Privacy Policy

1. Data we collect

We collect:

• Account data — your name, email address, email-verification status, and, if you set one, a hashed password (we never store passwords in plaintext).
• Authentication data — linked GitHub OAuth identifiers and tokens (if you sign in with GitHub), passkey public-key credentials (if you register a passkey), and session records including a session token, IP address, and browser user-agent.
• Content you create — repositories and their contents, projects, tracks, comments, and related metadata you submit to the Service.
• Consent records — when you accept a legal notice, we record the fact, the document version, the timestamp, and your IP address and user-agent, as proof of consent.
• Usage and technical data — logs, IP address, device and browser information, and activity within the Service, used for security and to operate the platform.

2. How we use data

We use personal data to provide and operate the Service, authenticate you, keep the platform secure and prevent abuse, communicate with you about your account and the Service, and improve and develop features.

3. Legal bases

Where the EU/UK GDPR or the Swiss Federal Act on Data Protection applies, we rely on: performance of our contract with you (to provide the Service); our legitimate interests (to secure, maintain, and improve the Service); your consent (where we ask for it, such as accepting the pre-alpha notice); and compliance with legal obligations.

4. Sharing and processors

We share personal data only with service providers that process it on our behalf and under contract, including: an email delivery provider (Resend) to send account and notification emails; GitHub, when you choose to sign in with GitHub or connect a GitHub account; and our hosting infrastructure. We may also disclose data where required by law or to protect our rights, users, or the Service.

5. International transfers

Some of our providers may process data outside Switzerland or the EEA. Where they do, we rely on appropriate safeguards such as adequacy decisions or standard contractual clauses.

6. Retention

We keep account and content data for as long as your account is active. When you delete your account, we delete or anonymize your personal data within a reasonable period, except where we must retain it to comply with legal obligations or to resolve disputes (for example, consent records kept as proof of consent). During the alpha, data may also be reset or wiped as described in the Pre-Alpha Notice.

7. Security

We protect data with measures including encryption in transit, hashed passwords, and access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your rights

Subject to applicable law, you have the right to access, correct, delete, restrict, or object to the processing of your personal data, and to data portability. Where processing is based on consent, you may withdraw it at any time without affecting prior processing. To exercise these rights, contact [email protected]. You also have the right to lodge a complaint with your data protection authority — in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); in the EU, your local supervisory authority.

9. Cookies and sessions

We use strictly necessary cookies and session tokens to keep you signed in and to secure the Service. We do not use third-party advertising or cross-site tracking cookies.

10. Children

The Service is not directed to children under 16, and we do not knowingly collect their personal data.

11. Changes

We may update this Policy from time to time. If we make material changes, we will take reasonable steps to notify you and update the date above.

12. Contact

Questions or data requests? Contact us at [email protected].