Privacy Policy

The OPTIMUS GRYME Tunes Portal ("the Portal") is operated by OPTIMUS GRYME, based in Aotearoa New Zealand. This policy explains what personal information we collect when you use the Portal, why we collect it, and the choices you have. It is written to align with the New Zealand Privacy Act 2020.

• Account information. Your email address (always), and — if you sign in with Google — your name, profile picture, and Google account ID. We never receive your Google password.
• Listening activity. Which tracks you stream or download from the Portal, with timestamps. We use this to understand what's landing with the crew and to keep the catalog tight.
• Technical information. IP address, browser, device type, and session cookies needed to keep you signed in.

• To give you access to the Portal and its tracks.
• To deliver streams and WAV/MP3 downloads to you.
• To understand which tunes are getting played so we can shape future releases.
• To send you transactional email — magic-link sign-ins, release notifications, and account messages.

We do not sell your personal information. We do not use it for third-party advertising.

We use the following third-party processors to run the Portal. Each only receives the data they need to do their job:

• Clerk — authentication (sign-in, magic links, Google OAuth, session management).
• Vercel — application hosting and request logs.
• Cloudflare R2 — audio file storage and delivery.
• Turso (libSQL) — database for your account and library.
• Google — only if you choose to sign in with Google. Google receives only what is needed to authenticate you.
• Email delivery(Mailgun / Resend / equivalent) — to send transactional email from notifications@optimusgryme.nz.

Some of these processors store data outside New Zealand (typically the United States or European Union). By using the Portal you consent to this transfer.

We use a small number of cookies, all strictly necessary for the Portal to work — the session cookie issued by Clerk when you sign in, and a CSRF token. We do not use advertising or analytics cookies.

We keep your account information for as long as your account is active. Listening activity is kept for up to 24 months for catalog-planning purposes, then aggregated. You can ask us to delete your account at any time — see "Your rights" below.

Under the Privacy Act 2020 you can ask us to:

• Confirm what personal information we hold about you.
• Correct anything that is wrong.
• Delete your account and the personal information attached to it.
• Stop sending you non-essential email (you can also unsubscribe from any email we send).

To make any of these requests, email notifications@optimusgryme.nz. We aim to respond within 20 working days.

We use HTTPS for everything, hash passwords (when applicable) via our auth provider, and restrict access to production data to a small number of operators. No system is perfectly secure — if we ever discover a breach that affects your information, we will notify you and the Office of the Privacy Commissioner as the law requires.

The Portal is intended for people aged 16 and over. If you are under 16, please do not create an account. If we learn we have collected information from someone under 16, we will delete it.

If we make material changes to this policy we will email you and update the "Effective" date at the top of this page. Continued use of the Portal after a change means you accept the updated policy.

Questions, requests, or complaints about privacy: notifications@optimusgryme.nz.

You also have the right to complain to the New Zealand Office of the Privacy Commissioner at privacy.org.nz.