Lel Privacy Policy

Last updated: November 12, 2026.

Who is responsible

Data controller: Andrii Horiachkin, Kyiv, Ukraine. Contact: accmusic.support@gmail.com.

What data we process and why

Data	Why
Email and password	To create your account and sign in. The password is stored only as a hash by our authentication provider.
Sign in with Google (if you use it)	Google sends us your email, name, profile photo link and the internal ID of your Google account. We use the email to sign you in to the Lel account with the same email or to create a new one; the rest is stored by our authentication provider together with the sign-in method. We never receive your Google password.
Confirmation that you are 18 or older	When you sign up you tick “I’m 18 or older”. We keep only the fact and time of confirmation. We don’t ask for or store your date of birth.
Profile: username, name, bio, photo, interests, preferred music service	To show your profile and recommend music and fan pages.
Content: posts, comments, likes and reactions to posts, playlists, fan pages, topics and replies in fan page discussions, likes on replies and topics you follow, the “Favorites” selection on your profile (which sections to show and what you chose), likes and saves of Lel Picks, and whether you hid Lel Picks	To run the social network.
Connections: followers, follow requests, blocks, and whether “Post notifications” is on for a follow	To show and protect your network; to tell you about new posts from people you follow, only if you turn it on.
Direct messages: text, forwarded post (a link to it), sticker and caption; who you message with; message requests; up to which message you have seen a conversation (for the unread counter and, only if both of you have “Read receipts” on, for the “Read” mark); the “Who can message me”, “Messages (push)”, “Read receipts” and “Typing indicator” settings	To deliver messages between you and the other person, to show unread conversations and, if you both allow it, the “Read” mark.
Posts you have already seen in the feed	To order the “All” feed: posts you have seen move down. We also use your interests, who you follow, and your likes and comments to order it. Only you can see this list.
When you last viewed new reactions to your posts	To show you only the new reactions on your posts. Only you can see it.
Reports you send and receive, with a copy of the reported content	Moderation and safety.
“Now playing” (off by default): title, artist, album and length of the song and which music player is playing it, only from players on an allow list (Spotify, YouTube Music, Apple Music, Deezer, Amazon Music, SoundCloud, TIDAL)	To show the people you choose what you are listening to. It works only after you turn it on in the app and give the notification access that Android requires for it. We never read or store the text of notifications or messages, don’t look at other apps and don’t record sound. Podcasts and ads are not sent. The player’s internal track ID is checked only to filter out podcasts and ads and is not stored.
Music searches	Sent to open catalogs (iTunes Search API, MusicBrainz) to find songs. Lel does not store or play audio.
In-app notifications	To tell you about followers, replies, likes and reactions, and about new posts if you turned on “Post notifications” for a follow.
Push notifications: the push token of this phone (an identifier issued by Firebase Cloud Messaging) and your setting “Text on the lock screen”	To deliver notifications to your phone when the app is closed. The token belongs only to the account that is active on the phone. A push contains the type of event (for example, which reaction), the username of who did it and, only if you turn on “Text on the lock screen”, up to 100 characters of the comment, post or discussion reply and, for discussions, also the topic title. You can turn push off in Settings → Notifications or in Android settings.
A verified artist badge request (if you send one): the artist you chose in the catalog, who is applying (the artist or their team), stage name, country, your Instagram username, up to 3 links to other official pages, an email for our reply, the LEL-XXXX verification code, and the moderator’s decision with its reason. When you send the code by Direct to Lel’s Instagram, we store that it arrived and the username it came from; if the server does the check, also the “verified account” mark and the follower count of that account that Instagram (Meta) gives us. We don’t store the message text	To check that the profile is run by the artist or their team and show the badge. A Lel moderator (or the server, if automatic checking is on) checks that the code came by Direct from the account in the request. Without Instagram — an email from the artist’s domain. We use the email only to reply about the request. We don’t ask for documents. The push about the decision only says what kind it is — the reason is shown only in the app.

On your device

The app stores on the phone, encrypted and excluded from backups, the sessions and basic data (email, username, name) of up to 5 added accounts. They are removed when you sign out of that account or delete it. The last 8 search queries of each account are also kept only on this phone; you can delete them in Search (“Clear”), and they are removed together with the account on this device. Translation (Settings → Translation, on by default) works on the phone: texts of posts, comments and descriptions are not sent anywhere to be translated — not to us and not to Google. The translation module is part of the app; only language packs (~30 MB per language) are downloaded from Google and kept on this phone; you can delete a language there. Translation settings, “Languages I understand” and which languages show up in your feed (to download languages in advance) are kept only on this phone. Google receives only technical data about how translation and language detection work, without the content of texts: an installation identifier, the app name and version, the phone model, the languages detected on the phone and the text size (details in “Who we share data with”).

Who we share data with

Database, authentication and storage provider: Supabase (servers in the United States, East US region, North Virginia).
Email delivery (confirmation codes): Brevo.
Music catalogs: Apple (iTunes Search API) and MetaBrainz (MusicBrainz) receive only the search text or the song identifier.
Google Play: app distribution.
Sign in with Google: Google (Google Identity) verifies your Google account and learns that you sign in to Lel. Only if you choose “Continue with Google”.
Artist verification via Instagram: Meta (Instagram). You send the LEL-XXXX code to Lel’s Instagram by Direct yourself, so Instagram handles that message under its own terms. If automatic checking is on, Meta delivers that message to us and we ask it for the username, the “verified account” mark and the follower count of the sending account. We don’t pass any other Lel data to Meta. Only if you request the verified artist badge and choose Instagram.
Push notifications: Google (Firebase Cloud Messaging) receives the push token of the phone and the content of each push (type of event and reaction, username and, only if you enable it, a short text and the discussion topic title). We use only Firebase Cloud Messaging, without Firebase analytics or advertising. For direct messages, the push includes the sender’s username and, only if you turn it on, up to 100 characters of the text.
Automatic translation: Google (ML Kit and Google Play services) provides the language packs that are downloaded to the phone (the translation module is part of the app), and, for diagnostics and usage statistics, receives technical data about how ML Kit works: an installation identifier (not intended to identify a person or a phone), the app name and version, the phone manufacturer and model, the system version, the languages detected on the phone, the chosen translation language pair, the text size (not its content), errors and duration. For translation, ML Kit also uses Firebase Installations and Firebase Remote Config. Google does not receive the texts being translated. The data is sent encrypted (HTTPS), and Google does not share it with third parties. While “Translation” is on, language detection runs on the phone for every text by someone else on screen — also when automatic translation is off: that is how the “Translate from …” button appears; Google Play services prepare the language detection module as soon as Lel starts. Translation data, only when the phone translates: automatically or with the “Translate from …” button. To turn it all off: Settings → Translation → “Translation”; then the language of texts isn’t detected, nothing is translated or downloaded, and no modules are prepared when Lel starts.

We do not sell your data or use it for advertising.

Who sees your content

Your profile and posts are visible according to your settings (public or private profile).

Your reactions to posts are seen by everyone who can see the post: they see the number of reactions of each kind and, in the “Reactions” list, who reacted and with which reaction (people you blocked or who blocked you are not shown).

“Favorites” on your profile: up to three fan pages, playlists and songs per section — the ones you chose or, until you choose, your fan pages, your latest public playlists and your latest favorite songs. It is seen by everyone who can see your profile (except people you blocked or who blocked you); nobody receives anything beyond what is shown. Your favorite songs (the ones you hearted) are seen by the people you pick in “Who sees your favorite tracks”: mutual followers, followers (default), everyone or nobody. You can change this on your profile: the pencil next to “Favorites”. The total number of likes of a song is visible to everyone, without names.

“Now playing” is seen by the audience you choose: mutual followers (default), followers, everyone or nobody. You can change it any time in Settings → Music → “Who sees what I’m listening to”. People you blocked or who blocked you never see it. We keep only your current status, with no listening history. To turn it off: Settings → Music → “Show what I’m listening to”, or Settings → Permissions → “Player access”, or remove Lel’s notification access in Android settings. Turning it off, signing out or switching accounts deletes your status from our server right away.

Lel Picks are put together automatically (including with the help of AI) from public music catalogs; the Lel team reviews each one before it’s published. They aren’t recommendations from other users. Nobody sees your likes or saves of picks, and the number of likes is never shown. To hide them from your feed: “⋯” on a pick → “Hide Lel Picks”.

Everyone can see the verified artist badge next to your name, and fan pages about that artist show “Official profile” with a link to you. Only you and Lel moderators can see your badge request, its status and the reason for the decision, and the email and links in it; we don’t show you the moderator’s name.

Direct messages

Who sees them. Only you and the person you’re talking to.
“Read” mark. While a conversation is open on your screen, we save up to which message you have seen it. The other person sees “Read” under their messages only if both of you have “Read receipts” on (on by default); if either of you turns it off, neither of you sees the other’s “Read”. There is no mark in a message request that hasn’t been accepted or after a block. In a message request there is no mark until it’s accepted, and messages read before that aren’t marked afterwards. To turn it off: Settings → Privacy and security → Messages → “Read receipts”.
“Typing…”. While a conversation is open on your screen, the app lets the other person know that you are typing or choosing a sticker or an emoji (they also see it in their list of conversations). This signal goes through our real-time service (Supabase Realtime) only to the other participant of an accepted conversation, disappears from the screen within a few seconds and isn’t kept with your messages: only the conversation and the type of signal pass through the service’s internal queue, which Supabase deletes automatically within a few days; it isn’t sent after a block. The indicator also works both ways: the other person sees it only if both of you have “Typing indicator” on (on by default); turn it off and you won’t see theirs either. Not shown in a message request until it’s accepted. To turn it off: Settings → Privacy and security → Messages → “Typing indicator”.
Encryption. Messages are stored on our servers (Supabase) and travel over a secure connection (HTTPS), but without end-to-end encryption: technically, Lel as the service operator can access them. We don’t read your conversations or use them for ads or recommendations.
Moderation. Moderators see messages only after a report: a report on a message includes a copy of that message; a report on a conversation or message request includes a copy of the reported person’s last 10 messages (text and markers for forwarded posts and stickers). Moderators don’t see any other messages.
Who can message you. By default, only mutual follows. In Settings → Privacy and security → “Who can message me” you can let your followers send a message request or block new conversations (“No one”; accepted conversations stay). Blocked people can’t message you.
Deleting. “Delete for everyone” immediately removes the message text, post and sticker for both of you (a “Message deleted” marker stays). “Delete conversation” only hides it for you. When you or the other person deletes their account, the conversation and all its messages are deleted for both.
Push. A message push includes the sender’s username and, only if you turn on “Text on the lock screen”, up to 100 characters of the text; a message request push has no text. To turn it off: Settings → Notifications → “Messages (push)”.

How long we keep data

Account and content: until you delete your account.
Likes, saves and hiding of Lel Picks: until you undo them or delete your account. Reports on picks are kept like other reports.
Notifications: 90 days.
Push token: while push is on for that account on this phone; deleted when you turn push off, sign out, switch to another account (the token moves to it), delete the account, or when Firebase reports it is no longer valid (for example, after the app is removed). One account keeps at most 10 tokens; older ones are deleted.
Posts you have seen in the feed: 30 days.
“Now playing”: only the latest status, up to 6 hours; deleted sooner when you turn the feature off, sign out, switch accounts or delete your account.
Reports with a copy of the content: up to 90 days after the reported account is deleted; child safety reports: 1 year from the decision, longer if required by law or a law enforcement request.
Direct messages: until you or the other person deletes their account (the conversation is then deleted for both) or until the sender deletes the message “for everyone”. Message copies in reports follow the reports item.
Username of a deleted account: reserved for 30 days to prevent impersonation (no other data).
Verified artist badge requests (request details, code, decision and its reason): until you delete your account. The moderation log entry for the decision (the artist’s catalog ID, decision and reason — no email or links) is kept for the security of the service.
Provider backups: our current plan does not include scheduled backups.
Replaced profile photos: the app deletes the previous photo right after it is replaced. If that deletion fails, the file may stay on the server until you delete your account.

Deleted topics and replies in fan page discussions disappear for everyone, but we keep them hidden for 1 year to review reports and then delete them. If you delete your account, the text of your topics and replies is erased immediately; only copies included in reports, if any, remain for up to 1 year.

Deleting your account

Immediate and permanent: in the app (Profile → ☰ → Settings → “Delete account”), on the web at https://accmusic.github.io/vybe-account-deletion/ or by email to accmusic.support@gmail.com. Other people’s replies to your comments are kept and your comment shows as deleted. Your discussion replies show as “Reply deleted” and their text is erased. Your topics without replies from others are deleted; in topics with replies from others, the title, text and attachments are erased and those replies are kept. Your direct conversations are deleted for both people.

Your rights

You have the right to access your data, correct it, delete it, restrict its processing, data portability, object to processing and withdraw your consent. To use these rights, write to accmusic.support@gmail.com. You can also complain to the data protection authority of your country: in Ukraine, the Ukrainian Parliament Commissioner for Human Rights; in Spain, the AEPD.

Minors

Lel is only for people aged 18 and over. If we learn that an account belongs to someone under 18, we block it right away and delete it after 7 days; during that time the person can write to us if it’s a mistake. A blocked account can’t confirm its age again. Anyone can report a profile that looks like it belongs to someone under 18.

Changes

We will announce important changes to this policy in the app.