Privacy Policy

Last updated: 21 October 2026 · Version 2.0

For NEXORA COMMERCE S.R.L., the company that operates PocketStage, the protection of your personal data matters. This policy explains what data we collect when you use the PocketStage app (Android and iPhone) or our website pocketstage.app, why we collect it, how long we keep it, who receives it and how you can control it.

We process personal data in line with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR"), Romanian Law no. 190/2018 implementing the GDPR, Law no. 506/2004 on privacy in electronic communications, and the decisions of the Romanian data protection authority (ANSPDCP).

This policy is for information. Where the law requires your consent (for example, for push notifications), we ask for it separately, in the app or through your phone. If you do not agree with how we process your data, please do not use PocketStage.

1. A few terms

Personal data: any information about an identified or identifiable person, such as a name, an e-mail address, a photo, a voice recording or an online identifier.
Processing: anything done with personal data, such as collecting, storing, using, showing, sending or deleting it.
Controller: the company that decides why and how data is processed. For PocketStage this is NEXORA COMMERCE S.R.L. ("we", "us").
Processor: a provider that processes data on our behalf and on our instructions, under a contract (for example, our hosting provider).
Profiling: automated use of data to evaluate personal aspects, such as your music preferences.
Personal data breach: a security incident that leads to the loss, unauthorised disclosure of, or unauthorised access to personal data.

2. Who we are

Name: NEXORA COMMERCE S.R.L.
Registered office: Strada Weiner Palada nr. 60D, Ilfov, România
Trade Register number: J2026031476005
European Unique Identifier (EUID): ROONRC.J2026031476005
Tax identification number (CUI): 54679106
E-mail: contact@pocketstage.app
Telephone: +44 800 229 4307
Website: pocketstage.app

3. How to contact us

For any question about your data or this policy, write to contact@pocketstage.app (please put "Privacy" in the subject), call +44 800 229 4307, or write by post to our registered office: Strada Weiner Palada nr. 60D, Ilfov, România. Requests about personal data are handled by the PocketStage team.

4. What data we process, why, and on what legal basis

Not every category applies to everyone: for example, prize data concerns only challenge winners.

Account and profile. Your name, username, e-mail address, password (stored only as an irreversible hash), date of birth, profile photo, cover photo, bio, the sign-in method (e-mail, Google or Apple), your app settings (language, notifications, who can message you) and the genres and artists you choose at sign-up. If you sign in with Google or Apple, they send us your name, e-mail address and an account identifier (Apple can hide your real e-mail address). We use this data to create and run your account, to log you in (including the verification codes we send by e-mail), to show your public profile and to apply the age rules. Legal basis: performance of the contract with you (Article 6(1)(b) GDPR) and our legitimate interest in keeping accounts secure and protecting minors (Article 6(1)(f) GDPR).

Your content. The songs, voice recordings, videos, cover images, titles, descriptions, lyrics and albums you publish, your comments, likes, saves, follows, shares, challenge entries and votes. We use it to publish your performances, to run challenges and voting, and to show your activity where the app shows it. Legal basis: performance of the contract (Article 6(1)(b) GDPR).

Private messages. The messages you send and receive, message requests, and the people you block. We use them to deliver your conversations and to protect users, especially minors (see section 8). Legal basis: performance of the contract (Article 6(1)(b) GDPR) and our legitimate interest in keeping the community safe (Article 6(1)(f) GDPR).

Listening and activity data. Which songs and videos you play, like, comment on, share or vote for. We use it to build the weekly and all-time charts, the "Your week" statistics, and the "Recommended for you" suggestions (see section 9). Legal basis: performance of the contract and our legitimate interest in recommending music you are likely to enjoy (Article 6(1)(b) and (f) GDPR).

Reports and moderation. The reports you make or that concern you (reason, description, the reported item), the last messages of a reported conversation, automatic moderation results, strikes, messaging mutes and bans. We use them to handle reports, to remove illegal or harmful content, to protect minors and to answer complaints. Legal basis: our legitimate interest in a safe community (Article 6(1)(f) GDPR) and our legal obligations as a hosting service under the EU Digital Services Act (Article 6(1)(c) GDPR).

Notifications and service e-mails. The notification history in the app, your device's push notification token, and the service e-mails we send you (verification codes, password reset, moderation decisions). We use them to tell you about likes, comments, followers, messages, votes, challenge results and decisions about your account or content. Legal basis: performance of the contract (Article 6(1)(b) GDPR); push notifications are sent only if you allow them on your phone. We do not send marketing.

Upload diagnostics. When you publish a song or a video, the app sends us a short technical report: your user ID, phone platform and system version, file sizes and formats, durations and the error, if any. We use it to find and fix upload problems. Legal basis: legitimate interest in a working service (Article 6(1)(f) GDPR).

Technical data. IP address, server access logs, login attempts and request limits. We use them to keep the platform secure, to stop abuse (for example, repeated wrong codes or spam) and to fix technical problems. Legal basis: legitimate interest in the security of our systems (Article 6(1)(f) GDPR).

Support. The messages you send to contact@pocketstage.app and your calls to our telephone number. We use them to answer you and to handle requests about your rights. Legal basis: performance of the contract and our legal obligation to answer data-protection requests (Article 6(1)(b) and (c) GDPR).

Challenge prizes (winners only). To deliver a prize we contact the winner through the app or by e-mail and ask only for the data needed for that prize (usually your full name and e-mail address for a voucher or gift card, and for minors the written consent of a parent). Where tax law requires it for the prize value, we also ask for the identification data required by law. Legal basis: performance of the contract (Article 6(1)(b) GDPR) and our legal tax obligations (Article 6(1)(c) GDPR).

Sensitive data. We do not ask for health data, religious or political views or any other special category of data. If your songs, lyrics or profile reveal such information, it is because you chose to make it public (Article 9(2)(e) GDPR). We do not use your voice or your face to identify you: we do not create voiceprints or facial templates.

5. What we do not collect

We do not collect your location, your phone contacts, payment card details or any bank data, and we do not use an advertising identifier. PocketStage has no advertising, does not track you across other apps or websites, and does not sell your data. Recording, posting, voting and entering challenges are free.

6. Permissions requested by the app

Microphone: to record your voice, only while you record.
Camera: to film a video or take a profile photo, only while you use it.
Photos: to pick a photo, a song or a video that you choose to upload, and to save your own posts to your gallery when you use "Save to phone".
Notifications: to send you push notifications.

Each permission is asked for by your phone separately, and you can refuse or withdraw it at any time in the phone settings. Without a permission, only the function that needs it stops working; the rest of the app keeps working.

7. What other users and the public see

Your public profile: name, username, profile and cover photo, bio, your followers and the people you follow, and the songs and videos you have published.
Your public activity: your comments, the likes and play counts of your posts, your challenge entries, their votes and the charts you appear in.
Share links: anyone with a link to one of your public posts (pocketstage.app/s/…) can view it in a browser, even without the app.
Private messages are visible only to the people in the conversation, and to our team when a conversation is reported or a message is blocked for safety (section 8).
Never shown to other users: your e-mail address, date of birth, age, password, strikes, reports and the people you voted for.
The PocketStage team: our administrators can see account data, content, reports and moderation records in the administration panel, to run the platform and keep it safe.

If you receive other users' data through PocketStage (for example in a conversation), use it only within the app. Do not publish, copy or reuse it elsewhere.

8. Automatic moderation and safety checks

To keep PocketStage safe, some checks run automatically:

New videos stay hidden from others until frames from the video are checked for sexual, violent or self-harm content. Profile photos, cover photos and song covers are checked the same way when uploaded. These checks use OpenAI's moderation service (see section 10).
Names, usernames, bios, titles, descriptions, comments and messages are checked against a list of offensive words in English, Spanish, Romanian and Italian. Text that matches is refused.
Messages sent to a user under 18 that ask for phone numbers, photos, moving to another app, secrecy or a meeting are blocked, and the sender's account is flagged to our team.
When three different people report the same song or video, it is hidden until our team reviews it. Entries in a running challenge stay visible and go straight to our team.

If the automatic check of a video cannot run, the video is published and our team reviews it. These checks can hide your content or refuse a text, but decisions about your account (strikes, mutes, bans, permanent removal) are taken by a person from our team. When we restrict your content or account, we tell you why. You can always ask for a person to review an automatic decision, explain your point of view and contest it (Article 22 GDPR) by writing to contact@pocketstage.app.

9. Recommendations and charts

Home suggests songs and videos based on the genres and artists you chose at sign-up and on what you play. This is profiling, but it has no legal or similarly significant effect on you: it only changes the order of suggestions. The main feeds (Discover and Following) show the newest posts first. Charts are calculated with a public formula (likes ×1, comments ×0.5, shares ×3, one vote per person). You can change your genres at any time and you can object to this processing (section 15).

10. Who receives your data

We do not sell your data and do not share it for marketing. We disclose it only as follows.

a) Providers that help us run PocketStage. They act as processors, on our instructions and under data processing agreements:

prepaid-host.com: hosting of the app's server, database and files (all the data on the platform). Location: data centre in Frankfurt, Germany (EU).
Google Firebase (Google): private messages database (located in the EU), push notifications on Android and iPhone, Sign in with Google and Sign in with Apple, and the sign-in to the chat. Data: messages, device token, e-mail and account identifiers. These sign-in records are deleted with your account. Location: EU and USA.
OpenAI: automatic moderation of images and video frames (section 8). Data: the image or frames only, without your name or e-mail address. According to its API terms, OpenAI does not use this data to train its models and keeps it only for a limited time (up to 30 days) to monitor abuse. Location: USA.
Resend: sending service e-mails. Data: e-mail address and the content of the e-mail. Location: USA.
Cloudflare: domain name service for pocketstage.app and routing of e-mails sent to our address. Data: technical connection data and the e-mails you send us. Location: EU and USA.
Google (e-mail mailbox): the e-mails you send to contact@pocketstage.app are delivered to a mailbox provided by Google. Location: EU and USA.
Fontshare (Indian Type Foundry): delivers the fonts of the website. Data: your IP address and browser information, as needed to send the font files.

The AI tools we use to create our instrumentals and lyrics do not receive any personal data.

b) Independent controllers. Apple (App Store, Sign in with Apple, push notifications on iPhone) and Google (Google Play, Sign in with Google) process data for their own services under their own privacy policies.

c) Other users and the public, as described in section 7.

d) Authorities. We disclose data to courts, the police, prosecutors or other competent authorities when the law requires it, when we must report content that endangers a person's life or safety, or to defend our rights.

e) Transfer of the business. If PocketStage is sold or reorganised, the data may pass to the new operator, under this policy and the law. We will inform you beforehand.

11. Transfers outside the European Economic Area

Some providers (Google, OpenAI, Resend, Cloudflare) are American companies or process data in the USA. Such transfers are based on the European Commission's adequacy decision for the EU–US Data Privacy Framework, for certified providers, or on Standard Contractual Clauses approved by the European Commission (Article 46 GDPR). Without an adequacy decision or appropriate safeguards, a transfer takes place only under the exceptions of Article 49 GDPR.

12. How long we keep your data

We keep data only as long as needed for the purpose for which it was collected, then we delete or anonymise it, unless the law requires us to keep it longer.

Account, profile and settings: while your account exists. Deleted when you delete your account.
Your posts, comments, likes, saves, follows and votes: until you delete them or your account.
Private messages: while the conversation exists. When either person deletes their account, the whole conversation is deleted.
Individual plays: 90 days. A play counter per song (used for your recommendations and statistics), likes, comments, shares, votes and notification history: while your account exists.
Verification codes: valid for a short time and deleted after use. Login tokens: until you log out or delete your account.
Push notification token: until you log out, uninstall the app or delete your account.
Content hidden by moderation: kept hidden, visible only to our team, while the case and any complaint are open, and deleted at the latest 12 months later.
Reports, the message excerpts attached to them and moderation decisions (strikes, mutes, bans): up to 3 years after the case is closed, to handle complaints, detect repeated abuse and defend legal claims. A suspended account, with its e-mail address, stays stored and hidden until we lift the suspension or close the account. Material we must preserve for the authorities is kept as long as they require.
Files made with "Save to phone": 2 days, so that you can download them.
Upload diagnostics: 30 days. Server and access logs: up to 14 days.
Database backups: up to 30 days. Deleted data disappears from backups when they expire.
Support e-mails: up to 3 years after the conversation ends.
Prize data: delivery data up to 12 months after the prize is delivered; data required by tax and accounting law, for the period required by that law (generally 5 to 10 years).

Deleting your account. You can delete your account at any time in the app: Profile → menu → Account settings → Delete account. Your profile, posts, comments, likes, votes, follows and conversations are deleted at once. Only the data listed above that we must keep for legal or safety reasons remains, for the period shown. Statistics we keep after that are anonymous and do not identify you.

13. Where your data comes from

Most data comes from you, when you create your account, fill in your profile, publish, comment, vote or write messages. Other sources: Google and Apple (when you sign in with them), other users (messages, comments, reports about you), and your phone and our servers (technical data).

14. How we protect your data

We use technical and organisational measures appropriate to the risk, including:

all connections between the app, the website and our servers are encrypted (HTTPS);
passwords are stored only as irreversible hashes;
every request to our server is tied to your account, so no user can read or change another user's data; private messages can be written only through our server;
Sign in with Google and with Apple is verified on our server;
limits on login attempts, verification codes, messages, comments and reports;
access to the administration panel only for administrator accounts, with a code sent by e-mail;
regular backups and security updates of the server.

No system is completely secure. Keep your password private and never share the verification code we send you. If you notice suspicious activity on your account, write to contact@pocketstage.app. Security breaches. If a personal data breach happens, we assess it without delay. If it is likely to affect your rights, we notify ANSPDCP within 72 hours of becoming aware of it, and if the risk to you is high, we also inform you directly.

15. Your rights

You have the following rights under the GDPR. Exercising them is free of charge.

Information: to know how we process your data. This policy serves that purpose.
Access: to know whether we process your data and to receive a copy of it (Article 15 GDPR).
Rectification: to correct inaccurate or incomplete data. You can change most of it yourself in your profile. Your date of birth can be corrected only by our team, to protect the age rules.
Erasure: to have your data deleted when it is no longer needed, when you withdraw consent, when you object and there are no overriding grounds, or when it was processed unlawfully. Some data may have to be kept for legal reasons (section 12). You can delete your account yourself in the app.
Restriction: to have the processing limited while you contest the accuracy of data, if the processing is unlawful but you do not want erasure, if you need the data for a legal claim, or while we check an objection.
Portability: to receive the data you gave us in a structured, commonly used, machine-readable format, or to have it sent to another controller, where the processing is based on consent or contract and is automated.
Objection: to object at any time, on grounds relating to your situation, to processing based on legitimate interest, including the profiling for recommendations (section 9). We stop, unless we have compelling legitimate grounds or need the data for a legal claim.
Withdrawal of consent: to withdraw any consent at any time (for example, by turning off notifications), without affecting earlier processing.
Automated decisions: not to be subject to a decision based solely on automated processing that significantly affects you, and to ask for human review (section 8).
Complaint and court: to lodge a complaint with a supervisory authority (section 16) and to go to court (Article 79 GDPR).

How to make a request: write to contact@pocketstage.app, preferably from the e-mail address of your account. To make sure we answer the right person, we may ask you to confirm a code sent to that address; we do not ask for an identity document unless there is no other reasonable way to identify you. We answer within one month. If a request is complex or there are many, we may extend this by two more months and tell you why within the first month. If we refuse a request, we tell you why. Manifestly unfounded or excessive requests may be refused or charged a reasonable fee. If you act through a representative, the request must include a signed power of attorney.

16. Complaints

Please contact us first, so that we can try to solve the problem. You also have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP):

address: Bd. G-ral. Gheorghe Magheru nr. 28-30, sector 1, București, România;
telephone: +40 318 059 211 / +40 318 059 212;
e-mail: anspdcp@dataprotection.ro;
website: www.dataprotection.ro.

If you live or work in another EU Member State, you can also complain to the data protection authority of that country.

17. Minors

PocketStage is for people aged 16 and over. We ask for your date of birth at sign-up and do not allow accounts under 16. Users aged 16 and 17 receive extra protection: only people they follow can message them, and messages that look like grooming are blocked (section 8). If we learn that someone under 16 has created an account, we close it and delete the data, except what the law requires us to keep. Parents and guardians can write to contact@pocketstage.app. More in our Child Safety Standards at pocketstage.app/child-safety.

18. Cookies and the website

The website pocketstage.app sets no tracking or advertising cookies. Details are in our Cookie Policy at pocketstage.app/cookies.

19. Changes to this policy

We may update this policy to follow the law or changes to PocketStage. The version and date at the top show the latest update. We announce important changes in the app or by e-mail before they apply.