Kobyna — Privacy and Cookie Policy
Version 2 · Updated 19 September 2026
1. Who is responsible
Kobyna is published by Kobyna Entertainment, a French company being formed (société en cours de formation), represented by its founder, Christian Kakesa. It is the controller of the personal data described here. Its registration details will be added here once it is registered.
For any question or request about your data: ask@kobyna.com. We have not appointed a data protection officer.
2. What we collect, why, on what legal basis, and for how long
| What | Why | Legal basis | How long |
|---|---|---|---|
| Account: email address and password (stored only as a one-way hash) | To create and secure your account and sign you in | Performance of the Terms | Until your account is deleted |
| Acceptance of the terms: which document and version you accepted, when, and your confirmation that you are 16 or over (18 or over for the Artist Terms); which version of this policy was shown to you | To prove what was agreed and when | Performance of the Terms, and legitimate interest (proof) | As long as your account exists |
| Invitation: the email address an invitation was sent to | Early access is by invitation | Performance of the Terms (steps before the contract) | Until the invitation is revoked; if never used, 30 days after it expires; once used, as long as the account it created |
Session cookie (audio_session) |
To keep you signed in, and to let the player work without an account | Performance of the Terms (strictly necessary) | 30 days, renewed as you use the Service |
| Listening history: which tracks were played for at least 30 seconds, on which day, by which account, or by which anonymous session | To stream, to count plays, and to attribute each listener's share to the artists they actually play (the fan-powered royalty model) | Performance of the Terms | 24 months linked to your account or session; after that, only monthly totals per artist and per track (how many plays, how many listeners), which identify no listener and cannot be traced back to anyone. When your account is deleted, your plays are unlinked from it at once |
| Artist information: artist name, the account linked as the artist's payee, uploaded audio, artwork, titles, credits and tags, and the history of reviews and takedowns | To publish the artist's music, check uploads, review artwork, and later pay royalties | Performance of the Artist Terms | While the content is online; deleted content leaves our backups within 90 days. Review and takedown records are kept as long as the account, and longer if needed for a claim; once the account is deleted they keep only its account number, with no name or address |
| Reports: the reason and explanation, the page, and the reporter's name, email and account if signed in | To handle notices of illegal content and tell the reporter our decision | Legal obligation (Digital Services Act) | The reporter's name and email are erased 180 days after the report is closed; the rest of the report is kept as a record |
| Emails you send us | To answer you | Legitimate interest (answering you), or legal obligation for rights requests | As long as needed to handle the request, then up to 3 years |
| IP address | To protect the Service against abuse (rate limits, sign-in throttling) | Legitimate interest (security) | Kept in memory only, for minutes; not written to our logs |
| Technical logs (errors and events, without IP addresses) | To run and secure the Service | Legitimate interest | 90 days |
| Backups of the database | To recover from an incident | Legitimate interest | 14 days on our server, 90 days in our offsite copy |
| Analytics (Google Analytics cookies and audience measurement: pages viewed, without the query string, and events such as playing a track) | To understand how the Service is used | Consent | Only if you accept; your choice is stored with its date and asked again after 13 months; Google keeps the data 14 months; you can withdraw consent at any time |
We do not sell your personal data, we do not use it for advertising, and we make no decision about you based solely on automated processing. Artists see statistics about their audience (numbers of plays and listeners, shares), never who listened.
3. Cookies and similar technologies
- Strictly necessary, no consent needed: the
audio_sessioncookie (section 2), and your choice about analytics, stored in your browser's local storage (gaConsent) so we do not ask again. - Analytics, only with your consent: Google Analytics cookies (
_ga,_ga_*). When you first visit, a banner lets you accept or refuse. Refusing is as easy as accepting, and the Service works the same either way. To change your choice, use the Cookie settings link (in the player's sidebar, or at the bottom of the home page); withdrawing deletes the analytics cookies. We ask again after 13 months. - No other site is contacted before you accept. Fonts and the player's streaming library are served by Kobyna itself, so loading a page sends nothing to Google or to a content delivery network.
4. Who receives your data
Only people at Kobyna Entertainment who need it, and service providers that process it on our behalf, under contracts that require them to protect it:
| Provider | What they do | Where |
|---|---|---|
| netcup GmbH | Hosts the website, the database and its backups | Germany (Nuremberg) |
| Cloudflare, Inc. | Stores audio, artwork and copies of our database backups (encrypted at rest by Cloudflare) | Storage located in the European Union; Cloudflare is a US company |
| OVH SAS | Hosts our email (contact addresses) | France / European Union |
| Google Ireland Ltd / Google LLC | Analytics, only with your consent | European Union and United States |
We may also disclose data when the law requires it, for example to a court or an authority, and to rightholders or authorities where a report concerns illegal content.
5. Transfers outside the European Union
Google LLC and Cloudflare, Inc. are established in the United States. Transfers to them rely on the EU-U.S. Data Privacy Framework, under which both are certified, and on the European Commission's standard contractual clauses included in their data processing terms.
6. Your rights
You can ask us to:
- access your data and receive a copy;
- correct it;
- delete it (including closing your account);
- restrict its processing, or object to processing based on our legitimate interest;
- receive the data you gave us in a portable format (portability);
- withdraw your consent to analytics at any time, without affecting what happened before.
In France you can also give instructions about what happens to your data after your death.
You can delete your account yourself, from Settings in the player. It asks for your password and for your email address, and it takes effect immediately.
For anything else, write to ask@kobyna.com (or legal@kobyna.com, which the Terms of Use give for closing an account) from the email address of your account, so we can check the request is yours. We answer within one month. We handle those requests by hand.
When we delete an account, we delete the account, its sessions, its invitation and its acceptance of the terms, and remove your name and address from reports you sent. We keep only a record of the account number and the date, with nothing else, so that restoring one of our backups cannot bring the account back; the backups themselves expire within 90 days. If you manage an artist, we first hand the artist over to whoever holds its rights, or take its music down.
If you think your rights are not respected, you can complain to the CNIL (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr) or to the data protection authority of the country where you live.
7. Security
Passwords are stored only as salted one-way hashes. Connections are encrypted (HTTPS). Session cookies cannot be read by scripts on the page. Access to production systems is limited to the people who run the Service. Backups are copied off-site.
8. Children
Accounts are for people aged 16 or over, and artist accounts for people aged 18 or over. If you believe a younger child has created an account, write to ask@kobyna.com and we will delete it.
9. Changes
We will tell account holders by email and in the Service before a significant change to this policy takes effect.