Privacy Policy

Effective date: August 26, 2026

1. Introduction

Rapper is a free AI rap studio for iPhone, with a companion website at rapper.studio. This Privacy Policy explains what data we collect, why, who we share it with, how long we keep it, and the rights you have. It applies to the app, this website, and the backend that powers them.

The data controller is CoinAxe Ltd, a company registered in Malta (company no. C 94976), Dragonara Business Centre, 5th Floor, Dragonara Road, St. Julians STJ 3141, Malta. For any privacy question or to exercise your rights, contact us at hello@boppy.me.

2. Scope

This policy covers data processed by Rapper directly. Rapper shares its backend with Boppy, our other music app, operated by the same company under the same safeguards. Services we rely on (the App Store, sign-in providers, and the processors listed in Section 6) handle some data under their own privacy policies, which we encourage you to read.

3. Data we collect

3.1 Account & identity

If you create an account, we store the data needed to operate it: a provider identifier if you use Sign in with Apple or Sign in with Google (and the email/name they return), an optional display name, the timestamp at which you accepted our Terms, and your plan.

3.2 Anonymous accounts & device identifier

You can make a limited number of tracks without registering. To do this we store a device identifier generated by the app, which lets us recognise your device and enforce the free-tier limit; it can persist across reinstalls. An anonymous account can later be upgraded to a registered account, keeping your library.

3.3 Content you create

We store the descriptions and vibes you enter, any lyrics you generate or edit (including pages in your Rhyme Book that you drop onto a beat), and the resulting audio and metadata (title, genre, BPM, model) in your library. If you share a track, it becomes accessible to anyone with the link and may be indexed by search engines.

3.4 Voice dictation

If you dictate a description with the microphone, the recording is sent to our speech-to-text provider to be transcribed into your prompt. The recording is stored only temporarily and is deleted from our servers within a few hours. Rapper does not clone voices.

3.5 Usage & technical data

To run the service securely we process your IP address (provided to us by Cloudflare), per-day usage counters used to enforce free limits and prevent abuse, and session records (we store only a hashed form of your login token, plus platform and device identifier). We also apply rate limiting.

3.6 Advertising identifiers

Rapper may show optional rewarded ads to keep the app free, and you choose how they work through Apple's App Tracking Transparency (ATT) prompt:

• If you allow tracking — the ad SDK (Google AdMob) may use your device's advertising identifier (IDFA) to show personalised ads.
• If you decline or don't choose — you only see non-personalised ads and your advertising identifier is not used to track you.

Our backend stores only a one-time ad transaction reference to prevent reward fraud — never your advertising identifier. You can change your choice anytime in iOS Settings → Privacy & Security → Tracking.

3.7 AI processing (third-party AI services)

Rapper creates music using third-party AI services. To produce your result, your inputs are sent to them as follows:

• Your description, vibe and any lyrics are sent to OpenRouter (which runs the large language model, by default Google Gemini) to write or enhance bars and style captions.
• Your style caption and lyrics are sent to deAPI to generate the beat and vocal audio, and any dictated recording is sent there to be transcribed.

These providers receive only the data needed to produce your output, process it on our behalf under data-processing agreements, and are required to protect it to a standard equivalent to this policy. Your inputs are not tied to your name or account when sent. The app tells you this and asks for your consent before any data is sent to these AI services.

4. How we use your data

• Create and operate your account and authenticate you
• Generate, store and deliver your beats, bars, tracks and shares
• Enforce free-tier limits and prevent abuse, fraud and spam
• Keep the service secure (rate limiting, integrity)
• Moderate shared content and respond to reports
• Comply with legal obligations

We do not sell your personal data.

5. Legal bases (GDPR)

For users in the EEA/UK, we rely on the following legal bases:

• Contract (Art. 6(1)(b)) — creating and running your account and generating, storing and delivering your music.
• Legitimate interests (Art. 6(1)(f)) — security, rate limiting, abuse and fraud prevention, and keeping a free service sustainable.
• Consent (Art. 6(1)(a)) — voice dictation, sending your inputs to AI services, and personalised ads / App Tracking Transparency. You can withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)) — responding to lawful requests and meeting retention duties.

6. Third-party processors

We share data with the following providers only as needed to run the service. Each has its own privacy policy, and where a provider processes personal data on our behalf it is bound by a data-processing agreement.

• deAPI — receives your style caption, lyrics and any dictated recording to generate music and transcribe speech.
• OpenRouter (default model Google Gemini) — receives your description to compose bars and captions.
• Apple & Google — verify your identity when you use Sign in with Apple or Google.
• Google AdMob — only if ads are enabled, to serve and verify rewarded ads.
• Google Analytics for Firebase — in the app, measures aggregate, anonymous usage (screens viewed, key actions) to help us improve. It may use a device/installation identifier; it does not track you across other companies' apps or websites.
• Google Fonts — serves this website's fonts and receives your IP address as part of delivering them.
• Cloudflare — our network proxy, which sees your IP address and traffic metadata to protect the service.

7. International transfers

Some of our providers process data outside the European Economic Area, including in the United States. Where that happens, transfers are made under appropriate safeguards (such as the providers' Standard Contractual Clauses or data-processing agreements, or an adequacy decision where one applies).

8. Data retention

We keep data only as long as needed. Key retention periods:

9. Your rights & account deletion

Depending on your location, you may have rights to access, correct, delete, restrict, object to, or port your personal data, and to withdraw consent. EEA/UK users may also lodge a complaint with their local data protection authority; our operator is based in Malta, whose authority is the Information and Data Protection Commissioner (IDPC).

You can delete your account and data yourself at any time from the app's Settings screen. Deletion permanently removes your account, your library of generated tracks, any public shares you created, your login sessions, and the associated audio files. We retain a minimal abuse-prevention record — a device identifier and a count of free generations used — so the free tier cannot be reset by deleting and recreating accounts; it is not linked to your identity.

To exercise any other right, contact hello@boppy.me.

10. Advertising & App Tracking

Rapper may show ads to keep the app free. On iOS we present Apple's App Tracking Transparency prompt. If you allow it, ads may be personalised using your advertising identifier; if you decline, you see only non-personalised ads and are not tracked across apps. Either way we use Apple's SKAdNetwork for privacy-preserving measurement. Rewarded ads are optional and user-initiated — no purchase is required. You can change your tracking choice anytime in iOS Settings.

11. Local storage

The app stores your login token in the device's secure keychain and your preferences (such as the chosen creation mode) in local app storage. This website sets no cookies of its own.

12. Children

Rapper is not directed to children and is not a "Made for Kids" service. It is intended for users aged 13 and over. We do not knowingly collect personal data from children under 13; if you believe a child has provided us data, contact us so we can remove it.

13. Security

Login tokens are stored only as hashes — never in plain text. Traffic is encrypted in transit via TLS. No method of storage or transmission is completely secure.

14. Changes to this policy

We may update this policy from time to time. When we do, we will revise the effective date above, and for material changes we will provide notice in the app or on this site.

15. Contact

Questions about this Privacy Policy or your data? Contact us at hello@boppy.me.