Privacy

MULO is run by Alex Bacskos from New South Wales, Australia. Anything on this page, or anything you’d like done with your information, reaches a person at hello@getmulo.com.

• Your account: the email address you signed up with, and a password you never give us in readable form — it’s hashed by Supabase, who handle logins, and we never see it.
• If you continue with Apple or Google: what they share when you agree — your email address, your name, and from Google a profile picture. Apple can give a private relay address instead of your own, which forwards to you; MULO only ever sees the relay. For Apple, MULO also keeps the token Apple issues, encrypted, so deleting your account can end MULO’s link to your Apple Account too.
• Your profile: username, display name, picture and bio, if you add them. In the app, a picture comes from your photo library only when you choose one, and only that picture leaves your phone.
• What you put in: scores, reviews, replies, lists, your GOAT, Versus picks and takes, who you follow, who you’ve blocked, and anything you report.
• Your listening diary, if you keep one: what you’ve listened to, and on which day. More on it below.
• If you turn on notifications in the app: the address Expo gives your phone so a notification can reach it, whether it’s an iPhone or Android, which notifications you’ve switched off, and a log of what was sent for a month, so nothing arrives twice.
• Your time zone and when you were last here, so streaks and reminders run on your own clock and stop if you’ve been away a while. Nobody else can see either.
• A little technical housekeeping: your network address for a short while, so nobody can hammer the site with thousands of requests, and ordinary server logs.
• On the website, a cookie that keeps you logged in, and a few small notes stored in your own browser — recent searches, which tips you’ve seen. Those never leave your device and aren’t used to follow you anywhere.
• In the app, the same kind of thing on your phone: what keeps you logged in, held in the phone’s secure keychain, and small notes — records you’ve looked at, recent searches, tips you’ve seen, your best Guess the score, the badges already celebrated, and when you last looked at your notifications. They stay on the phone, and deleting your account clears them.

No advertising. No selling or renting your information to anybody. No third-party trackers following you around other websites. If MULO ever measures how the site is used, it’s counting visits in aggregate, not building a profile of you.

Your scores, reviews, replies, lists and who you follow are visible to other people on MULO — that’s the point of it. Some of it can be seen by anybody, including people without an account and search engines:

• Written reviews, with their score and your name, on album and artist pages.
• Your takes on the Daily Versus, once that day’s matchup is over.
• Your profile: your name, picture, bio, what you were raised on, your GOAT, your badges, your streak, the kinds of music you score highest, how many records you’ve rated, your average score, and how many people you follow and how many follow you.
• Your listening diary, unless you make it private: the albums you listened to and when, on your profile and its own page.
• The pages your profile shares: your mixtape for each month, your ranking of an artist’s albums, how you rate against everybody else, and your milestones. Each shows some of what you’ve rated, with your scores.

The rest needs an account: everything you’ve rated in one place, your Top Shelf, your lists, who you follow and who follows you by name, the newest ratings from everybody, and replies.

Replies are only for people who are signed in: unlike reviews, nobody without an account can read them. You can delete your own replies, and the writer of a review or take can delete any reply on it.

Your email address is never shown to anybody, signed in or not. If you’d rather somebody couldn’t see you at all, blocking them hides each of you from the other.

The diary keeps each album you listened to on a day: how many of its songs you played, roughly how long for, and where it came from. It fills from what you choose:

• What you log yourself, from an album’s page.
• Last.fm, once you connect it on Last.fm’s own page. MULO reads your plays there (when each was, and its song, album and artist) every hour until you disconnect. It keeps your Last.fm name and the time zone you connected in, so each play lands on your own day, and never a key to your account.
• Spotify’s extended streaming history, the file Spotify sends when you ask for it. It’s read on your own device, in your browser or the app, and only the albums are sent to MULO, never the file.
• Apple Music, in the iPhone app: your library’s play counts and when each album was last played, read on your phone.

To find which album a name means, MULO asks ListenBrainz and MusicBrainz about the album and artist names (and one song’s), with nothing that says who you are.

Your diary is public on your profile, like your ratings, unless you switch off Show my diary in your account settings. Somebody you’ve blocked, or who has blocked you, never sees it. You can delete anything in it, remove everything one source added, or disconnect Last.fm. The diary comes with your download, and goes when you delete your account.

MULO is a small site built on a few services, and your information passes through them:

• Supabase stores the database, handles logins and keeps uploaded pictures.
• Vercel runs the site itself.
• Resend sends the few emails MULO sends: confirming your address, and resetting a password.
• Apple and Google, only if you continue with them: they confirm it’s you, and know you signed in to MULO.
• Last.fm, only if you connect it: it knows you’ve let MULO read your plays, until you disconnect.
• Expo delivers fixes to the app. Your phone asks it for them, so it sees the phone’s network address and the app’s version, never your account.
• Expo, then Apple or Google carry notifications, if you turn them on: they get your phone’s notification address and the words of each one (a name, a record’s title), to show it on your phone.

Those companies store data on servers that may be outside Australia. Album and artist information comes from MusicBrainz and Wikipedia, and song previews from Apple — they’re asked about records, never about you. In the app, a preview is fetched from Apple by your phone itself, so Apple sees your phone’s network address and the song, but not who you are on MULO.

Two buttons, both on your account page (in the app, under You and then the settings button), both doing exactly what they say:

• Download my data hands you a file with everything you’ve put in — every score, review, reply, list and follow, and your listening diary — and your notification settings.
• Deleting your account removes your profile and everything attached to it. It isn’t hidden or deactivated; it’s gone, and it can’t be undone. If you joined with Apple, it also asks Apple to end MULO’s link to your Apple Account, and says so if you need to remove it yourself. One thing stays: if somebody reported a reply of yours, their report keeps a copy of its words, without your name, so it can still be dealt with.

Both live at your account settings. Copies can linger in backups for a short while before they roll over, and emails already sent can’t be unsent. Anything else — a correction, a question, a complaint — email hello@getmulo.com and you’ll get a person.

For as long as you have an account. Delete it and the lot goes with it, apart from the words of a reported reply, which stay with the report. Technical logs are kept briefly and then discarded.

You need to be at least 13 to have an account. If you believe somebody younger has one, email hello@getmulo.com and it will be removed.

MULO is built carefully — logins are enforced on the server, everything you send is checked, and the database is locked down so one account can’t read another’s private details. No site can promise perfection. If information is ever exposed in a way that could harm you, you’ll be told, and so will the regulator where the law requires it.

If this page changes in a way that matters, the date at the top changes and you’ll be told in the app. MULO follows Australian privacy law, and if you’re in the UK or Europe, the rights you have there — to see, correct, export or erase what’s held about you — are rights this page already gives everybody.