Privacy policy

An English translation, for convenience. The binding version is the German Datenschutzerklärung, and where the two differ, that one is what applies.

1. Who is responsible

Christian Heinrich Marek, chris@christian-marek-analytics.de. Postal address in the Impressum.

2. What is stored, and why

Your account

Your chosen name, your email address, a one-way hash of your password (never the password itself), when the account was created, your interface preference, and — only if you switch it on — a secret for two-factor authentication. Purpose: running the account you asked for. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

What you and your band put in

Songs, ratings, difficulty ratings, votes, comments, your private notes, setlists and stage cues, song arrangements — the parts of a song and what each member does in each of them — and any audio recordings you upload. This is visible to the members of the bandspace it belongs to and to nobody else; personal notes are visible only to you. Legal basis: Art. 6(1)(b) GDPR.

A recording of a rehearsal will normally contain the voices and playing of everyone in the room. Whoever uploads it is responsible for having their agreement — see the terms.

Usage events

So that the service can be measured and kept working, we record that something happened: the kind of action, which bandspace, which member, the time, and for page views the path. Never the content — no song titles, no comment text, no note text. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in understanding and improving our own service).

The same log counts, without any account and without anything identifying a visitor, how often the public front page is opened and how often the guided demo is started, finished, or refused because all places were taken. These entries carry no user, no bandspace and no address — they are a tally of how often a page was rendered, which is why they cannot be linked to a person and are not used to try. They tell us whether the front page works at all.

Security

Failed logins and similar attempts are counted in memory, per address, to stop password guessing. Those counters are not written to the database and disappear when the server restarts. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the security of the service).

Chat with the developers

What you write in the “Chat with the developers” window, which kind of message you chose (feedback, bug report, feature request), the page you were on, the time, and our replies. Only the people who run this service read it — never your bandmates, never other users. Purpose: answering you and fixing what you report. Legal basis: Art. 6(1)(b) GDPR — it is the answer you asked for. Kept until you delete your account, which deletes the whole conversation; it is part of your data export.

Server logs

Our hosting produces technical logs (request paths, status codes, timings, error traces) which are kept for 30 days and then removed automatically.

3. Cookies

One cookie: a signed session cookie. It keeps you logged in, remembers which bandspace you are working in, and carries the token that stops another site from submitting a form on your behalf. All three are strictly necessary for a service you asked for, so it needs no consent and there is no consent banner (§ 25 Abs. 2 Nr. 2 TTDSG). There are no analytics, no advertising, no tracking pixels, no third-party scripts and no fonts loaded from anywhere else — every script and stylesheet is served from this site. If that ever changes, this section and the banner situation change with it.

A login lasts at most 30 days before you have to sign in again.

The guided demo uses the same one cookie and nothing else. It holds a random token naming your place in the demo, which mode you are looking at and which step you are on — no account, no name, no address, because the demo has none of those. The token is stored here only until the demo ends or your place runs out, and it is not connected to anything about you. Nothing you do in the demo is recorded in the usage figures below.

4. Who else processes it

• Amazon Web Services EMEA SARL — the application, the database and the uploaded recordings run in the AWS region eu-central-1 (Frankfurt, Germany), with logs in the same region. Processor under a data processing agreement; AWS's parent company is based in the USA, and transfers are covered by the EU standard contractual clauses in that agreement.
• Our front-end hosting provider — a rented virtual server in Germany terminates the encrypted connection from your browser and forwards the request to AWS. It stores nothing beyond short-lived technical logs.
• Our email provider — account email (confirmation, password reset, account notices, and the occasional note about a new feature) is handed to a mailbox hosted in Germany, which delivers it to you. It sees the address it is sending to and the contents of that message, and nothing else about your account. No account email is sent through AWS.
• OpenStreetMap Foundation (Nominatim) — when a bandspace saves a "looking for members" advert, or when you type a place to search near, that place name is sent to OpenStreetMap's geocoder to turn it into a point on the map. What leaves us is the text you typed and our server's address; not your account, not your band, and not your browser's address. The result is stored on the advert, so browsing adverts sends nothing anywhere.

Nothing is sold, and nothing is passed to anyone for advertising. When you add a song, the server may ask a lyrics or tab site whether it has a page for that artist and title; that request carries the artist and title and nothing about you.

Looking for band members

This is the one part of the app where something is visible outside your own bandspace, so it is spelled out. Your band's advert — what you are looking for, the town, how far you will travel, and whatever you wrote — is readable by anybody signed in here. Nothing else about the bandspace becomes visible with it: not your songs, not your ratings, not your recordings, not the other members' names.

When you answer somebody's advert, they see your account name and what you write, and every member of that bandspace can read it and answer — a band answers as a band. They do not see your email address. If a conversation includes a rehearsal recording, only the people in that conversation can play it, and only for as long as its owner keeps it.

A band can also publish its advert. Making a picture to post on social media creates a link that shows that one advert to anybody at all, with no account — the band's name, what they are looking for, the town, the radius and what they wrote. Nothing else about the bandspace becomes public, and this never happens on its own: writing an advert keeps it inside the app, and only making the picture puts it outside. The band can replace or pull the link at any moment, which stops every copy of the picture already posted from leading anywhere.

Take the advert down at any time and it stops being listed, and the public page goes with it. Delete your account and the conversations you started are deleted with it; messages you wrote inside a band's own thread are emptied and stop naming you, because the other half of that conversation belongs to somebody else.

Writing to somebody here — posting an advert, answering one, sending a message — needs a confirmed email address. Reading does not. That is there so that anybody who can put text in front of a stranger has at least one address that has been proved to reach them.

5. How long it is kept

• Account and content: until you delete the account, or your band deletes the material.
• Deleted recordings: 7 days. Deleting a recording hides it immediately and it can be restored during that window; afterwards the file is destroyed. A rehearsal take cannot be recorded again, so the delete button is deliberately not final.
• Chat with the developers: until you delete your account.
• Usage events: 365 days, then deleted automatically.
• Confirmation and reset links: 24 hours and one hour respectively, and deleted once used.
• Server logs: 30 days.
• Backups: the database has continuous backups covering the last 7 days, and the recording storage keeps a previous version of a deleted file for a further 30 days. Something you delete disappears from the service at once (recordings: after the 7-day restore window above) and from the backups within those windows.

6. Your rights

You can exercise most of these yourself, on your account page:

• Access (Art. 15) — the account page lists what is held; the export contains it.
• Portability (Art. 20) — download all of it as JSON, and a whole bandspace can be exported from the bandspace page.
• Rectification (Art. 16) — change your name, address and password there.
• Erasure (Art. 17) — “Delete my account”. What survives, and why, is spelled out before the button.
• Restriction and objection (Art. 18, 21) — write to the address above.
• Withdrawal of consent, where processing rests on consent, with effect for the future.

Right to object (Art. 21). Where we rely on legitimate interests (Art. 6(1)(f)) — the usage events, the security counters, the server logs and the occasional note about a new feature — you may object at any time on grounds relating to your particular situation. An informal message to the address above is enough.

You may also complain to a supervisory authority (Art. 77), in particular in the member state of your residence, your place of work, or where you think the infringement happened. The authority competent for us is Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Str. 22, 7. OG, 20459 Hamburg, Telefon: 040 / 428 54 - 4040, E-Mail: mailbox@datenschutz.hamburg.de.

7. Automated decision-making

None. The ranking of the song list is arithmetic on the ratings your band entered, it produces a running order and nothing else, and it has no legal effect on anyone.

8. Changes

This policy describes what the software actually does. When the software changes — a payment provider, an email provider, an analytics tool — this page is changed in the same release.