Privacy Policy

Last updated: 30 October 2026

This policy explains what personal data Ceylo collects, why, who helps us handle it, how long we keep it, and what you can do about it. It covers the ceylo.tv website, the Ceylo Music app for Android and iPhone, and Ceylo Studio, where filmmakers and music creators upload their work.

The short version

We collect what we need to run your account, play films and music, count the charts, and keep the service safe.
We do not sell your personal data. We do not show ads based on you. We do not use third-party analytics or advertising tools on the website or in the app, and the app does not track you across other apps or websites.
Music rankings, Samples and radio are worked out the same way for everyone. They are not a personal profile of you.
You can delete your account at any time, in the app or on the website. See Delete your account.

Who we are

Ceylo ("we", "us") runs ceylo.tv and the Ceylo Music app. We decide how your personal data is used, which makes us responsible for it under Sri Lanka's Personal Data Protection Act, No. 9 of 2022, and, for people in the European Union or the United Kingdom, under the GDPR and UK GDPR where those laws apply to us.

Questions about privacy go through our contact form (choose "Account & Profiles").

What we collect

Your account

Your name and email address.
Your password, stored only as a secure one-way hash. We never see or store it in plain text. If you sign in with Google or through our sign-in service instead, we receive your name and email address from it, and no password.
Your profiles: the name, picture and settings of each profile on the account (up to five), and whether a profile is a kids profile.
Your email preferences, and whether you asked to hear about new films and offers.
If you buy something: a billing address where you give one, your purchases, rentals, gifts and subscription status. Card details are handled by our payment processor, Stripe. We keep a Stripe customer reference, never your card number.

What you watch, listen to and play

Films: what you watch, how far you got (so you can resume), your watchlist, ratings and reviews.
Music plays: which song, how long you listened, whether it played to the end or you skipped it and where, and where you started it (a chart, search, radio, a playlist, an artist page, a shared link). We also record the country your connection comes from, and a scrambled form of your IP address that we use only to spot fake plays.
Samples: which 30-second preview you heard, for how long, and how it ended.
Your music library: liked songs, saved releases, artists you follow and playlists you make, plus a history of likes, unlikes, follows and unfollows.
Games: your saved progress.

Music searches

When you search Ceylo Music we store the words you searched, how many results came back, the country, and whether it was the website or the app. We store this without your account, profile or device. It tells us what listeners are looking for that we do not have yet. The app also keeps your recent searches on your phone.

How you found us

If you arrive from a shared link with a tag such as ?ref=share or ?ref=artist:name, we remember that tag for 30 days in a cookie, and record it once on your account if you sign up.
On Android, the Ceylo Music app reads the Google Play install referrer once, to see whether you installed from a creator's invite link. iPhone has no equivalent.
We count shares, preview starts, sign-ups and app installs without names. Each one is tied only to a code that changes every day and cannot be turned back into your IP address.

Your devices and security

When you sign in we record your IP address, your browser or device type, and your approximate location (country and city from your IP address). This lets you see and sign out your devices, and lets us email you when a new device signs in.
A first-party device cookie lets us recognise a browser you have used before, so we only send "new sign-in" alerts for genuinely new devices.
For the app we keep a list of signed-in devices: the device name you gave, the platform (Android or iPhone), the app version, and the last IP address used.
If you allow notifications, we store your phone's push notification token.
The app sends its version and platform with each request so we can keep old versions working or ask you to update.

Emails

We keep a log of the emails we send you (what was sent and whether it was delivered), so we can fix delivery problems and answer support questions.

If you are a creator (Ceylo Studio)

Your application to join Studio, and the people on your team.
Your artist or film pages: names, bios, photos, links to your other accounts, credits.
What you upload: audio files, films, cover art, artwork, lyrics and track details.
How each song was made: your AI-use answer (how much was AI, which tools, whose voice, which plan of the tool), which we show as a credit.
Your promises and choices: when you accepted the creator agreement, your yes or no to Ceylo's social posts and to radio and TV pitching, and, for songs made by people, whether you or a co-writer belong to a collecting society. Each record keeps the date, time, the account that made it and the IP address it came from. These records are never edited — a change adds a new record.
Where your songs went off the site (our posts, radio, TV, venues), any strikes on your account, and our messages to you.
For film partners, the payment details you give us under your partner agreement.

Reports and messages

If you report a track or a film, we keep your name, email address, how you are related to the work, what you told us, and the IP address the report came from.
If you write to us through the contact form or by email, we keep the message and our reply.

People we invite to Ceylo Music

We sometimes invite creators we find on public platforms such as TikTok, YouTube or Facebook. For that we note their public name, handle and profile link, and how the conversation went. If someone declines or never replies, we delete their record 12 months later.

How we use it, and why we are allowed to

To provide the service you asked for (our contract with you): your account, sign-in, playing films and music, your library, purchases, Studio uploads and reviews.
For our legitimate interests, balanced against yours: counting fair charts and play counts, showing creators their statistics, ordering Samples, related songs and radio, finding what listeners search for, measuring which links bring people in, preventing fraud, fake plays and abuse, keeping the service secure, and improving it.
With your consent: push notifications (your phone asks you first), optional emails such as product news, and pitching a creator's songs to radio and TV. You can withdraw consent at any time; it does not affect what happened before.
To meet legal duties: tax and accounting records, and answering lawful requests.

Automated help for creators

When a creator uploads a song, we use AI service providers to help prepare it: writing out the lyrics from the audio, timing the lyric lines, suggesting captions for share cards, and making cover art if the creator asks for it. This uses the creator's uploaded audio, lyrics and track details only — never listeners' data. A person at Ceylo reviews every release before it is published, and no automated tool decides on its own whether a release is accepted.

What is public

Some things are meant to be seen: reviews (under the name you chose), artist and film pages, published songs and films with their credits and AI credit, charts, and "Heard on radio"-style notes on a track page. Your account details, viewing and listening history are never public.

Who we share it with

We do not sell personal data. We share it only with companies that help us run Ceylo (our "processors"), under contracts that let them use it only for us:

Hosting and security providers — running the website and app, delivering content quickly, and protecting the service from attacks.
Cloud storage providers — storing films, music, images and uploads.
Server and database hosting providers — the servers our database runs on.
Email delivery — sending account and service emails.
Sign-in providers — only if you choose to sign in with one, such as Google.
Apple and Google — delivering push notifications to the Ceylo Music app, through their notification services.
Stripe — payments, if you buy something.
AI service providers — preparing creators' uploads, as described above.

We also share data:

with radio stations, TV channels and venues — a creator's songs, name and credits only, and only if the creator switched on radio and TV pitching;
when the law requires it, or to protect people, our users or Ceylo from harm or fraud;
with a buyer, if Ceylo or its business is ever sold, under this policy.

Data stored outside Sri Lanka

Our servers and providers are in other countries, including the European Union and the United States. When your data leaves Sri Lanka, or the EU or UK, we use providers with strong security and contractual protections, as the law requires.

Cookies and storage on your device

We use only cookies we need to run Ceylo. No advertising cookies, no third-party tracking cookies.

Session cookie — keeps you signed in.
Sign-in security cookies — short-lived, used while you sign in, confirm a second factor or come back from Google or our sign-in service.
Playback cookies — let your browser fetch the video you are allowed to watch.
Device cookie — recognises a browser you have used before, for new-sign-in alerts. Kept for up to two years.
Referral cookies — remember which shared or invite link brought you, for up to 30 days.
Preferences in your browser — things like autoplay, captions and volume, kept on your device only.

The app keeps your sign-in in your phone's secure storage, and your settings and recent searches on the phone.

Push notifications

The app asks before sending notifications. We use them for things like a decision on your release, a song entering the charts, the weekly chart reveal and new releases from artists you follow. You can turn them off in your phone's settings at any time. Signing out or deleting your account turns them off for that device.

How long we keep it

Your account: until you delete it. Deletion takes effect after a 60-day grace period; see Delete your account.
Profiles, watch history, watchlist, ratings, music library, Samples and like or follow history, game saves: until you delete the profile or the account.
Music plays: kept, because charts and artists' play counts are built from them. When you delete your account, the link between the plays and you is removed, so they can no longer be tied to you.
Music searches and link counts: kept without anything that identifies you.
Sign-in records: website sign-ins end when they expire or you sign out, and are deleted with your account. App sign-ins are cancelled straight away when you sign out or delete your account.
Email logs: kept for delivery reporting. When your account is deleted, your address is removed from them and any stored copies of emails are deleted.
Security and activity records: kept as a record of what happened. When your account is deleted, your name, email address, IP address and device details are removed from them.
Payment records: kept as long as tax and accounting law requires.
Creator agreement and consent records, and where songs went: kept as the record of what was agreed and where a song was sent, including after a takedown, so we can ask outlets to stop playing it.
Reports and complaints: kept as a record of how we handled them.
People we invited who declined or never replied: deleted after 12 months.

Children

You must be 13 or older to create a Ceylo account. A parent or guardian can add a kids profile to their own account; kids profiles see only suitable films and cannot use Ceylo Music. If we learn that someone under 13 has made an account, we delete it. If you think this has happened, tell us.

Your rights

Under Sri Lanka's Personal Data Protection Act you can ask us to:

tell you what personal data we hold about you and give you a copy;
correct data that is wrong or incomplete;
delete your data, or stop using it, where the law allows;
withdraw any consent you gave;
review a decision made about you only by automated means (we do not make such decisions about members).

If you are in the European Union or the United Kingdom, you also have the rights the GDPR gives you, including to object to processing based on our legitimate interests and to receive your data in a portable form.

To use any of these rights, send a request through our contact form while signed in, or give the email address on your account. We may ask you to confirm it is you. We aim to reply within 30 days. Some data we must keep, for example payment records required by law; if so, we will tell you.

If you are unhappy with how we handled your data, please tell us first. You can also complain to the Data Protection Authority of Sri Lanka, or, in the EU or UK, to your local data protection authority.

Security

Everything travels over encrypted connections (HTTPS). Passwords are hashed. Staff can see only the parts of Ceylo their role needs. Uploaded films and songs are stored privately and can only be played through Ceylo. No system is perfectly secure, but we take reasonable care, and we will tell you and the authorities about a breach where the law requires.

Data we collect in the Ceylo Music app

This section matches the privacy questions on Google Play and the Apple App Store.

Name and email address — for your account. Linked to you.
User ID — your Ceylo account and profile. Linked to you.
App activity — songs played, how long and how they ended, previews heard, likes, follows, saves and playlists. Linked to you. Used for the service, the charts and artists' statistics.
Search history — what you searched in the app. Not linked to you.
Approximate location — the country your connection comes from. Not precise location; the app never asks for GPS.
Device ID — the push notification token, only if you allow notifications. Linked to you.
Audio, photos and other content — only if you upload as a creator: your songs, cover art, artist photos, lyrics and track details. Linked to you.
Takedown reports — the name, email address and description you give us.

The app does not collect your contacts, precise location, camera or microphone (it never records), photos other than the ones you pick to upload, or any advertising identifier. It contains no advertising or analytics tools. All data is sent encrypted. You can delete your data by deleting your account.

Changes to this policy

If we change this policy in a way that matters, we will tell you by email or with a notice on the site or in the app before the change takes effect. The date at the top shows the latest version.

Contact

Privacy questions or requests: our contact form.