Privacy Policy

What we gather and why

We collect information in a few different ways to provide and improve our Service:

• Account information: When you create an account, we collect your email address and password (which is securely hashed). You may also voluntarily provide additional profile information, such as a bio, handle, and avatar images.
• User-generated content: We collect the content you create and share on our platform, including audio submissions, challenge ideas you submit, comments you post, your list of "Favorite" challenges, and your challenge history.
• Usage and analytics: We use Vercel Analytics to collect anonymous data about your visit. This includes pages you visit, the country you visit from, your device type, and browser type. This data is fully anonymized, does not use cookies, and cannot be used to personally identify you.
• Cookies: We use essential cookies provided by our backend service, Supabase, solely for authentication and session management (i.e., to keep you logged in). We do not use cookies for tracking or advertising.
• Subscription information: If you subscribe to ComposerDeck Pro, we store the plan you chose, its status, its renewal date and the customer and subscription identifiers our payment provider gives us, so we can link your subscription to your account. Everything else stays with Stripe, which sells the plan as merchant of record: your card details and the billing address it needs to work out the applicable tax never reach our servers. We deliberately keep as little of this as possible: we only need to know whether your plan is active. We hold it because we need it to perform the contract with you.

What we do with it

We use the information we collect for the following purposes:

• To provide, operate, and maintain our Service.
• To manage your account, including authentication and profile settings.
• To display your user-generated content to the community, as intended by the features you use.
• To improve our Service by understanding how users interact with it through anonymized analytics.
• To communicate with you, such as responding to support inquiries or notifying you of important updates.

We don't sell your data

We do not sell, trade, or rent your personal information to third parties. We may share information only in the following limited circumstances:

• With your consent: When you publicly post content (like an audio submission or a comment), you are directing us to share that information with the community.
• Service providers: We rely on trusted third-party services to operate our platform. These are listed below.
• Legal requirements: If required by law, we may disclose your information in response to a subpoena, court order, or other governmental request.

Who we work with

We use the following third-party services to run ComposerDeck:

• Supabase: our all-in-one backend provider for database, authentication, and file storage. All of your account data and user-generated content is stored securely with Supabase. View their privacy policy.
• Vercel: our hosting and analytics provider. Vercel hosts our website and provides the privacy-focused analytics mentioned above. View their privacy policy.
• Stripe (Link): our payment provider, used only if you subscribe to ComposerDeck Pro. Stripe is the merchant of record for those purchases, which means it sells the plan, collects the payment and the applicable tax, and issues your receipts and invoices. It collects and holds your payment details and billing address directly; we never see or store your card number. We receive only what we need to run your subscription: the plan you chose, its status, its renewal date and the customer and subscription identifiers. You can view and manage your purchases, and request deletion of your payment data, from your Link account. View their privacy policy.

You're in control

We believe you should have control over your data. As a ComposerDeck user, you have the following rights:

• Access and portability: You can download a copy of your personal data directly from your user profile page at any time. This export covers the data we hold: it does not include your billing details, which are held by Stripe and which you can access from the billing portal.
• Correction: You can update and correct your profile information at any time through your profile settings.
• Deletion ("right to be forgotten"): You can permanently delete your account and all associated data (profile, submissions, comments, favorites, etc.) from your profile settings. This action is irreversible.

How long we keep things

We keep your account data for as long as your account exists, and we delete it when you delete your account. If you have bought a paid plan, the corresponding billing records are kept for 10 years to meet accounting obligations. Those records live with Stripe, which issued them as merchant of record; they are limited to what an invoice contains and are never used for anything else. To have your payment data erased, or to see every invoice we could not show you here, go through your Link account.

How we protect your data

We take data security seriously. Our platform is built on Supabase, which provides enterprise-grade security features, including Row Level Security to ensure you can only access your own data. All traffic is encrypted using SSL/TLS.

Age limits

Our Service is not intended for individuals under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have, we will take steps to delete such information.

Updates and notifications

We may update this Privacy Policy from time to time. We will notify you of any significant changes by posting the new policy on this page and updating the "Last Updated" date. We encourage you to review this policy periodically.

Questions?

If you have any questions about this Privacy Policy, please contact us at hello@composerdeck.com.