Privacy policy

Effective from 23 October 2016. Last updated 26 July 2026.

This policy explains what Riyaz collects, why, who we share it with, how long we keep it, and what you can do about it.

Riyaz is operated by MusicMuni Labs Private Limited ("MusicMuni", "Riyaz", "we", "us"), registered at 220, 4th C Cross Road, 3rd Block HRBR Layout, Kalyan Nagar, Bengaluru 560043, India. It covers the Riyaz mobile apps on Android and iOS, and the website at riyazapp.com.

Questions, requests, or complaints: care@riyazapp.com.

The short version

Your singing is analysed on your device. Recorded audio is never uploaded to us or stored on our servers.
You can use most of Riyaz without giving us a name or an email.
We do not sell your personal data, and we do not use it for advertising. We collect no advertising identifiers.
Songs you upload are yours; we process them so you can practise with them, and you can delete them at any time.
You can delete your account and its data from inside the app, in Settings.

Using Riyaz without an account

You can open Riyaz and practise without signing in. In that mode the app creates an anonymous identifier so your progress survives restarts on that device. It is not linked to your name, email, or any account, and it does not follow you to another device.

If you later sign in, the practice history from that anonymous session is attached to your new account.

What we collect

Information you give us

When you sign in, you do so through a third-party sign-in provider offered in the app. We receive your email address and, where the provider supplies it, your name. Sign-in credentials are handled by that provider: we never see or store your password.

In the app you may also give us:

Gender, used to set the default vocal range and reference pitch for exercises
App language and music genre preference
Your practice key (shruti) and natural speaking pitch, either measured by the app's voice tools or set by you
Anything you write to us when you contact support

We do not ask for or store your date of birth, postal address, phone number, government identity documents, or photograph.

Your voice, and why we do not have it

Riyaz needs microphone access to work. When you practise, audio from your microphone is analysed in real time, on your device, to work out pitch, timing, and breath. That audio is not sent to our servers and we do not keep a copy of it.

What does reach our servers is the numbers derived from it:

Session results: score, duration, which lesson or song, whether headphones were connected, your practice key, and the timezone the session happened in
Voice metrics: breath capacity, breath control, pitch accuracy, voice agility, natural speaking pitch, and your vocal range

These let us show your progress over time and pick the right exercises for you. They are measurements about your voice, not a recording of it. They cannot be used to reconstruct what you sang, and we do not use them to identify anyone by voice.

Songs you upload

If you upload a song from your device to practise with, the audio file is stored on our cloud infrastructure in India and processed to produce the parts Riyaz needs: a separated vocal track, a backing track, a pitch track, and a timing map.

Uploaded songs are visible only to you. We do not publish them, share them, or use them to train models for other users. You can delete an upload at any time from the app, which removes the source file and everything derived from it. Please only upload music you have the right to use, as set out in the Terms of Use.

Purchases

If you buy a subscription or a course through an app store, the store handles the payment. We receive confirmation that a purchase happened, along with the product, amount, currency, and the store's transaction reference. We never see your card number.

If you pay through a payment gateway instead, that gateway collects and processes your payment details directly under its own privacy policy. We receive the payment status and a reference, not your card or bank details. We do not store card details on our servers.

Device and technical information

To deliver the app and keep it working we process device model, operating system version, app version, app language, network state, whether headphones are connected, crash and performance diagnostics, and an app-instance identifier used by analytics.

Attribution

If you arrive at Riyaz through an advertisement, referral link, or campaign, we record the campaign, source, and medium values so we know which channel brought you. We use an attribution and deep-linking service for this; once you are signed in it also receives your account identifier, so a link you tap opens against the right account.

Notifications

If you allow notifications, we store a push token so we can send practice reminders and product updates. You can turn notifications off in the app or in your device settings; doing so affects nothing else.

Analytics

Analytics identifiers. We use a third-party analytics service to understand how the app is used. When you are signed in, we associate your app activity with a randomly generated internal account identifier so that we can measure your progress and improve the product across the devices you use. This identifier is not your name, email address, or phone number, and we do not send those to our analytics provider. When you sign out, we stop associating new activity with your account identifier.

How long we keep analytics data. We retain individual app-usage events for up to 24 months, after which they are deleted. Aggregated and anonymised statistics that cannot be linked back to you (for example, daily totals by feature or country) may be kept indefinitely to track long-term product trends. You can request deletion of your account and its associated analytics data at any time by writing to care@riyazapp.com, or by deleting your account in the app under Settings.

No advertising. We do not collect advertising identifiers, we do not run advertisements inside Riyaz, and we do not share your data with advertising networks.

Why we are allowed to process your data

Where the EU or UK GDPR applies, our legal bases are:

Contract: creating and running your account, delivering lessons and practice tools, processing purchases and entitlements.
Legitimate interests: keeping the service secure, diagnosing crashes, measuring how features are used so we can improve them, and understanding which channels bring learners to Riyaz. We balance these against your rights, and you can object.
Consent: notifications, and analytics identifiers where consent is required. You can withdraw consent at any time, and withdrawing it does not affect processing that already happened.
Legal obligation: keeping tax and accounting records for purchases.

Where India's Digital Personal Data Protection Act, 2023 applies, we process your personal data on the basis of your consent and for the legitimate uses that Act permits.

Who we share it with

We do not sell your personal data, and we do not share it with anyone for their own marketing.

We use service providers who process data on our instructions and only to provide their service to us. They fall into these categories:

Authentication and identity
Cloud hosting, storage, and content delivery
Analytics and product measurement
Crash and performance monitoring
Push notifications and messaging
Payment processing and app-store billing
Attribution and deep linking
Customer support tooling

We choose providers that offer appropriate security and confidentiality commitments, and we put data-processing terms in place with them. If you want to know which providers we currently use, ask us at care@riyazapp.com and we will tell you.

We will also disclose personal data where we are legally required to, where it is necessary to establish or defend a legal claim, or where we reasonably believe it is needed to prevent serious harm. If we are ever part of a merger or acquisition, your data may transfer with the business, and we will tell you before it does.

International transfers

We are based in India and our production data is stored in India.

If you are in the European Economic Area, the UK, or Switzerland, your data is transferred to India, which does not benefit from an EU adequacy decision. We rely on the European Commission's Standard Contractual Clauses, together with the measures described under Security, to protect those transfers. You can ask us for a copy of the relevant safeguards.

Some of our providers may process data in other countries under their own transfer mechanisms.

How long we keep things

Account and profile: until you delete your account.
Practice history and voice metrics: until you delete your account.
Uploaded songs and their derived files: until you delete the upload, or your account.
Analytics events: up to 24 months, then deleted. Aggregated statistics that cannot be linked to you may be kept indefinitely.
Crash reports: under the standard retention of our monitoring provider.
Purchase and invoice records: for as long as Indian tax and company law requires, even after you delete your account.

When you delete your account we remove your profile, practice history, voice metrics, and uploads. Backups are cycled out within 90 days.

Your rights

Wherever you live, you can:

Delete your account and its data from inside the app, under Settings, or by writing to care@riyazapp.com
Ask for a copy of the personal data we hold about you
Ask us to correct anything that is wrong
Turn off notifications without losing anything else

If the EU or UK GDPR applies to you, you also have the right to restrict processing, to object to processing based on legitimate interests, to data portability in a machine-readable format, and to withdraw consent. You have the right to complain to your national data protection authority, and we would rather you told us first so we can put it right.

If India's Digital Personal Data Protection Act, 2023 applies to you, you have the right to a summary of your data and our processing, the right to correction and erasure, the right to nominate someone to exercise your rights if you cannot, and the right to a grievance process. Our Grievance Officer is named below.

If you are a California resident, you have the right to know what we collect and why, to have it deleted, to have it corrected, and not to be treated differently for exercising those rights. We do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not process personal information for cross-context behavioural advertising.

We answer requests within 30 days. We may ask you to confirm you control an account before acting on a request about it.

Children

Riyaz is not for children under 13, and we do not knowingly collect personal data from them.

If you are between 13 and 15, you may use Riyaz only with the consent of a parent or guardian. Where your local law sets a higher age for consenting to data processing, that age applies to you instead. A parent or guardian may contact us at care@riyazapp.com to see, correct, or delete their child's data, or to withdraw consent.

If we learn that we have collected personal data from a child under 13, or from a young person without the consent their local law requires, we delete it.

Security

Traffic between the app and our servers is encrypted in transit.
Sign-in is handled by an external identity provider, so we never hold your password.
Data at rest is encrypted on our cloud infrastructure.
Access to production data is limited to the people who need it, and is authenticated and logged.
We run crash and error monitoring so that failures surface quickly.

No system is perfectly secure. If we discover a breach affecting your personal data, we will notify you and the relevant regulator where the law requires it, within the deadlines it sets.

If you think your account has been compromised, email care@riyazapp.com.

Cookies on riyazapp.com

The Riyaz app does not use cookies.

The website at riyazapp.com uses analytics cookies to count visits and see which pages are read. They load only after you accept them in the banner shown on your first visit; if you decline, no analytics script is loaded. The website sets no advertising cookies.

You can clear or block cookies in your browser at any time. The site works without them.

Changes to this policy

We will update this page when what we do changes. The "last updated" date at the top always reflects the current version. If a change materially affects how we use your personal data, we will tell you in the app or by email before it takes effect, and where the law requires your consent, we will ask for it.

Contact and complaints

For anything in this policy, email care@riyazapp.com.

Grievance Officer (under the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023):

Gopala Krishna Koduri MusicMuni Labs Private Limited 220, 4th C Cross Road, 3rd Block HRBR Layout, Kalyan Nagar, Bengaluru 560043, India care@riyazapp.com

We acknowledge grievances within 48 hours and resolve them within 30 days.

The Terms of Use govern your use of Riyaz alongside this policy.