r*cap is operated by Lost Property Labs LLC, a California company, which is the data controller for the Service. We collect the minimum needed to run an account and understand how the product is used. We do not sell your personal data, we do not share it with advertisers, and there is no ad targeting anywhere in the Service. This policy explains what we hold, why, and how to get rid of it.

Account data. When you sign up we store your email address, handled through our authentication provider, Supabase. If you sign in with Google we receive basic profile information from that account — your email address, name, and profile picture. We never receive your Google password.

Activity data. We store what you do in the product so it can work at all: the topics you follow, the episodes you like and bookmark, and playback state such as which episode you were listening to and how far through it you got.

Usage analytics. We record product events — pages viewed, episodes played, features used — through Amplitude, so we can see which parts of the Service are worth building on. IP address collection is disabled in our Amplitude configuration, so these events are not tied to your location or network address.

Technical data. Our infrastructure providers process standard server logs, including IP address and browser user agent, for security, abuse prevention, and debugging.

We use this data to authenticate you and keep you signed in, to build your feed from the topics you follow, to sync your saves and likes across devices, to resume playback where you left off, to diagnose faults and prevent abuse, to measure and improve the product, and to send you service messages such as sign-in codes and account notices.

We do not sell personal data, we do not share it with data brokers, and we do not use it to target advertising. We do not use your personal data to train machine learning models.

Where the GDPR or a comparable law applies, we process account and activity data to perform our contract with you, analytics and security data under our legitimate interest in operating and improving a reliable service, and any optional communications on the basis of your consent, which you may withdraw at any time.

We use a small number of processors, each bound by a data processing agreement and permitted to use your data only to provide their service to us: Supabase for authentication and the primary database; Cloudflare for content delivery, audio storage, and hosting; and Amplitude for product analytics. Payments are handled by our payment provider, or by Apple or Google for subscriptions purchased inside a mobile app — we never see or store your full card details. Some of these providers operate in the United States, and transfers are made under Standard Contractual Clauses or an equivalent safeguard.

We may also disclose data if required by law, to enforce our terms, or to protect the rights and safety of our users.

We use browser local storage and cookies to keep you signed in between visits, to remember interface preferences, and to count anonymous plays against the free listening limit. These are essential to how the Service works — we do not set advertising or cross-site tracking cookies. Clearing your browser storage will sign you out.

We keep account and activity data for as long as your account is open. You can delete your account at any time from the Profile screen; doing so removes your account record, your follows, saves, likes, and playback history. Backups and server logs may retain copies for a short period before rolling off, and we keep whatever records we are legally obliged to keep, such as billing records for tax purposes.

Depending on where you live, you may have the right to access a copy of your data, to correct it, to delete it, to object to or restrict certain processing, and to receive it in a portable format. Deletion is available directly in the app; for anything else, write to legal@rcap.io and we will respond within thirty days. You also have the right to complain to your local data protection authority.

The Service is not intended for children under 16, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact legal@rcap.io and we will delete it.

If we change how we handle your data we will update this page and revise the "last updated" date above, and we will give notice through the Service or by email before any material change takes effect. For any question about this policy, or to exercise any of the rights described in it, contact legal@rcap.io.