your account, and process account support or deletion requests.
2.2 Spotify OAuth Integration
In our connected music/media services, you may optionally connect your Spotify account via Spotify's official OAuth 2.0 PKCE flow. We request only the minimum scopes necessary to perform the playlist organization features you explicitly trigger:
user-library-read— To read your saved track metadata (track title, artist, album art URL, ISRC, and Spotify URI) so we can organize and group tracks according to your preferences.playlist-modify-publicandplaylist-modify-private— To create new playlists or append newly organized tracks into playlists in your Spotify account when you explicitly enable synchronization.
2.3 Apple MusicKit Integration
If you choose to connect Apple Music, our connected media services use Apple's official MusicKit framework to request permission to read your Apple Music library tracks and create or update playlists in your personal Apple Music library. Your Apple Music authorization remains scoped to our application and can be revoked anytime in iOS or Android system settings.
2.4 YouTube Music / Google OAuth Integration
If you choose to connect YouTube Music, our connected media services request your authorization via Google OAuth 2.0 (YouTube Data API v3) solely to read your liked music tracks/videos and create or update playlists inside your YouTube Music account.
3. Spotify Developer Policy & Google API Limited Use Compliance
In strict compliance with the Spotify Developer Policy and Spotify Developer Terms:
- Zero AI/ML Model Training: Spotify content, user library data, audio metadata, and any data obtained from the Spotify Web API are NEVER used to train, fine-tune, calibrate, distill, or improve any artificial intelligence (AI) or machine learning (ML) model—whether operated by Sammich Labs LLC or any third party.
- Ephemeral Playlist Organization Only: When tracks are categorized into mood, genre, or thematic playlists across our connected music/media services, classification is performed ephemerally to organize the user's personal playlists at the user's explicit request, using commercial API endpoints configured with zero training retention.
- No Sale or Ad Targeting: Spotify user data is never sold, transferred to data brokers, used for cross-app behavioral advertising, or shared with unauthorized third parties.
- Complete Deletion Upon Disconnection: Disconnecting your Spotify account or deleting your Sammich Labs account immediately purges your Spotify OAuth tokens and personal library mapping from our servers.
Sammich Labs LLC's use and transfer to any other app of information received from Google APIs (including Google Sign-In and YouTube Data API v3) will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, data obtained via Google APIs is used solely to provide user-facing authentication and media/playlist organization features, is never transferred to third parties except as necessary to provide the user-requested service, and is never used to train generalized AI/ML models or serve advertisements.
4. How Our Applications & Utilities Process Data
4.1 Content/Link Parsing & Personal Library Utilities
- Public URLs You Submit: When you submit or share a publicly accessible link into a Sammich Labs content/link parsing utility, our backend processes that public URL to structure factual information (such as itemized lists, quantities, steps, and source attribution) for your personal library.
- User Cloud Library & Document Exports: We store your saved items, custom edits, personal notes, checklists, and exported document configurations in your cloud account so they remain synchronized across your devices.
- Optional Cloud Drive Backup: If you explicitly authorize exporting or backing up generated files to iCloud Drive or Google Drive, files are written only to the destination you select.
4.2 Connected Music & Media Services
- Library Track Metadata: When you initiate a library scan in our connected music/media utilities, we process track identifiers (ISRC, track title, artist name, album cover URL, and release year) to organize tracks into user-approved playlists.
- Canonical Public Track Metadata Cache: Public catalog facts (such as song title, artist name, ISRC, and public genre/mood tags from Last.fm) may be cached globally without any link to your identity. Your personal library membership, playlist preferences, and OAuth tokens are strictly isolated to your private account.
5. Third-Party Processors & Service Providers
Across Sammich Labs LLC mobile applications, content/link parsing utilities, and connected music/media services, we rely on vetted infrastructure and API sub-processors solely to operate and secure our Services:
| Processor | Purpose | Data Processed & Safeguards |
|---|---|---|
| Google Cloud Platform & Firebase | Cloud hosting (Cloud Run), database (Firestore / Cloud SQL), Firebase Auth, App Check, & Crashlytics | Account UID, email, saved app records, encrypted tokens, and anonymized crash diagnostics. Encrypted in transit (TLS 1.3) and at rest (AES-256). |
| RevenueCat | In-app subscription & purchase entitlement verification | Pseudonymous App User ID and Apple App Store / Google Play Store purchase receipt tokens. We never receive or store your credit card or payment details. |
| Google Gemini API | Ephemeral text structuring & metadata classification across content/link parsing and media utilities | Public link text/captions or public track title/artist/tag strings. Accessed via paid commercial API where prompts and outputs are not used to train Google models. |
| Apify | Public web/social link caption & metadata retrieval for content/link parsing utilities | Only the public post URL explicitly submitted by a user for parsing. No user identity or private account credentials are transmitted. |
| Last.fm API | Public music catalog genre & mood tag lookup | Public artist name and track title only. No user ID, Spotify ID, or personal library data is shared with Last.fm. |
| Cloudflare | Website hosting, DNS, CDN, and DDoS protection for sammichlabs.com |
Standard HTTP request metadata (IP address, user agent) processed transiently for security and edge delivery. |
6. GDPR Legal Bases for Processing & International Data Transfers
6.1 Legal Bases for Processing (GDPR & UK GDPR Article 6)
If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, we process your personal data only when we have a valid legal basis under Article 6 of the General Data Protection Regulation (GDPR):
- Performance of a Contract (Article 6(1)(b)): To create and authenticate your account, synchronize your saved library across devices, verify in-app subscription entitlements, and execute the core application features you request.
- Consent (Article 6(1)(a)): For optional third-party OAuth connections (such as connecting Spotify, Apple Music, or YouTube Music) and optional cloud drive backups. You may withdraw your consent at any time by disconnecting the integration in-app or revoking access in your provider account settings.
- Legitimate Interests (Article 6(1)(f)): To maintain the security and integrity of our infrastructure, prevent automated abuse via Firebase App Check, and diagnose application crashes through de-identified telemetry, where such interests are not overridden by your fundamental data protection rights.
- Legal Obligation (Article 6(1)(c)): To comply with applicable tax, accounting, financial reporting, and lawful regulatory obligations.
6.2 International Data Transfers (GDPR Chapter V)
Sammich Labs LLC is established in the United States (State of Michigan). When you use our Services from the EEA, the United Kingdom, Switzerland, or other regions outside the United States, your information is transferred to, stored, and processed in the United States. Whenever we transfer personal data out of the EEA, UK, or Switzerland, we rely on recognized legal transfer mechanisms under GDPR Chapter V, including our cloud sub-processors' certifications under the EU-U.S. Data Privacy Framework (DPF) (and the UK Extension and Swiss-U.S. DPF) and/or the European Commission's Standard Contractual Clauses (SCCs) coupled with encryption in transit (TLS 1.3) and at rest (AES-256).
7. Data Retention, Account Deletion & Global Privacy Rights
We retain your account data only for as long as your account remains active or as necessary to provide you the Services.
- Instant In-App Deletion: Every Sammich Labs mobile application includes a dedicated Settings → Account → Delete Account & Data control that permanently deletes your Firebase Authentication record, saved cloud items, and connected OAuth tokens.
- Web Deletion Portal & Response SLA: If you have uninstalled our app, you can submit a deletion or privacy rights request at https://sammichlabs.com/delete-account or by emailing privacy@sammichlabs.com. Verified account deletion requests are fulfilled within 7 business days, and all other verified privacy rights requests (access, correction, portability, or restriction) are fulfilled within 30 days.
- EEA, UK & Swiss Supervisory Authority Rights: You have the right to access, rectify, erase, restrict, object to processing of, or request portability of your personal data. You also have the right to lodge a complaint with your local Data Protection Authority (DPA) in the EEA, the UK Information Commissioner's Office (ICO), or the Swiss Federal Data Protection and Information Commissioner (FDPIC).
- U.S. State Privacy Rights (CCPA/CPRA, VCDPA, CPA, CTDPA) & Global Privacy Control (GPC): Residents of California, Virginia, Colorado, Connecticut, and other applicable U.S. states have the right to know, access, correct, and delete their personal information, and to opt out of the "sale" or "sharing" of personal information and targeted advertising. Sammich Labs LLC does not sell or share your personal information as defined under the CCPA/CPRA, VCDPA, CPA, or CTDPA, and we honor browser and device Global Privacy Control (GPC) and universal opt-out signals under CalOPPA and state privacy laws.
8. Children's Privacy, Security & Contact Information
Our Services are intended for general audiences aged 13 and older (or 16 and older in the European Economic Area) and are not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us at privacy@sammichlabs.com and we will promptly delete it.
If you have any questions about this Privacy Policy, our data practices, or our third-party compliance disclosures, please contact our Privacy Officer:
Sammich Labs LLC
Attn: Privacy & Data Protection
State of Michigan, USA
Email: privacy@sammichlabs.com
Support: support@sammichlabs.com