Privacy Policy

Morus provides account-based music search and playback, favorites, playlists, listening history, queue and autoplay functions, lyrics, optional lyric translation, profile editing, and supported offline downloads.

The launch build does not use Google Sign-In. It also does not initialize or use Firebase for authentication, analytics, crash reporting, remote configuration, or push messaging.

Friends, Listen Together, referrals, artist claims, Spotify import, crowdsourced upload, and premium routes are disabled in the launch build and are not described here as active services.

Morus uses Supabase Auth for email-and-password authentication.

When you register, the App processes:

• a Gmail address
• a password processed by Supabase Auth
• a chosen username or Morus ID (Z ID)
• a display name
• an optional country value
• the date and time at which you accepted the legal terms

Registration requires a 6-digit verification code sent to your email. Morus also supports password-reset email flows through Supabase Auth.

Morus does not store your plain-text password in its application database.

Your Morus profile may contain your Z ID, display name, optional country, profile-image URL, profile visibility state, account status, and other operational profile fields.

If you select a profile image from your device, the selected image is uploaded to Supabase Storage and its public URL is stored with your profile. Morus does not scan unrelated photos in your gallery.

New profiles are currently created as public profiles. A public Z ID, display name, avatar, and playlists marked public may appear in in-app search results.

You may enter a country during registration. If an authenticated profile has no country value, Morus may request a country-level result from ipapi.co using the network request's IP address and store the returned country name in your profile.

Morus does not request Android precise-location permission and does not collect GPS coordinates through this flow. The external country service necessarily receives the IP address used for the request under its own privacy practices.

To provide and synchronize core music features, Morus may store or process:

• favorites
• playlists, playlist visibility, and playlist songs
• recently played tracks
• listening history and play counts
• last playback position
• current and previous song identifiers
• completion, replay, and skip outcomes
• queue, transition, and autoplay decision information
• music-taste selections used for recommendations

This information is used for library synchronization, resume playback, history, search ranking, recommendations, autoplay, and service improvement. It is not sent to advertising networks.

Morus stores recent search queries locally and may synchronize recent queries to Supabase for signed-in users.

The App also records first-party operational search events and interactions, which may include a query, result or song identifier, result type, event type such as impression or click, a session identifier, timestamp, and the authenticated user identifier when available.

Playback and recommendation systems may record listening-history entries, search-result selections, session transitions, autoplay decisions, and taste-profile data. These records support in-app search quality and recommendations. Morus does not include a third-party advertising analytics SDK.

Morus uses Hive, SharedPreferences, and secure storage on the device. Local information may include:

• recent searches and recently selected search results
• recently played tracks
• favorites and playlists
• listening history, including play counts
• cached lyrics
• cached lightweight audio-analysis results
• playback position, theme, audio, wallpaper, and other app preferences
• Supabase session information and access tokens in secure storage
• an installation identifier used only if staged gateway rollout evaluation is enabled

Local records are separated by signed-in user where implemented.

When supported, Morus can download audio to the device for offline playback. Downloaded audio and related paths are stored locally and are not uploaded as personal files to Morus.

If you choose a custom wallpaper or profile image, Morus processes only the file you select. Custom wallpaper files are copied into the App's local documents directory. Selected profile images are uploaded to Supabase Storage as described above.

Downloaded or cached files may remain on the device after sign-out or account deletion until removed through the App where available, device storage controls, or app uninstallation.

The Android launch manifest requests internet access and foreground media-playback service permissions.

While audio is playing, Morus uses an Android foreground media service and displays a media playback notification with playback information or controls. This is not a general marketing or account-notification system.

The launch app does not use Firebase Cloud Messaging and does not send promotional push notifications.

Morus does not integrate a remote crash-reporting or analytics SDK in the launch build. Application errors may be written to local or development console logs, but the client does not upload crash reports to Firebase Crashlytics, Sentry, or a similar crash-reporting service.

Network and hosting providers may generate ordinary server, security, and request logs when their services are accessed. Their handling of those logs is governed by their own practices and applicable contracts.

Morus currently relies on third parties or separately operated services for specific functions:

• Supabase for authentication, database, Realtime profile updates, and profile-image storage
• api.trymorus.in and configured music catalog or streaming providers for catalog metadata, stream resolution, search, and related music functions
• YTMusic-based discovery for search suggestions and autoplay candidate discovery
• a configured primary lyrics provider, LRCLIB, and Lyrics.ovh for lyrics where available
• MyMemory when you request English translation of lyrics; the selected lyric text or an excerpt is sent for translation
• ipapi.co for country-level lookup when a profile has no country value
• Vercel and other infrastructure providers used to host Morus web or API services

Song titles, artist names, identifiers, durations, queries, or lyric text may be sent when needed to fulfill the corresponding request. These providers apply their own terms and privacy practices.

We use information to:

• create, verify, secure, and recover accounts
• maintain profiles and enforce account restrictions
• synchronize favorites, playlists, history, and playback position
• provide search, streaming, lyrics, translation, downloads, queue, and autoplay
• restore recent activity across sessions
• rank search results and generate in-app recommendations
• diagnose failed requests and protect the service
• comply with legal obligations and enforce these Terms

Morus is ad-free. We do not sell personal information or use it for targeted advertising or cross-app advertising tracking.

We disclose information only as needed to operate the services described above, when you make information public, when required by law, to protect users or the service, or in connection with a lawful business transaction.

We seek to limit information sent to a provider to what is reasonably required for the requested function.

Cloud account and application records may be retained while your Morus account is active or while reasonably required to provide the service, resolve disputes, prevent abuse, comply with law, or maintain security.

Local search history is limited by the App to recent entries, recently played tracks are limited to recent entries, and local listening history is capped by the App. Other cloud operational records do not all use the same retention period.

We do not claim that every operational record is automatically deleted after a fixed number of days unless the implementation or applicable law requires it.

The in-app Delete Account flow currently attempts to delete the signed-in user's playlist songs, playlists, favorites, listening history, user preferences, cloud search history, search results, session transitions, Morus profile, and certain legacy social or subscription records. It then signs the user out and clears local application state through the sign-out flow.

The current client-side flow does not itself delete the underlying Supabase Auth identity. It also does not explicitly delete every possible first-party operational analytics table. Records outside the current deletion sequence may require a separate deletion request or may be retained where legally permitted or required.

Downloaded audio or other files may remain on the device until removed through device storage controls or app uninstallation.

For a deletion request covering authentication-provider or other service-side records, contact us using the details below.

Morus uses HTTPS for network requests, Supabase authentication, row-level access controls where configured, input validation, user-scoped local storage, and secure storage for session material on supported mobile platforms.

No method of storage or transmission is completely secure. You are responsible for protecting your email account, password, device, and access to Morus.

Morus is not intended for children under 13. Users under 18 should use the App only with permission from a parent or legal guardian where required.

If you believe a child has provided information contrary to this section, contact us.

The App allows you to edit supported profile fields, clear search history, clear listening history, manage playlists and favorites, sign out, and use the in-app deletion flow.

Depending on applicable law, you may also request access, correction, or deletion of personal information. Some requests may require identity verification.

We may update this Privacy Policy when the App's features, data flows, providers, or legal requirements change. The updated date will be shown on this page.

Material new data practices will not be described as active before the corresponding feature is released.

For privacy questions or requests, contact:

• Email: contact@morus.in
• Website: https://trymorus.in
• Location: Siliguri, West Bengal, India