Privacy Notice

1. The short version

Instamusic collects the details needed to run an account, hold a gold balance, pay rewards and keep sign-ins safe. It does not sell your personal information and does not run advertising or analytics trackers in the app.

We share the minimum with the services that make the app work — hosting, payment processing, Google sign-in, and the blockchain when we release funds to you. Members above you in a referral chain see only your MUSIC CODE ID, display name and membership type, never your email, mobile number, password, PIN or payout address.

2. What you give us when you register

The register form asks for, and we store:

• Full name and username. Used to identify you in the app, to label songs you compose, and to show a masked name when another member sends you gold.
• Email address. Used for sign-in, password resets, security alerts, and the one-time code that proves you own the address before a payout address can be changed.
• Mobile number with country code. Used to reach you about your account. It is not published to other members.
• Password. Stored only in a form that cannot be read back. Instamusic staff cannot see your password, and we will never ask you for it.
• Referral code (optional). Links your account to the member who invited you, so their position in the reward chain is recorded.
• Security PIN. Stored as a one-way code, not as the digits themselves. It guards claiming from your Vault Wallet and opening Timelock Self Storage.
• Payout address. The XAUt BEP20 address you save is where your gold and USDT are released. Changing it requires a one-time code emailed to your verified address.
• Identity documents, when we ask. If verification is required, we collect a face photo taken by your camera and the front and back of your ID. These are kept in private storage and reviewed only by administrators.

3. If you sign in with Google

When you use Continue with Google, Google sends us your name and email address so we can create or match your Instamusic account. Google also applies its own privacy notice and its own consent screen to that step.

Google sign-in cannot carry the details the register form asks for, so a member who joins through Google starts without a username, mobile number or sponsor unless they complete those in Settings or register with the referral code first.

4. What is collected automatically

• Sign-in security. When a sign-in fails we record the identifier used, the IP address, the browser and device string, the approximate location (city, region and country) and the time. That is what lets us email you a security alarm and temporarily block repeated guessing. Successful sign-ins do not store a location record.
• Browser storage. Your chosen language, chosen display currency, a referral code from an invite link, and the session that keeps you signed in. A referral code from a Google sign-in journey is held briefly in the tab so your sponsor can still be attached when Google returns you to the app.
• Payment records. The payment provider returns the amount, currency, payment identifier and status of each USDT BEP20 payment, which we match to your order.
• Blockchain records. Your verified address, transaction hashes and provider payout identifiers, so a release can be traced.
• Feature settings. Whether Auto-Claim is on, when its 72-hour cycle started, your subscription expiry, your music-credit balance and your Timelock positions.

The app loads the Instamusic fonts from Google Fonts and, on the videos page, YouTube thumbnails and players. Those services see the technical request their own servers need (such as an IP address) and apply their own policies. There are no advertising, session-recording or analytics scripts of our own in the app.

5. Records the app creates about you

As you use the service, we keep a record of what happens on your account:

• every wallet movement — additions, sends, sells, rewards, claims, corrections — with amount, fee and time;
• reward shares you earned or paid, and the level and member they came from;
• membership activations, renewals, subscriptions and music-credit purchases;
• withdrawals with amount, address, fee, network fee, status and transaction hash;
• your AI threads: the prompts you typed, generated titles, lyrics, the audio file, and the credits each song cost;
• community messages, support tickets and attachments, and announcements you publish;
• an administrator audit log for sensitive actions taken on accounts, including balance adjustments and cancelled storage positions.

6. Why we need it

• to create and operate your account, and to let you sign in;
• to hold, move and show your balances, and to pay or refuse a claim correctly;
• to work out and pay referral rewards to the right members at the right level;
• to verify who you are when a payout address changes, and when identity checks are required;
• to detect account takeovers, reward farming, duplicate accounts and other abuse;
• to answer support tickets, honour a correction, and keep records we are required to keep;
• to send you account and security emails about your own activity.

7. Who sees your information

• Members above you in a referral chain. They can see your MUSIC CODE ID, your display name and your membership type. A member verifying a referral code sees only the sponsor’s display name and membership type — never anyone’s reward totals.
• Members in your community list and chat. They see display names, MUSIC CODE IDs and the messages posted.
• Administrators. They can open a read-only view of a member’s dashboard, review identity documents, adjust balances or credits, and read support tickets — each recorded in the audit log.
• Our hosting and cloud platform. The database, file storage and authentication that hold your records are run by our platform provider.
• Our payment provider. USDT BEP20 payments are processed by a third-party payment service, which receives the payment details it needs and hands back a status.
• Google. For sign-in and fonts, as described above.
• The blockchain. Once gold or USDT is released to your address, that transfer is visible on the public ledger and cannot be deleted.
• Authorities. If we receive a valid legal request, we may disclose what that request requires.

We do not sell your personal information, and we do not share it with advertisers.

8. Your choices and control

• edit your name, username and mobile number in Settings;
• change your payout address only after confirming the emailed code, which also means you can stop anyone else changing it;
• switch Auto-Claim on or off in the wallet, and use the eye icon to hide balances on screen;
• change your language and display currency at any time from the header;
• delete a song you composed, which removes the track and its lyrics from your list (the credits are not returned);
• stop using the service and ask us to close your account.

If you want a copy of the personal details we hold about you, a correction, or your account closed, send the request through the Support page inside the app so we can confirm it is really you. Where the law of your country gives you a right of access, rectification, deletion, objection or portability, we will handle your request the same way.

Some records stay after an account closes: transactions, rewards, withdrawals and audit entries that we must keep for accounting, dispute or legal reasons. Identity documents are kept only as long as they are needed to verify you.

9. How we protect it

• passwords and the security PIN are stored as one-way codes, not as readable text;
• the one-time code that changes your payout address is stored hashed with an expiry and a limited number of attempts;
• your AI tracks, support attachments, materials and identity documents sit in private storage that only you and administrators can open;
• every member can read and write only their own records — the database rules decide this, not the app screen;
• repeated failed sign-ins are rate-limited, temporarily blocked, and reported to the account holder;
• administrator actions on balances, credits and storage positions are logged with the admin’s identity.

No system is perfect. Please keep your password and PIN private, use a password you do not reuse elsewhere, and tell us through Support the moment you see a security alarm you do not recognise.

10. Children

Instamusic is not intended for anyone under 18, and we do not knowingly collect information from children. If you believe a child has registered, tell us through Support and we will close the account.

11. Changes to this notice

We update this page when our practices change and show a new “last updated” date. If a change affects how your money or identity details are handled, we will also announce it inside the app.

12. Contact

The fastest route to us is the Support page inside the app: tickets are tied to your account, and you can attach a screenshot.

Account and security emails arrive from noreply@notify.instamusic.live. That mailbox does not receive replies, so please use Support for anything you need an answer to.