Privacy Policy

stagebandly (stagebandly.com) is operated by TONEFORM Studio Karol Masternak, ul. Zamknięta 10/1.5, 30-554 Kraków, Poland — NIP 6783226082, REGON 541476057. For any question about this policy or your data, contact toneformstudio.km@gmail.com.

Account data: your name, email address, and profile photo — either from your Google account (if you sign in with Google) or the email address and photo you provide yourself (if you sign up with email and password, which is stored as a salted hash, never in plain text, by our authentication provider).

Content you upload: audio files (WAV or MP3, up to 250MB each) for tracks and their versions, project and track titles, version labels, and comments (including the optional timestamp a comment is pinned to).

Usage data needed to run the service: which projects you have access to, your role on each project, your notification preferences, and read/unread state of notifications.

Technical data: a session cookie that keeps you signed in, and a cookie that remembers your language preference (English/Polish). We do not use advertising or analytics cookies.

To operate your account and let you sign in (contract performance — you cannot use the service without this).

To store and display the mixes, versions, and comments you and your collaborators create, and to let project owners control who can access a project.

To send you notification emails about activity relevant to you (comments, new versions, access requests). Email notifications are opt-in per event type and can be turned off individually at /settings/notifications at any time — access-request emails to project owners/admins are on by default since they need to act on those, everything else defaults to off.

To keep the service secure and working correctly.

We do not sell your data, and we do not share it with advertisers. We use the following processors to run the service:

• Supabase (authentication, database, and file storage; EU region) — stores your account, your projects/tracks/versions/comments, and the audio files themselves in a private storage bucket, protected by database-level access rules so only people you explicitly grant access to a project can read its content.

• Google — provides the "Sign in with Google" option, if you choose to use it.

• Resend — delivers the transactional emails described above (invites, access requests, notifications, password resets). It does not receive your uploaded audio or comments.

• Vercel — hosts and serves the application.

We keep your data for as long as your account exists. You can delete your account yourself at any time from /settings. Deleting your account removes your ability to sign in, but — because collaborators rely on shared project history — your existing comments and uploaded versions remain visible to people who already had access to those projects, attributed to your account as it existed at the time. You can transfer or delete your own projects before deleting your account if you want their content removed entirely.

Under the EU General Data Protection Regulation (GDPR), you have the right to access, correct, or delete your data, to object to or restrict certain processing, and to receive a copy of your data in a portable format. Most of this is self-service in the app (edit your profile, download your files, leave or delete projects, delete your account); for anything else, contact us at toneformstudio.km@gmail.com. You also have the right to lodge a complaint with your local data protection authority — in Poland, the Urząd Ochrony Danych Osobowych (UODO).

Audio files are stored in a private storage bucket, not publicly accessible — access is granted per project through database-level Row Level Security rules, not just hidden links. All traffic to and from the app is encrypted (HTTPS/TLS).

stagebandly is not directed at children and is not intended for use by anyone under 16.

If we make material changes to this policy, we will update the date below and, where appropriate, notify users through the app.