Privacy policy
Updated 28 September 2026 · Français
Who handles your data?
Rebound is provided by Stéphane Bucco, in France, the controller for this service. Contact contact@joinrebound.co with privacy questions or requests. This policy covers the Rebound app and joinrebound.co website.
Account and security
Sign in with Apple provides authentication. We store the Apple identifier specific to Rebound, an account identifier, sign-in dates, sessions and installation security credentials (App Attest). Authentication tokens are protected; we never receive your Apple password. This sign-in flow does not store your Apple account name or email address. This information supports authentication and service security.
Profiles, Rebounds and messages
We store the information you provide: a name or nickname, avatar, optional biography and profile links, Rebound titles, participation, invitations and access requests. Messages, reactions, music choices, dates and session histories support music sharing and chat. Shared content may also include media references and the terms used to search for them. This data is associated with participation identifiers and, where linked, your account. Authorized participants can see information shared in their Rebound; messages are not end-to-end encrypted. Other participants may retain copies.
Apple Music, photos, contacts and dictation
Apple Music supplies the catalogue and plays music on each device with your permission and subscription. Rebound uses track references and metadata, not copies of audio files. Only the image you select as your avatar is sent to Rebound. Contacts are used locally to prepare invitations and are not imported into our server; names you choose for invitations may be stored. Optional dictation uses on-device recognition to produce text: we do not store or send your voice recording to our server. You can manage permissions in iOS Settings.
Service providers
Apple processes data required for its sign-in and music services. Cloudflare hosts our API, database and website and processes technical information needed for operation and security. These providers may process data outside the European Economic Area under their contractual safeguards and privacy policies.
Service measurement, support and Music Club
We measure sign-ins, account activity, sessions and music usage to understand how Rebound operates. Limited technical logs support error diagnosis, cost monitoring and security. When you contact support, we process your email, message and any technical information you send. Optional Inside the Music Club registration separately records your email, language, source, date and consent wording version, solely for priority invitations and launch news.
Purposes and retention
Accounts, sessions and exchanges are processed to provide the service you request. Security, usage measurement and support rely on our legitimate interest in operating and improving the service. Music Club communications rely on your consent. Account data and histories remain available while needed for the service or until deletion is requested. Detailed account sign-in and activity events older than 90 days are purged during service maintenance operations. Provider logs and backups follow their technical retention periods. We do not sell your data or use cross-app advertising tracking.
Delete your account
In the app: Preferences → Apple Connect → Delete my account. Deletion revokes Rebound’s Apple authorization and removes the account and participation, profiles, messages and histories we can verifiably link to it. Rebounds you host are closed; other participants’ own data is retained, with your details removed from shared server histories. Data not linked to your account may require a request to contact@joinrebound.co: we verify your right to access rather than relying only on a name or photo. Revoked-key digests, without a name, photo or account link, prevent deleted data from being recreated; a technical receipt can acknowledge a retried deletion for 24 hours. We cannot remotely erase copies already saved by other users.
Your choices and rights
Write to contact@joinrebound.co to request access, correction, erasure, restriction and, where applicable, portability or objection. We may request only what is necessary to verify your identity. The Music Club list is independent of your Rebound account: withdraw consent and request removal at musicclub@joinrebound.co. You can also lodge a complaint with the French data protection authority, CNIL (cnil.fr), or your local supervisory authority.
Technical support diagnostics
Help lets you voluntarily send a support request to Rebound’s private Slack support channel. The form includes the description you enter and your reply email, used only to answer your request, along with a limited technical report: app and iOS versions, interface language, and up to 30 recent technical events (operation categories, error codes, response times and random request references). The app does not automatically attach Apple credentials, account identifiers, chat conversations, photos or music choices. Technical events remain in app memory, are not saved to disk by this feature, and events older than 24 hours are excluded. The form explains what is sent before you select Send.
The server also forwards fixed technical error categories and, when available, random request references to this private channel to identify service failures. Cloudflare stores pending reports and grouped alerts in a delivery queue; entries older than seven days are purged by scheduled maintenance. Copies already sent to Slack follow the workspace’s retention settings and Slack’s applicable privacy safeguards, including processing outside the European Economic Area. Contact contact@joinrebound.co with the report reference for a support or deletion request.
Technical connection information
The hosting provider also processes network addresses and sampled request diagnostics: device/browser information, requested routes, response times, errors and approximate location derived from the network address (such as country or city). This supports security and troubleshooting, not advertising. Rebound does not request your precise GPS location.