Last Updated: August 10, 2026 • Version: 4.0.1
McRock is owned and operated by Differson LLC. This Privacy Policy explains what personal information we collect, why we collect it, who we share it with, and what choices you have.
Please read Section 5.1 before streaming music on McRock. It describes information about your listening that is shown to the creators whose tracks you stream. This is a deliberate design choice that distinguishes McRock from other streaming services.
At or before the point we collect your personal information, this is what we collect and why:
| Category | Examples | Purpose | Disclosed to |
|---|---|---|---|
| Identifiers | Email, display name, account ID | Account creation, authentication | Firebase |
| User content | Chat, prompts, lyrics, tracks | Provide the Service | Firebase |
| Listening activity | Tracks streamed, timestamps, verification status | Stream counting, creator payouts | Track creators (see §5.1) |
| Commercial info | Subscription tier, payout records | Billing, royalty payment | Stripe |
| Device & usage | Device model, OS, IP address, error logs | Security, fraud prevention | Firebase |
We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
Stripe Connect account identifier, verification status, and connection timestamp. We do not store bank account numbers or card details — payment credentials are handled entirely by Stripe.
We do not use your personal information for advertising or profiling unrelated to the Service.
You can withdraw consent, or object to processing based on legitimate interests, by contacting contact@differson.net.
All data is stored on Google Firebase infrastructure in the United States.
No system is perfectly secure. We cannot guarantee absolute security.
McRock shows creators information about who streamed their tracks. This is not standard practice among streaming services and you should understand it before streaming music here.
Why. Creators are paid per verified stream. Without visibility into those streams, a creator has no way to independently confirm that the counts they are paid on are genuine. McRock makes the payout system auditable by the people it pays.
What a creator can see about you, for their own tracks only:
What a creator cannot see:
Your display name is public to creators whose tracks you stream. If your display name identifies you personally, creators will be able to identify you. You can change your display name at any time in Settings.
About the listener ID. The ID shown to a creator is derived separately for each creator: the same listener appears under a different ID in each creator's dashboard, so the IDs alone cannot be used to link your activity across creators. Note, however, that your display name is the same everywhere, so creators who compared dashboards could still identify common listeners by name.
The listener ID is a pseudonym, not anonymisation. Differson can always resolve it back to your account, which is necessary for payout disputes and fraud investigation.
Your choice. This disclosure is inherent to how McRock's transparent payout system works. If you do not want your listening shared with creators in this form, do not stream music on the platform. You can still use McRock to generate music without streaming other creators' tracks.
| Provider | Purpose | What is shared |
|---|---|---|
| Google Firebase | Authentication, database, storage | Account and content data |
| Stripe | Royalty payouts | Stripe account ID, payout amounts |
These providers process data on our behalf and are not permitted to use it for their own purposes.
We do not sell your personal information. We do not share it for cross-context behavioral advertising. We do not provide data to advertisers or data brokers.
We may disclose information in response to valid legal process, to comply with law, to prevent fraud or harm, or to enforce our Terms.
If Differson is involved in a merger, acquisition, or sale of assets, personal information may be transferred. We will provide notice before your information becomes subject to a materially different privacy policy.
Residents of California and of other U.S. states with comprehensive privacy laws have the rights below. We extend these rights to all users regardless of location.
How to exercise: email contact@differson.net with "Privacy Request" in the subject line. We will verify your identity through your account email and respond within 45 days. If we need more time, we will tell you why and may extend by a further 45 days.
Appeals. If we decline your request, you may appeal by replying to our response with "Appeal" in the subject line. We will respond within 45 days. Authorized agents may submit requests on your behalf with written authorization.
We keep personal information only as long as we have a specific reason to.
| Data | Retention | Basis |
|---|---|---|
| Financial and tax records | 7 years | Legal obligation (IRS) |
| Payout and transaction history | 7 years | Legal obligation |
| Account and profile data | Until deletion request, or 3 years after deactivation | Contract; fraud prevention |
| Stream and payout verification logs | 3 years | Dispute resolution; fraud prevention |
| Released tracks | While published; removed on request unless licensed to others | Contract |
| Unreleased generated content | Deleted on request, or 1 year after deactivation | Contract |
| Chat conversations | Deleted on request, or 90 days after deactivation | Contract |
| Cached audio | 24 hours | Technical |
Deletion requests. When you request deletion, we delete your personal information except where retention is required for: (a) completing a transaction you requested; (b) legal obligations, including tax records; (c) detecting and preventing fraud, including payout manipulation; or (d) an ongoing legal dispute. Where an exception applies, we delete everything not covered by it and tell you what was retained and why.
Deactivation is not deletion. Deactivating your account ends your access but does not by itself delete your data. To delete your data, submit a deletion request as described in Section 6.
Note on earlier versions of this policy. Versions before 4.0.1 stated that extended retention was "required under" the CCPA and GDPR. That was incorrect: those laws limit retention rather than require it. The retention periods above have been revised accordingly and reduced where no legal obligation applies.
McRock requires users to be 13 or older. We do not knowingly collect information from children under 13. If we learn that we have, we will delete it promptly. Users aged 13–17 should have permission from a parent or guardian. To report an underage user: contact@differson.net
McRock is operated from the United States and data is stored in the United States. If you use the Service from outside the U.S., your information will be transferred to and processed in the U.S., where privacy laws may differ from those in your country.
For transfers of EU/UK personal data, our infrastructure providers rely on the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses.
Corrected in 4.0.1: earlier versions referenced the EU-US Privacy Shield, which was invalidated in 2020 and replaced by the Data Privacy Framework in 2023.
We monitor for unauthorized access and system vulnerabilities. If a breach affecting your personal information occurs, we will notify you without undue delay and within the timeframes required by applicable state breach-notification laws, and will notify regulators where required. Our notice will describe what information was affected, what we are doing, and what steps you can take.
Corrected in 4.0.1: earlier versions stated user notification within 72 hours "as a GDPR requirement." The 72-hour deadline under GDPR applies to notifying a supervisory authority, not users.
If you suspect unauthorized access to your account, change your password, sign out of all devices, and contact contact@differson.net.
We will post any changes here with an updated version number and date. For changes that materially expand how we use or disclose information we already hold, we will provide advance notice and, where required, obtain your consent before applying the change to previously collected information.
Differson LLC — McRock Music Platform