Privacy Policy

Who we are

Songboxer is operated by Usonian Studios LLC, an Illinois limited liability company (“Usonian Studios,” “we,” “us”). Usonian Studios is the data controller for the personal data described in this policy. You can reach us about anything in this policy at privacy@songboxer.com.

Data we collect

We collect only what the service needs to work:

• Account data — your name, email address, and password (stored as a hash; we never see the plaintext). Optionally a profile photo and a short bio.
• Content you create — song catalogs, setlists, practice schedules, band and venue profiles, availability, booking events, open calls, applications, and messages you send to other users.
• Location you provide — a city, region, or ZIP code on a band or venue profile, used for local discovery. We derive approximate map coordinates from the ZIP code. We never collect device GPS location.
• Technical data — IP address, browser type, and request logs generated automatically when you use the service, kept for security and debugging.
• Payment data — if you subscribe, payment is processed by Stripe. We store your Stripe customer ID and subscription status; your card number never touches our servers.

How we use it

• To provide the service: showing your catalog to your band, surfacing your public profile to venues, delivering messages, managing bookings.
• To send transactional email: confirmation links, password resets, booking and invite notifications.
• To prevent abuse and keep the service secure.
• To improve the product, using aggregate, non-identifying usage patterns.

We do not sell your personal data, rent it, or share it with advertisers. Where the GDPR applies, our legal bases are performance of a contract (providing the service you signed up for), legitimate interests (security, abuse prevention, product improvement), and consent where we ask for it specifically.

What other users can see

Songboxer is a coordination tool, so some of your content is visible to other users by design: your bandmates see the band’s shared catalog and schedule, and venues you message see your conversation. A band’s public profile is only listed in public discovery if the band has opted in (public listing can be turned off on the band’s manage page), and the public projection never includes member names, contact details, or precise location.

Third-party processors

We use a small set of infrastructure providers to run the service:

• Supabase — database, authentication, and file storage
• Vercel — application hosting
• Cloudflare — DNS and network security
• Resend — transactional email delivery
• Stripe — subscription payments

Each processor handles data only on our instructions. If we add a processor (for example an error-monitoring service), we’ll update this list.

International transfers

Our infrastructure is hosted in the United States. If you use Songboxer from outside the US, your data is transferred to and stored in the US. Where the GDPR or UK DPA applies, our processors rely on standard contractual clauses and equivalent safeguards for these transfers.

Data retention

• Active accounts: we keep your data for as long as your account exists.
• Deleted accounts: personal data is removed within 30 days of a verified deletion request.
• Backups: encrypted backups roll off within 30 days.

Your rights

You can access, correct, export, or delete your personal data. Depending on where you live (including the EU/EEA, UK, and California), these are legal rights — but we honor them for everyone. Profile data can be edited in Settings; for deletion or a full export, email privacy@songboxer.comfrom your account email and we’ll handle it within 30 days. You also have the right to complain to your local data protection authority.

Cookies

We use cookies only to keep you signed in and to remember which band or venue workspace you were last using. We use no advertising or cross-site tracking cookies, and our analytics are cookie-free — which is why you don’t see a cookie banner.

Children

Songboxer is not directed at children. You must be at least 13 to create an account (16 where local law sets a higher floor). If we learn an account belongs to a child below the applicable age, we’ll delete it.

Changes to this policy

If we make material changes, we’ll update the date at the top of this page and notify account holders by email before the changes take effect.

Contact

Privacy questions: privacy@songboxer.com. General support: support@songboxer.com.