Last updated: October 9, 2026
Service: Umiki (Windows and Windows Phone apps, the website at www.umiki.net and the API at
api.umiki.net)
Umiki ("we", "us", "our") is a music listening service of One Live, established in the European Union. For the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and equivalent laws, One Live is the controller of the personal data described in this policy.
This policy covers the Umiki apps, the Umiki website at www.umiki.net and the Umiki API at
api.umiki.net that they use (together, "the Service").
Data protection contact: [email protected]. General support: [email protected]. We have not appointed a data protection officer because we are not required to; the privacy address above reaches the people responsible for data protection.
You sign in to Umiki with your One Live ID. One Live ID handles your password, sign-in methods and account security under its own Privacy Policy. When you sign in, Umiki receives your account identifier, your username and any One Live staff role. Umiki never receives your password.
Your Umiki profile is your One Live Network profile: your display name, picture, biography, friends and profile visibility come from One Live Network and are governed by the One Live Network Privacy Policy. Umiki keeps only what is about music, described below.
We do not collect your real name, date of birth, gender, phone number, postal address, payment details, precise location, contacts or biometric data. We do not knowingly process special categories of personal data (such as health, religion or political opinions), although your music taste may say something about you, so we do not use it to make guesses about such things. We do not run analytics, advertising or social-media tracking in the Service.
| Purpose | Data used | Lawful basis (GDPR Article 6) |
|---|---|---|
| Signing you in and providing the Service: searching, playing music, keeping your library and playlists, importing playlists | One Live ID details, library and playlists, import data | Performance of a contract (Art. 6(1)(b)) |
| Keeping your listening history, and showing you your recent plays and statistics | Listening history | Performance of a contract (Art. 6(1)(b)) |
| Personal recommendations (section 5) | Listening history, likes and dislikes, library, playlists, and imported Last.fm history if you allow it | Performance of a contract (Art. 6(1)(b)): personal recommendations are a core part of Umiki |
| Showing your activity on your profile and in feeds, and sharing "Listening to" with One Live Network | Social activity, sharing settings | Performance of a contract (Art. 6(1)(b)), following the settings you choose |
| Scrobbling, "now playing", syncing loves and importing your history with Last.fm | Last.fm data, listening history | Performance of a contract (Art. 6(1)(b)), at your request when you link Last.fm |
| Protecting the Service: limiting automated or excessive requests, restricting devices or accounts that break our Terms | IP address, device identifier, account identifier, logs | Legitimate interests (Art. 6(1)(f)) in a safe and available service |
| Finding and fixing errors, and answering support requests about them | Server logs | Legitimate interests (Art. 6(1)(f)) in a working service |
| Answering your support and privacy requests | Communications, any relevant data | Performance of a contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) for data protection requests |
| Complying with the law, responding to lawful requests, and establishing, exercising or defending legal claims | Any relevant data | Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) |
Where we rely on legitimate interests, we have weighed those interests against your rights and freedoms and limited the data to what the purpose needs. You may object to that processing (section 11).
A One Live ID is necessary to use Umiki. Linking Last.fm, importing playlists and sharing your activity are optional.
Umiki suggests music based on what you play, finish, skip, like, dislike and save, and, if you allow it, your Last.fm history. It compares this with the listening patterns of Umiki listeners as a whole and with information about the music itself (such as artists, genres and similar artists from Last.fm). This is a form of profiling, used only to choose music to show you.
Recommendations do not have legal or similarly significant effects on you, and they are not used for advertising, shared with other companies or used to decide anything else about you. Patterns learned from all listeners together are stored in a form that does not identify you. To influence your recommendations, like or dislike tracks and artists, or turn off "use for recommendations" for Last.fm. To have your listening history removed altogether, ask us (section 11).
Umiki does not have its own music catalogue. To find songs, albums, artists, artwork, lyrics and charts, and to find a playable version of a track, our servers send search terms and track details (such as titles, artist names, ISRC codes and service identifiers) to other music services. These requests come from our servers and do not include your account details. The services we use for information are:
To play a track, we look for a playable version of it with third-party audio services, including services that give access to the catalogues of TIDAL, Qobuz, Amazon Music, JioSaavn, Deezer and YouTube, and a file server used by Umiki. Some of these requests include your IP address, so that the service can return a version that is available where you are. When we find one, your app usually downloads the audio directly from that service, which then receives your IP address and app details like any website you visit. These services act independently and their own policies apply.
When you link Last.fm, Umiki sends Last.fm, under your account: the tracks you play (when "scrobbling" is on), the track you are playing (when "now playing" is on), and tracks you like or unlike (when "sync loves" is on). It also reads your Last.fm profile and history. Last.fm is an independent controller, and its privacy policy governs what it does with your data. You can unlink Last.fm at any time in Umiki's settings, or remove Umiki's access on Last.fm. When you unlink, your session key and unsent scrobbles are deleted, and you can choose to delete the history imported from Last.fm too.
We use the following providers to run the Service. They process personal data only on our instructions:
www.umiki.net and the requests it
passes to the API run on Cloudflare's network, which therefore receives your IP address and browser
details.Authorized One Live staff can access Umiki data, including logs, only as far as needed to run the Service, answer support requests and enforce our Terms.
We may disclose data where the law requires it, to respond to a valid legal request, to protect the rights, property or safety of our users, the public or One Live, or to a successor in a merger, acquisition or transfer of the Service (you will be told before your data becomes subject to a different policy).
We do not sell your personal data, and we do not share it for advertising.
If an account or a device breaks our Terms of Use, we may restrict it. Device restrictions are recorded against the device identifier with the reason and the date. Decisions to restrict an account or a device are made by people. Automatic limits on the number of requests are temporary and lift on their own after a short time.
Our servers and database are located in the European Union. Some recipients in section 6 may process data outside the European Economic Area ("EEA"): Cloudflare operates globally and its parent company is in the United States, Last.fm is in the United Kingdom, and some of the music services in section 6.3 are located in other countries, including the United States and India.
Where we send personal data outside the EEA to a recipient acting for us, we rely on an adequacy decision of the European Commission (such as the one for the United Kingdom) or on the European Commission's Standard Contractual Clauses. Sending data to Last.fm, and to a music service from which your app plays a track, happens at your request to provide what you asked for.
No system is completely secure and we cannot guarantee absolute security.
If something goes wrong: if a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours of becoming aware of it, and we will tell you directly where the risk is high, as the GDPR requires.
| Data | How long |
|---|---|
| Library, playlists, likes and dislikes, listening history, statistics and social activity | While you use Umiki, until you remove them or ask us to delete them. Items you remove from your library or playlists, and activity you delete, are deleted straight away. |
| Recommendations | Rebuilt regularly; each version replaces the previous one. |
| Last.fm link, settings and session key | Until you unlink Last.fm. Unsent scrobbles are deleted when you unlink, and scrobbles that could not be sent are given up after 14 days. |
| History imported from Last.fm | Until you unlink Last.fm and choose to delete it, or ask us to delete it. |
| "Listening to" status | Up to three minutes after your app last checks in, or until you stop playing or turn sharing off. |
| Device restrictions | Until the restriction is lifted. |
| Rate-limiting counters | In memory only, for up to 15 minutes. |
| Server logs | Up to 30 days. |
| Support and privacy correspondence | For as long as needed to resolve the matter, and up to 24 months afterwards, so that we can show how a request was handled. |
When you ask us to delete your Umiki data, we delete your library, playlists, likes and dislikes, listening history, statistics, recommendations, social activity, sharing settings and Last.fm link from our live database within 30 days. Copies in backups, if any, are overwritten on a rolling basis within 90 days, and logs expire as shown above. We keep data for longer only where the law requires it or where it is needed to establish, exercise or defend legal claims. Deleting your Umiki data does not delete your One Live ID or your One Live Network profile; see their own policies.
Under the GDPR you have the right to:
To exercise these rights, write to [email protected], ideally with the subject "Umiki Privacy Rights Request". We will respond within one month, as the GDPR requires (extendable by two further months for complex or numerous requests, in which case we will tell you why within the first month). To protect your data, we may need to verify that the request comes from you, normally by asking you to write from the email address on your One Live ID. Exercising your rights is free of charge unless a request is manifestly unfounded or excessive.
The Umiki apps do not use cookies. They store your sign-in and settings on your device so you stay signed in.
The Umiki website uses only storage that is strictly necessary for the Service or for a function you asked
for, such as keeping you signed in, so it does not require consent under the ePrivacy rules. We do not use
advertising, analytics or third-party tracking cookies. Cloudflare may set a strictly necessary security
cookie (such as __cf_bm) to tell people apart from automated traffic. Signing in takes place
on One Live ID, whose cookies are described in its own policy.
If you live in the United Kingdom, the UK GDPR and the Data Protection Act 2018 apply, and you may complain to the Information Commissioner's Office (ico.org.uk). If you live in Switzerland, the Federal Act on Data Protection applies, and you may complain to the Federal Data Protection and Information Commissioner. The rights in section 11 apply to you in the same way.
If you live in a US state with a consumer privacy law (such as California, Colorado, Connecticut, Virginia or Utah):
If you live elsewhere, for example in Brazil (LGPD), Canada (PIPEDA) or another country with data protection law, you have the rights that law grants you. Contact us as described in section 11 and we will honour them where they apply.
You must be at least 13 years old to use Umiki. If the law of your country sets a higher age for using services like ours without a parent's or guardian's permission (for example 16 in some EU member states), you need that permission. We do not ask for your age and do not knowingly process the data of children under 13. If you believe a child under 13 is using Umiki, contact [email protected] and we will delete their Umiki data.
We may update this policy, for example when the Service changes. We will post the updated version here, change the "Last updated" date and keep earlier versions on the past policies page. Where changes are material, we will tell you in the Service or on our social media before they take effect.
Questions about this policy or your data: [email protected]. General support: [email protected].