Privacy and browser storage

GigAlong is operated by Daniel Seixas, trading as Hyperthings, established in Spain. Contact the controller about privacy or to exercise your rights at dpo@hyperthings.es.

Information we use

We store account details such as your name, email, instrument and authentication information and the date of recent activity, along with ensemble memberships, charts, setlists, notes and activity. Content you enter may contain personal information. Ensemble members can see content shared with their ensemble. Account credentials and personal notes are not shared with other members.

When you use connected features, information may be sent to the relevant provider, such as Google or Facebook for sign-in, Spotify for playback, MusicBrainz and Cover Art Archive for recording information and artwork, or Ultimate Guitar for chart searches. Their own privacy policies apply to their processing. Email delivery and hosting providers may also process information on our behalf.

Why information is used

Account and ensemble information is used to provide the songbook, synchronize your content, authenticate you, manage shared access and respond to service requests. Security and activity information helps protect accounts and investigate misuse. The bases are performance of the service agreement for providing requested features, legitimate interests in protecting and operating the service where applicable, and compliance with legal obligations where relevant.

The service is not intended for children under 16. No payments, advertising, analytics or marketing emails are planned at launch. If those plans change, we will update this information and provide any choices required before enabling them.

Storage and recipients

Production is planned to be hosted in-house in Madrid, Spain; Hyperthings does not plan to transfer its hosted data internationally. Account email is planned to be sent from ensemble@hyperthings.es; the email delivery provider has not yet been identified. Optional third-party services operate independently and may process information internationally. Their processing locations and any applicable transfer safeguards should be checked for each service.

We intend to review accounts after 24 months of inactivity, with advance notice before deletion; the app records recent activity but notices and deletion are not yet automated. Deleted charts and setlists remain in the trash until permanently deleted by an authorized user. The intended backup retention is 30 days, but backup expiry and restoration procedures must still be put in place. Legal obligations and legitimate requests may affect retention.

Cookies and storage on your device

The app uses an HttpOnly session cookie and stores a separate CSRF value and revocation-only capability on the device. If you sign out offline, the revocation capability is retained until the app reconnects and sends it. Existing sessions created before the upgrade may temporarily use local storage until they reconnect. Local storage also holds the offline library, including your profile, charts, notes, setlists and ensemble information, as well as display and performance preferences. Session storage holds the current view and, when you connect Spotify, the information needed to complete the connection and its session tokens. The service worker caches app files for offline use. These can remain until you clear site data, sign out where applicable, end the session, or the browser removes them. Clearing site data can sign you out and remove offline data and preferences.

When you choose Google or Facebook sign-in, the app sets an oauth_google or oauth_facebook cookie to protect the sign-in request. It expires after ten minutes or is removed when the sign-in returns. Those providers may use their own cookies on their sites. If you choose Spotify, Spotify may use its own cookies on its site.

The app also stores a record on this device when you dismiss the browser-storage notice. This is an acknowledgement, not a choice to enable advertising or analytics. If optional tracking is introduced, the notice and controls must be updated before it is enabled.

Your choices and requests

You can update your name and instrument in your profile and download an account-data export there. For access, correction, erasure, restriction, objection or portability requests, contact dpo@hyperthings.es. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD) or another competent data protection authority. The availability of particular rights depends on the circumstances.

Account deletion is not yet available as a self-service feature. You can request it using the contact above. Data in backups, on other members’ devices or held by third parties requires separate handling.

Further information

The controller is still finalising the email provider, processing and legal-basis assessment, international transfer safeguards, and operational retention and deletion procedures. This page does not yet provide all information required for a complete privacy notice.