Privacy Policy

Account information. When you create an account we collect a username you choose and sign-in credentials managed by Firebase Authentication. You may sign in with Apple, Google, phone (SMS one-time code), or email (a one-time login code sent via our email provider, Resend). We do not use email/password signup as a primary path. For Apple or Google Sign-In, we may receive your name and email address from that provider.

Profile content. You may upload a profile photo, add a bio, and add a website link. Profile photos are stored in Firebase Cloud Storage.

Posts and activity. When you share a song, we store the song metadata (track name, artist, album, and album art URL sourced from Spotify), any caption or hashtags you add, and engagement data such as likes, comments, saves, and follower relationships.

Direct messages. Messages you send to other users are stored on our servers to deliver the messaging service. Messages are not end-to-end encrypted.

Voice notes. If you send voice notes through the app, the audio files are stored in Firebase Cloud Storage and linked to your account.

Comments. Comments you leave on posts are stored alongside your user ID and a timestamp.

Push notification tokens. If you enable push notifications, we store your device token to send you notifications about activity on your account (likes, comments, follows, messages).

City-level location. If you choose to use the map feature and share your city, Corus requests your location while you are using the app. Precise location, when permitted, is used only transiently on your device to identify the correct city and is not saved or shared. We store only your city, region, country, and a public city-level map coordinate linked to your account. If you allow only approximate location, Corus asks you to confirm the resulting city before sharing it. You can instead select a city manually.

Subscription information. If you subscribe to Corus Club, purchase and subscription status is managed by RevenueCat and the app store you used to subscribe (Apple App Store on iOS or Google Play on Android). We store your club membership status (active or inactive) but do not have access to your payment method, credit card details, Apple ID password, or Google account password.

If you allow contact access and choose to sync, we read phone numbers from your device contacts and store those numbers with your Corus account to find friends who use Corus. This feature may notify matching friends that you are on Corus. You can revoke contact permission in your device settings to prevent future access. To remove previously synced numbers, contact help@corus.fm or delete your Corus account.

Your choice and permissions. Signing in to Corus with Google provides basic account information such as your name and email. Connecting YouTube Music is optional and requires separate Google permission. We request the YouTube permission identified as https://www.googleapis.com/auth/youtube.force-ssl when you connect, generate a YouTube Music playlist, or enable saved-song syncing. Google describes this permission broadly; Corus uses it for the playlist features below. We do not receive your Google password.

Data accessed and use. We use your authorization to identify your YouTube channel, search public music video metadata, and read the contents of playlists managed by Corus. We create private playlists in your selected YouTube account from songs you select in Corus. These playlists can appear in YouTube Music when the recordings are eligible. Regenerating a playlist can replace its existing entries. If you enable Add Saved Songs to Playlist, future songs you save in Corus are added to a private Corus Saved Songs playlist. Unsaving a song in Corus does not remove it from that playlist. We do not use this connection to read your YouTube watch history or upload videos.

Storage and protection. Our server receives a Google access token over HTTPS for each authorized request and uses it to call Google. We do not store these tokens in our server database or log them. Mobile authorization is handled through Google's sign-in or authorization services; the web app keeps its access token in memory. Your device or browser also stores connection preferences and pending saved-song identifiers. In Firebase, we store your Corus user ID, YouTube channel ID, playlist IDs, and update information so later exports can find the correct playlist. Access to this metadata is restricted to our backend. Public song-to-video matches are cached for up to 29 days and expired matches are removed by a daily cleanup.

Sharing and limits on use. We send selected song information and playlist requests to Google/YouTube to provide these features, and use Google/Firebase to process and store the associated metadata. This connection does not publish your Google account details to other Corus users. We do not sell Google user data, share it with advertisers, use it for targeted advertising, or use it to train generalized AI or machine-learning models. We use this data to provide and maintain the features you authorize.

Retention, disconnecting, and deletion. Playlist identifiers and associated channel metadata are retained to support later exports; they are not automatically deleted when you disconnect. Disconnect YouTube Music in Corus to stop syncing on that device or browser and clear its local connection preferences and pending saves. To revoke Google authorization, remove Corus from your Google Account connections. Disconnecting or deleting your Corus account does not delete playlists already created in YouTube; you can delete those in YouTube or YouTube Music. To request deletion of the YouTube channel and playlist metadata held by Corus, email help@corus.fm. We will respond within 30 days. Revoking access prevents further authorized Google API requests but does not by itself erase data previously stored by Corus.

We use the following third-party services:

• Firebase (Google) — authentication, database (Firestore), file storage, cloud functions, and push notifications. Google's privacy policy: policies.google.com/privacy
• Spotify Web API — we search Spotify's catalog to let you find and share songs. If you connect Spotify, we also use the account and playback permissions you approve to provide supported playback, playlist generation, and saved-song features. Spotify's privacy policy: spotify.com/legal/privacy-policy
• RevenueCat — manages in-app subscriptions and purchase receipts. RevenueCat receives an anonymous app user ID and purchase data from the Apple App Store (iOS) or Google Play (Android). RevenueCat's privacy policy: revenuecat.com/privacy
• Apple App Store — processes payments for Corus Club subscriptions on iOS. Apple's privacy policy: apple.com/legal/privacy
• Apple Location Services and geocoding — if you choose "Use my city" on iOS, Apple's location and geocoding services process your device location to identify your city. Corus does not store the precise device coordinate returned during this process. Apple's privacy policy: apple.com/legal/privacy
• Google Play — processes payments for Corus Club subscriptions on Android and distributes the Android app. Google's privacy policy: policies.google.com/privacy
• YouTube API Services — we use the YouTube Data API to find official music videos and film trailers, which play inside YouTube's embedded player. You can also choose to connect your Google/YouTube account for the playlist features described below. When a video plays, your browser or device connects to YouTube directly, and Google may collect data as described in its privacy policy. Your use of these features is also governed by the YouTube Terms of Service and Google's privacy policy: policies.google.com/privacy
• Cloudflare — hosts our website (corus.fm) and provides DNS, CDN, and security services. Cloudflare's privacy policy: cloudflare.com/privacypolicy

• To create and maintain your account
• To display your profile, posts, and activity to other users
• To enable social features (following, likes, comments, direct messages, voice notes, and notifications)
• To place you at the city level on the map and help you find people in or near a city, when you choose to use the map feature
• To show trending songs and hashtags
• To manage your Corus Club subscription status and deliver subscription benefits
• To send push notifications about activity on your account (you can disable these in your device settings at any time)
• To enforce our Terms of Use and protect users from abuse
• To improve the app and develop new features

• We do not store your precise device location; if you choose to use device location for the map, it is converted to city-level location information before Corus stores it
• We access your device contacts only with your permission
• We do not track you across other apps or websites
• We do not use cookies for advertising or tracking purposes
• We do not sell your personal information to any third party
• We do not use your data for targeted advertising

We do not sell your personal information. We do not share your data with advertisers. Your data is shared only in the following ways:

• Public profile and posts. Your username, profile photo, bio, and posts are visible to other Corus users. Posts may also appear in trending feeds and search results within the app.
• Map visibility. If you enable map sharing, Corus displays your city-level location and profile information to the audience you select in the app. Other users are not shown your precise device location. You can change the audience or stop sharing at any time.
• Service providers. We use Firebase (Google) to store data, Spotify to retrieve song information, and RevenueCat to manage subscriptions, as described above. These providers process data on our behalf and are contractually obligated to protect it.
• Legal requirements. We may disclose your information if required to do so by law, regulation, or legal process, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Corus Media, Inc., our users, or the public.
• Business transfers. If Corus Media, Inc. is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change via the app or email.

You can delete your account at any time from the Settings screen in the app. When you delete your account, we permanently remove your profile, all your posts, comments, likes, saves, follower relationships, messages, voice notes, and notifications. This action cannot be undone.

If you enable map sharing, your city-level map record remains until you change it, stop sharing, or delete your account. You can stop sharing from the map controls at any time; doing so deletes that map record. You can also revoke location permission in your device settings. Revoking permission prevents future device-based city updates, but it does not by itself remove a city you previously chose to share, so use the in-app map controls to stop sharing.

If you cancel your Corus Club subscription, your subscription benefits end at the close of your current billing period. Your account and content remain intact.

Data is transmitted over HTTPS. Firebase Authentication manages account authentication. We use access controls to restrict private account data and server-only integration records. We implement reasonable administrative, technical, and physical safeguards to protect your information. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

Corus is not intended for children under 13. We do not knowingly collect information from children under 13. If we learn that we have collected personal information from a child under 13, we will delete that information promptly. If you believe a child under 13 has provided us with personal information, please contact us at help@corus.fm.

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your information
• Object to or restrict certain processing of your information
• Request a portable copy of your information
• Withdraw consent where processing is based on consent

To exercise any of these rights, please contact us at help@corus.fm. We will respond within 30 days.

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights regarding your personal information, including the right to know what information we collect, the right to delete your information, and the right to opt out of the sale of your information. We do not sell personal information. To exercise your CCPA rights, contact us at help@corus.fm.

Corus is operated from the United States. If you are accessing the app from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States. By using Corus, you consent to the transfer of your information to the United States.

We may update this policy from time to time. If we make material changes to how we collect, use, or share your information, we will notify you through the app or by updating the date at the top of this page. Your continued use of the Service after changes constitutes acceptance of the updated policy.

If you have questions about this privacy policy, please contact Corus Media, Inc. at help@corus.fm.