Privacy policy

Who is responsible

The data controller is Daniele Brambilla, who runs Downbeat as an individual from Italy. Write to admin.downbeat@gmail.com for anything about your data.

What Downbeat collects

• Account: your email address, the name you sign up with and a password, which is stored only as a hash. If you sign in with Google, Google shares your name, email address and profile photo with us.
• Musician profile: a photo, instrument, city and a short bio, all optional. If you sign in with Google, Downbeat copies your Google photo as your profile photo until you upload another one or choose your initials. Photos are stored with Supabase at an address that cannot be guessed.
• Band content: band name and logo, members and their roles, invite links, song proposals with their listen links and notes, votes, the repertoire with key, BPM, duration and charts (text or PDF), setlists, and gigs with date, place, notes and who is coming.
• Notifications: messages inside the app and, if you turn them on, a push subscription for this browser.
• Tips: if you leave a tip, Stripe handles the payment. Downbeat receives the amount and whether it went through, never your card details.
• Technical data: our hosting providers keep short-lived server logs (IP address, browser, time and page requested) to run the service and keep it secure.
• Visit statistics: Vercel Web Analytics counts which pages are opened, with the referring site, country, browser, operating system and device type. It sets no cookies and stores nothing on your device. Visits are told apart by a code worked out from the request that changes every day, so they cannot be linked to you or across days. The address it receives is only the page: no query string, and invite links without their token.

Downbeat has no ads and does not follow you across other sites. It does not sell or rent your data.

Why, and on what legal basis

• To provide the app you signed up for: your account, your bands and everything in them (performance of a contract, Art. 6(1)(b) GDPR).
• To keep the service secure, prevent abuse and approve new accounts (legitimate interest, Art. 6(1)(f)).
• To understand which pages are used and improve the app, with anonymous visit statistics (legitimate interest, Art. 6(1)(f)).
• To send push notifications, only after you allow them in your browser (consent, Art. 6(1)(a)). You can switch them off at any time in your browser's site settings.
• To process tips and keep the records the law requires (contract and legal obligation, Art. 6(1)(b) and (c)).

Who sees your data

The members of a band see what is shared in that band: your name, photo and profile, your proposals, votes, charts, setlists and gig answers. People who open the band's invite link see the band name, its city and who created the link. The people who run Downbeat can see account data to approve accounts and to help when you ask.

These providers process data on our behalf:

• Supabase: database, sign-in and file storage, on servers in Frankfurt, Germany (EU).
• Vercel: hosting of the website and the app, and the anonymous visit statistics.
• Stripe: payments, only if you leave a tip.
• Google: sign-in with Google, if you choose it, and the map on a gig page that has an address.
• Your browser's push service (Google, Apple or Mozilla), if you turn on push notifications.
• Anthropic (Claude), only if you connect Claude to Downbeat. When you ask Claude about your band it receives what you ask it to read, including what other members wrote (proposals, notes, charts, gig answers), under Anthropic's own privacy policy. You can disconnect Claude in Settings at any time.

When you open a listen link inside the app, the player is loaded from that service (for example YouTube, Spotify or Amazon Music), which receives your IP address under its own privacy policy. When you add a YouTube link, Downbeat asks YouTube for the title and artist.

Transfers outside the EU

Some providers (Vercel, Stripe, Google, Anthropic) may process data in the United States. Those transfers rely on the EU–US Data Privacy Framework or on the European Commission's standard contractual clauses.

How long data is kept

• Account, profile and band content: while your account exists. When you ask for deletion, the account and the data linked to it are deleted within 30 days.
• Server logs: for the short period set by the hosting providers, usually a few weeks.
• Tip records: for as long as tax and accounting rules require.

Your rights

You can ask to access your data, correct it, delete it, receive a copy in a portable format, restrict or object to its processing, and withdraw consent you gave. You can edit your profile in the app at any time. For everything else, including deleting your account, write to admin.downbeat@gmail.com. You will get an answer within one month.

If you think your data is handled unlawfully, you can complain to the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or to the authority where you live.

Cookies and storage on your device

Downbeat uses only what it needs to work: a session cookie to keep you signed in and a cookie that remembers your language. The browser also keeps a copy of your band's data, the pages you have opened, and the setlists and charts you have opened, so the app works offline. Signing out deletes them. None of this is used for tracking, so there is no cookie banner.

Embedded players and maps from other services may set their own cookies when you open them.

Age

You must be at least 14 to create an account, the age of digital consent in Italy.

Changes

If this policy changes in a way that matters, Downbeat will tell you in the app before the change applies. The date at the top shows the latest version.