This notice explains what personal data BeatID Online collects, why, and what rights you have over it under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Section 1
Who we are
BeatID Online is operated by BEAT ID LTD, a company incorporated in England and Wales (company number 17175762), registered address Office 18878, 182-184 High Street North, London, England, E6 2JA.
BEAT ID LTD is the data controller for personal data processed through the Platform. We are registered with the Information Commissioner’s Office under reference ZC164843.
For any privacy question, or to exercise a right under Section 8, contact admin@beatidapp.com.
Section 2
Who this notice is for
- Players — anyone who joins a room with a PIN
- Hosts — anyone who creates and runs a room, with or without an account
- Subscribers — hosts who buy Premium
How much data we hold depends entirely on which of those you are. A player who joins a room and leaves gives us a nickname and nothing else.
Section 3
What we collect and why
3.1 Everyone who plays
| Data | Where it comes from | Why | Lawful basis |
|---|---|---|---|
| Anonymous session ID | Created automatically by Firebase Authentication when the page loads | Telling one browser from another so the room can run — scoring your answers, keeping you in the room across a reload | Legitimate interests, Art. 6(1)(f) — without it there is no multiplayer game |
| Nickname (up to 24 characters) | Typed by you when you join | Showing who you are to the host and the other players, and on the room leaderboard | Legitimate interests, Art. 6(1)(f) — identifying you during play |
| Gameplay data — guesses, answer times, scores, streaks, round results, votes | Created as you play | Scoring, ranking and running each round in real time | Legitimate interests, Art. 6(1)(f) — core game function |
3.2 Hosts
| Data | Where it comes from | Why | Lawful basis |
|---|---|---|---|
| Host session ID | Firebase Authentication | Making sure only you can control your room | Legitimate interests, Art. 6(1)(f) |
| Music searches | Typed by you | Passed straight to the Apple Music API to fetch results. We do not store your searches. | Legitimate interests, Art. 6(1)(f) |
| Playlists you build — the name you give them and the tracks in them | Created by you, from search, an Apple Music link, or a pasted list | Saving your queue so you can run it again at the next event | Legitimate interests, Art. 6(1)(f), or performance of your contract where you are a subscriber, Art. 6(1)(b) |
| Room summary — room PIN, host ID, date, duration, round and player counts, and the winning nickname and score | Created by us when a room ends | Giving hosts a record of the night, and letting us understand and cost how the service is used | Legitimate interests, Art. 6(1)(f) — operating and improving the service |
3.3 Hosts who sign in
Hosting a Premium room needs an account, and you create one by signing in with Google. Google then gives us the following from your Google profile:
| Data | Why | Lawful basis |
|---|---|---|
| Your name and Google profile picture | Showing you which account you are signed in to | Performance of a contract, Art. 6(1)(b) |
| Your email address | Identifying your account, sending it to Stripe as the billing contact, and contacting you about your subscription | Performance of a contract, Art. 6(1)(b) |
| Your Google account identifier | Linking the account to your sessions so a subscription belongs to you and not to one browser | Performance of a contract, Art. 6(1)(b) |
3.4 Subscribers
Card payments are taken by Stripe on a page hosted by Stripe. Your card number never reaches us and we never store it. What we hold is the record of the subscription itself:
| Data | Why | Lawful basis |
|---|---|---|
| Your Stripe customer ID | Connecting your account to your subscription | Performance of a contract, Art. 6(1)(b) |
| Subscription status, plan, renewal date and payment history | Knowing whether your account currently has Premium, and showing you your billing page | Performance of a contract, Art. 6(1)(b) |
| Billing address, country and any VAT/tax ID you give at checkout | Collected by Stripe to calculate tax correctly and issue a valid receipt | Legal obligation, Art. 6(1)(c) — tax and accounting |
| Redemption of a complimentary code | Making sure a code is used once, by one account | Legitimate interests, Art. 6(1)(f) — preventing abuse of an offer |
3.5 Claiming a score in the iOS app
If you choose to claim your score in the Beat ID iOS app, we write your nickname and final score to a temporary record so the app can pick it up. It is deleted automatically after 7 days. This only happens if you ask for it. Lawful basis: legitimate interests, Art. 6(1)(f) — doing the thing you just asked for.
3.6 Storage on your device
We keep a small number of items in your browser rather than on our servers — your nickname, your session, and your preferences like whether the lobby music is muted. Our Cookie & Storage Policy lists every one of them and says which need your consent.
Section 4
What we do not collect
- We never see your card details. They are entered on Stripe’s page and stay with Stripe.
- We do not ask players for any identifying information. Joining a room needs a nickname and nothing more — no email, no name, no account.
- We do not use advertising, analytics or tracking. No Google Analytics, no advertising pixels, no third-party trackers, no profiling, and no automated decision-making with legal effects.
- We do not sell or rent personal data, ever, to anyone.
- We do not collect location data or biometric data.
Section 5
Who else is involved
We do not sell your personal data. It is shared only as set out here.
5.1 With other people in your room
Your nickname and score are visible to the host and to everyone else in the same room, during and after the game. That is the point of a multiplayer game rather than an incidental disclosure.
5.2 With the services that run the Platform
| Provider | What they do | What they receive | Where |
|---|---|---|---|
| Google (Firebase Authentication, Cloud Firestore, App Hosting, Cloud Functions) | Sign-in, the real-time database, and hosting the Platform itself | Everything described in Section 3, plus your IP address as part of serving the page | United States |
| Google (Sign-In and Fonts) | Signing hosts in, and serving the typefaces the site is set in | Your Google profile when you sign in; your IP address when a font is fetched | United States |
| Apple (Apple Music API and MusicKit JS) | Searching the catalogue and playing song previews | Search terms as they are typed (not stored by us) and your IP address, as your browser talks to Apple directly | United States |
| Stripe | Taking payment and running the billing portal | Your email address, your card details (entered on Stripe’s page), billing address and tax ID | Ireland and the United States |
Google and Apple act as our processors for the data we send them. Stripe acts as an independent controller for payment data as well as our processor — its own privacy policy governs what it does with your payment information.
5.3 Sending data outside the UK
These providers are based in, or transfer data to, the United States, which has no general UK adequacy decision. We rely on:
- Google LLC — certified under the EU-US Data Privacy Framework and its UK Extension (the UK Data Bridge), plus Google’s data processing terms with the UK Addendum to the EU Standard Contractual Clauses.
- Apple Inc. — the EU-US Data Privacy Framework and UK Extension, and Apple’s developer terms.
- Stripe — our contract is with Stripe Payments Europe, Ltd. in Ireland; transfers to Stripe, Inc. in the US are covered by the Data Privacy Framework and Standard Contractual Clauses with the UK Addendum.
5.4 When the law requires it
We may disclose data where we are required to by law or a court order, or where it is necessary to establish, exercise or defend a legal claim.
Section 6
How long we keep it
| What | How long |
|---|---|
| Rooms, players, rounds and guesses | Deleted automatically 24 hours after the room was created. A daily sweep removes the room and everything under it. |
| Room summaries and usage records | Kept indefinitely. They hold the room PIN, the host’s account ID, the date and size of the game, and the winning nickname and score — they are how a host sees their history of events. Ask us and we will delete yours. |
| Playlists you have built | Until you delete them, or until you ask us to close your account |
| Account and subscription records | For as long as you have an account, then up to 12 months after it is closed |
| Payment and tax records | 6 years from the end of the financial year they relate to, as UK tax and accounting law requires. This period cannot be shortened by a deletion request. |
| Score claim records | 7 days, then deleted automatically |
| Anonymous sessions never linked to an account | Cleared by Firebase after a long period of inactivity |
| Items in your browser | Until you clear your browser data or withdraw consent — see the Cookie & Storage Policy |
Section 7
How we keep it safe
- All traffic to and from the Platform is encrypted with HTTPS.
- Database security rules restrict every read and write — a host can only control their own room, a player can only write their own answers, and a playlist can only be read by the account that owns it.
- Card data never touches our systems, so it cannot be exposed by them.
- We hold no passwords: sign-in is handled by Google.
- Automatic deletion is built in, so the default is that data goes away rather than accumulates.
- Access to production data is limited to the people who need it to run the service.
If a breach occurs that is likely to risk your rights and freedoms, we will report it to the ICO within 72 hours and tell you without undue delay where the risk to you is high.
Section 8
Your rights
| Right | What it means |
|---|---|
| Access | Get a copy of the personal data we hold about you |
| Rectification | Have inaccurate or incomplete data corrected |
| Erasure | Have your data deleted, where we have no overriding reason or legal duty to keep it |
| Restriction | Have us pause processing while a question about it is resolved |
| Portability | Receive the data you gave us in a structured, machine-readable format |
| Object | Object to processing we carry out on the basis of legitimate interests |
| Withdraw consent | Withdraw consent for anything we do on that basis, such as remembering your nickname |
These rights are free to use, and we will respond within one calendar month.
To exercise any right, email admin@beatidapp.com.
Section 9
Complaining to the regulator
If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office. We would rather hear from you first at admin@beatidapp.com, but you do not have to come to us before going to them.
- Online: ico.org.uk/make-a-complaint
- Telephone: 0303 123 1113
Section 10
Children
Beat ID Online is a music game that people of all ages play, often in the same room. We have designed it to need as little as possible from anyone: joining a game requires a nickname and nothing else, and we do not ask any player for a name, an email address or an age.
Accounts and subscriptions are for adults — you must be 18 to subscribe. If you are a parent or guardian and want data relating to your child removed, email admin@beatidapp.com and we will do it.
Section 11
Changes to this notice
We may update this notice. The “Updated” date at the top shows when it last changed. If a change materially affects how we use your data, we will make that clear rather than relying on you noticing the date.
Section 12
Contact
BEAT ID LTD
Office 18878, 182-184 High Street North, London, England, E6 2JA
Email: admin@beatidapp.com
ICO registration: ZC164843
Companies House: 17175762