Privacy Policy

Effective date: October 8, 2026

1. Introduction

Rapper is an AI rap studio, free to use with an optional paid Premium subscription, available as a mobile app with a companion website at rapper.studio. This Privacy Policy explains what data we collect, why, who we share it with, how long we keep it, and the rights you have. It applies to the app, this website, and the backend that powers them.

The controller of your personal data within the meaning of the GDPR (Regulation (EU) 2016/679) is GT Solutions, a business registered in Poland (Budowlanych 1A, 62-081 Baranowo, Poland; EU VAT ID PL7792155376). For any privacy question or to exercise your rights, contact us at hello@boppy.me.

2. Scope

This policy covers data processed by Rapper directly. Rapper shares its backend, its accounts and its Premium subscription with Boppy, our other music app, operated by GT Solutions under the same safeguards. Services we rely on (the App Store, sign-in providers, and the processors listed in Section 6) handle some data under their own privacy policies, which we encourage you to read.

3. Data we collect

3.1 Account & identity

If you create an account, we store the data needed to operate it: a provider identifier if you use Sign in with Apple or Sign in with Google (and the email/name they return), an optional display name, the timestamp at which you accepted our Terms, and your plan (free or Premium).

3.2 Anonymous accounts & device identifier

You can make a limited number of tracks without registering. To do this we store a device identifier generated by the app, which lets us recognise your device and enforce the free-tier limit; it can persist across reinstalls. An anonymous account can later be upgraded to a registered account, keeping your library.

3.3 Content you create

We store the descriptions and vibes you enter, any lyrics you generate or edit (including pages in your Rhyme Book that you drop onto a beat), and the resulting audio and metadata (title, genre, BPM, model) in your library. If you share a track, it becomes accessible to anyone with the link and may be indexed by search engines.

3.4 Voice dictation

If you dictate a description with the microphone, the recording is sent to our speech-to-text provider to be transcribed into your prompt. The recording is stored only temporarily and is deleted from our servers within a few hours. Rapper does not clone voices.

3.5 Usage & technical data

To run the service securely we process your IP address (provided to us by Cloudflare), per-day usage counters used to enforce free limits and prevent abuse, and session records (we store only a hashed form of your login token, plus platform and device identifier). We also apply rate limiting.

3.6 Advertising identifiers

The free app shows ads (Google AdMob); Premium removes them. Watching an ad is your choice — when one is offered you can tap Watch ad or Not now. On iOS you choose how ads work through Apple's App Tracking Transparency (ATT) prompt:

• If you allow tracking — the ad SDK (Google AdMob) may use your device's advertising identifier (IDFA) to show personalised ads.
• If you decline or don't choose — you only see non-personalised ads and your advertising identifier is not used to track you.

Our backend stores only a one-time ad transaction reference to prevent reward fraud — never your advertising identifier. You can change your choice anytime in iOS Settings → Privacy & Security → Tracking.

3.7 AI processing (third-party AI services)

Rapper creates music using third-party AI services. To produce your result, your inputs are sent to them as follows:

• Your description, vibe and any lyrics are sent to OpenRouter (which runs the large language model, by default Google Gemini) to write or enhance bars and style captions.
• Your style caption and lyrics are sent to deAPI to generate the beat and vocal audio, and any dictated recording is sent there to be transcribed.

These providers receive only the data needed to produce your output, process it on our behalf under data-processing agreements, and are required to protect it to a standard equivalent to this policy. Your inputs are not tied to your name or account when sent. The app tells you this and asks for your consent before any data is sent to these AI services.

3.8 Purchases (Rapper Premium)

If you buy Premium, Apple or Google process the payment through the App Store or Google Play; we never see your card details. We receive and keep the store's transaction or purchase-token identifiers, the product, purchase and expiry dates, price and currency, renewal and refund status, and a random account token we pass to the store so the purchase can be linked to your account. Apple and Google send us notices about renewals, cancellations and refunds. We use this to provide Premium and handle disputes (Art. 6(1)(b) GDPR) and to keep records required by law (Art. 6(1)(c)). After you delete your account we keep the purchase record without the link to you.

4. How we use your data

• Create and operate your account and authenticate you
• Generate, store and deliver your beats, bars, tracks and shares
• Provide Rapper Premium and handle store purchases, renewals and refunds
• Enforce free-tier limits and prevent abuse, fraud and spam
• Keep the service secure (rate limiting, integrity)
• Moderate shared content and respond to reports
• Comply with legal obligations

We do not sell your personal data.

5. Legal bases (GDPR)

For users in the EEA/UK, we rely on the following legal bases:

• Contract (Art. 6(1)(b)) — creating and running your account, generating, storing and delivering your music, and providing Premium.
• Legitimate interests (Art. 6(1)(f)) — security, rate limiting, abuse and fraud prevention, and keeping a free service sustainable.
• Consent (Art. 6(1)(a)) — voice dictation, sending your inputs to AI services, and personalised ads / App Tracking Transparency. You can withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)) — responding to lawful requests, keeping purchase records, and meeting retention duties.

6. Third-party processors

We share data with the following providers only as needed to run the service. Each has its own privacy policy, and where a provider processes personal data on our behalf it is bound by a data-processing agreement.

• deAPI — receives your style caption, lyrics and any dictated recording to generate music and transcribe speech.
• OpenRouter (default model Google Gemini) — receives your description to compose bars and captions.
• Apple & Google — verify your identity when you use Sign in with Apple or Google, and process Premium purchases through the App Store and Google Play (see Section 3.8).
• Google AdMob — serves and verifies ads in the free app.
• Google Analytics for Firebase — in the app, measures aggregate, anonymous usage (screens viewed, key actions) to help us improve. It may use a device/installation identifier; it does not track you across other companies' apps or websites.
• Google Fonts — serves this website's fonts and receives your IP address as part of delivering them.
• Cloudflare — our network proxy, which sees your IP address and traffic metadata to protect the service.

7. International transfers

Some of our providers process data outside the European Economic Area, including in the United States. Where that happens, transfers are made under appropriate safeguards (such as the providers' Standard Contractual Clauses or data-processing agreements, or an adequacy decision where one applies).

8. Data retention

We keep data only as long as needed. Key retention periods:

9. Your rights & account deletion

Depending on your location, you may have rights to access, correct, delete, restrict, object to, or port your personal data, and to withdraw consent. EEA/UK users may also lodge a complaint with their local data protection authority; our operator is based in Poland, whose authority is the President of the Personal Data Protection Office (Urząd Ochrony Danych Osobowych, UODO).

You can delete your account and data yourself at any time from the app's Settings screen. Deletion permanently removes your account, your library of generated tracks, any public shares you created, your login sessions, and the associated audio files. Deleting your account does not cancel Premium — cancel it in the App Store or Google Play first; we keep purchase records without the link to you. We retain a minimal abuse-prevention record — a device identifier and a count of free generations used — so the free tier cannot be reset by deleting and recreating accounts; it is not linked to your identity.

To exercise any other right, contact hello@boppy.me.

10. Advertising & App Tracking

The free app shows ads; Premium removes them. On iOS we present Apple's App Tracking Transparency prompt. If you allow it, ads may be personalised using your advertising identifier; if you decline, you see only non-personalised ads and are not tracked across apps. Either way we use Apple's SKAdNetwork for privacy-preserving measurement. Watching an ad is your choice — when one is offered you can tap Watch ad or Not now. You can change your tracking choice anytime in iOS Settings.

11. Local storage

The app stores your login token in the device's secure keychain and your preferences (such as the chosen creation mode) in local app storage. This website sets no cookies of its own.

12. Children

Rapper is not directed to children and is not a "Made for Kids" service. It is intended for users aged 13 and over. We do not knowingly collect personal data from children under 13; if you believe a child has provided us data, contact us so we can remove it.

13. Security

Login tokens are stored only as hashes — never in plain text. Traffic is encrypted in transit via TLS. No method of storage or transmission is completely secure.

14. Changes to this policy

We may update this policy from time to time. When we do, we will revise the effective date above, and for material changes we will provide notice in the app or on this site.

15. Contact

Questions about this Privacy Policy or your data? Contact us at hello@boppy.me.