Privacy policy

1. Information we process

Account and profile: your sign-in email, account identifier, display name, language and preferences. Supabase Auth processes email verification codes and sessions. We do not ask for your email account password.

Collaboration: bands you create or join; invitation email addresses; gig and rehearsal dates, times, time zones and manually entered locations; participation, attendance responses and your performance roles.

Your content: songs and arrangements you enter, lyrics, performance cues, PDFs and images you upload, private notes and material preferences, and information you send with support, report or deletion requests. Upload and share only content you are entitled to use.

Essential operational data: request times and identifiers, feature paths, response statuses, errors and network addresses used to protect the service. Service logs should not contain verification codes, access tokens, raw invitation tokens, signed download URLs, score contents or private-note text.

On-device data: downloaded gig packages, reading positions, page numbers and song-navigation progress remain on your device. Turning pages and changing songs do not broadcast to other members. File selection and optional notifications use operating-system controls. Manually entering an event location does not require continuous device-location access.

2. How and why we use information

We use necessary information to authenticate you, provide collaboration, enforce access, store and retrieve selected content, support offline performance, handle requests and prevent abuse. Reminders are scheduled on your device; receiving current schedule changes requires synchronization.

Where applicable law requires a legal basis, we generally rely on providing the service, legitimate security and operational interests, legal obligations and consent where required. You can turn optional permissions off in device settings.

We do not sell personal information or use your scores or private notes for advertising profiles. This website uses no advertising trackers, third-party analytics scripts or marketing cookies.

3. Bands, events and private content

Band materials are available to active members of that band. Event materials are available to active participants of that event, subject to restrictions on drafts. Joining an event does not join a band, and associating a band does not expose its whole library.

Sharing from a band to an event is an explicit copy action. Selected material becomes an independent event copy available to that event's participants, including people from other bands. Private notes, unselected songs and version history are excluded. Check the audience before confirming.

Private notes are isolated to their author. Band maintainers and event organizers cannot read other people's private notes. Participants can see the display names, roles and attendance information needed to collaborate. Avoid placing unnecessary sensitive information in shared content.

Confirmed online revocation triggers cleanup of the relevant cache. A fully offline device cannot instantly revoke previously downloaded content. Copies that others independently saved or shared may not be immediately retractable.

4. Service providers and international processing

We use Supabase for authentication and PostgreSQL, Cloudflare R2 for private attachment storage, and configured hosting for the application server and website. Sign-in emails triggered by Supabase are delivered through Feishu Mail SMTP, which processes recipient addresses, message contents and delivery information. These providers process information needed to deliver their services.

Attachments are private. The server checks permission before issuing a short-lived access link; do not forward these links. The website and API use HTTPS, and clients do not receive server storage credentials.

Information may be processed in selected service regions and countries where providers operate. We take measures required by applicable law. Contact wonpheys@gmail.com for current data-region and provider details. Necessary disclosures may also occur to comply with valid legal requirements, protect users or address security incidents.

Provider policies: Supabase · Cloudflare.

5. Retention and account deletion

Account information is generally retained while the account is active. Shared content remains while its band or event needs it, until archived or deleted. Expired invitations cannot be used. Idempotency records are normally retained for 30 days. Necessary security and operational records follow the operating schedule; routine service access logs target no more than 30 days.

Request deletion through the app account flow when available, or email wonpheys@gmail.com from your sign-in address with the subject “GigCue account deletion”. Never send a password or verification code. After verifying identity, we generally process requests within 30 days and explain any exceptional delay.

Deletion covers account identity, private notes, preferences and related authorizations. Band maintenance responsibilities, unfinished events and files charged to you are handled as part of the process. You may transfer them first or cancel events you organize as prompted; another person's indefinite cooperation is not required. Untransferred associated files may be removed and shown as missing to collaborators. Independent copies made by others are not automatically removed solely because the source account is deleted.

Limited records may be retained for legal obligations, disputes, security or abuse prevention, with restricted use. Residual data in enabled backups expires through backup rotation and is not used as active application data. See account and data deletion for the request pathway.

6. Choices and rights

You can update your profile, leave bands or events, manage local downloads and reminders, and request access, correction, export or deletion. Depending on applicable law, you may also have rights to restrict or object to processing, withdraw consent or complain to a regulator. Send requests to wonpheys@gmail.com; we verify identity and respond within applicable time limits.

Without necessary account data, collaboration may be unavailable. Declining optional notifications does not prevent other features. The service is not directed to children under 13 or the applicable local minimum age. Contact us about inappropriate collection so we can address it.

7. Purchases, security and changes

If in-app purchases are introduced, Apple or Google processes payment details. GigCue processes transaction identifiers, verification results and entitlements, not full card details. Purchase availability depends on the app version actually offered.

We use access controls, private storage, encrypted transport and necessary logs, but no system can guarantee absolute security. We update this date and provide notices where needed for material changes. Privacy and support contact: wonpheys@gmail.com.