PRIVACY POLICY

1. What data we collect

We only collect what the service needs to work:

• Account information: your email address and password when you create an account. Passwords are stored encrypted and are never visible to us.
• Content you create: band names, members, setlists, songs, lyrics, tempo (BPM), markings and similar.
• Uploaded audio files: audio files you upload to your songs.
• Invitations: email addresses of people you invite to your band, so we can send them an invitation.
• Live Sync status: when you use the "Conductor" feature, temporary information about which song and line is playing is shared between members who have the same set open.
• Payment status: if you upgrade, we only store the fact that your account is paid. The payment itself is handled by Stripe – we never receive or store card numbers or payment details.

We show no advertising and use no third-party tracking or analytics tools.

2. How we use the data

• To give you access to your account and store your data across devices.
• To let you share setlists and collaborate with band members.
• To send necessary emails, such as invitations and login-related messages.
• To process your upgrade and keep track of paid status.
• To operate, secure and improve the service.

3. Third parties we use (data processors)

We use a few established services to run the app. These process data on our behalf:

• Supabase – database, authentication and file storage.
• Stripe – processing payment when you upgrade.
• Resend – sending emails (invitations, etc.).
• Netlify – hosting of the website and app.
• Google Play – if you installed the app from there, Google's own terms also apply.

Some of these providers may process data outside Norway/the EEA. In such cases, the transfer is carried out in accordance with applicable data protection rules.

4. Storage and security

Your data is stored for as long as you have an active account. We take reasonable technical measures to protect your information, but no service can guarantee 100% security. You are responsible for keeping your password confidential.

5. Your rights

Under data protection law (GDPR) you have the right to:

• request access to the information we hold about you,
• have inaccurate information corrected,
• have your account and associated data deleted,
• receive a copy of your data (data portability),
• withdraw consent at any time.

To delete your account or exercise any of these rights, send an email to shtooopstore@gmail.com and we will help you.

6. Children

The service is not directed at children under 13, and we do not knowingly collect information from children under that age.

7. Changes to this policy

We may update this policy when needed. The date at the top shows when it was last changed. Significant changes will be made available in the app or on the website.

8. Contact

If you have questions about privacy or your data, contact us at shtooopstore@gmail.com.