Privacy policy

Last updated 1 November 2026, and in effect from that date

This explains what Collabspot holds about you, why we hold it, who helps us run the service, and what you can ask us to do about it. It is written to meet the UK General Data Protection Regulation and the Data Protection Act 2018.

1. Who we are

Collabspot is run by Andrew Taylor, a sole trader based in the United Kingdom, trading as Collabspot. For everything in this policy, Andrew Taylor is the data controller.

Write to privacy@collabspot.app about anything here. For help with the app, use support@collabspot.app.

2. What we hold, and why

Your account. Your email address and password, or your Google sign-in. If you use Google, Google shares your name, email address and profile photo with our sign-in provider; your Collabspot profile only shows what you enter yourself. We use your email address to let you in and to send you mail about your account, and it is never shown to other people. We also record that you confirmed you are 18 or over, and when you agreed to our terms and this policy and which versions of them. Lawful basis: performing our contract with you.
Your profile. Your artist name, and anything you choose to add: a photo, a bio, a location, your roles and genres, and up to three links to your music. Other signed-in people can see it, and anyone can see it if you turn on your public profile. Lawful basis: contract.
Your legal name, if you add it. It is there for distributor and collecting society forms, which ask for a writer's legal name rather than an artist name. Only people you share a verified credit with can see it, so a collaborator copying your shared credits names you properly. Nobody else can, signed in or not, and it is never shown on your public profile. Leave it empty if you do not need it. Lawful basis: contract.
What you make and share. Projects, audio files, notes and replies, credits, wanted ads and applications. They are shared with the people you work with or send a link to. Lawful basis: contract.
Discord, if you link it. If you choose to link your Discord account in Settings, Discord tells us your Discord user ID and display name, not your email address. We keep them in your private settings, which only you can read. When someone posts a wanted ad that suits you, our post about it in the Discord server where we share new ads may mention you by your Discord name. Unlink it in Settings at any time and the mentions stop. Lawful basis: your consent, which unlinking withdraws.
People you invite by email. If you invite someone who has no account, we store a one-way hash of their address, not the address itself, so we can match the invitation if they sign up. It expires after thirty days. We send them one email about it. Lawful basis: legitimate interest, yours and theirs, in finishing a track together.
Listeners on a shared link. Someone opening a link you sent can leave a note under a name they type. We keep the name and the note with your track. Lawful basis: legitimate interest in running the feedback you asked for.
Messages to us. What you send to our support or privacy address, or through Contact us or Feedback in the app, so we can answer it or fix what you report. Feedback is copied into our private issue tracker on GitHub with your artist name and account ID, never your email address. Lawful basis: legitimate interest.
Safety. Reports and blocks, so we can review abuse and keep people apart. Lawful basis: legitimate interest and our legal obligations.
Technical records. Our hosting and server providers log requests, including IP address, browser and device details, and errors. We also count how many accounts, projects and plays there are. We use these to keep the service running and secure, not to profile you. Lawful basis: legitimate interest.

We do not sell your data, we do not show ads, and we do not use your audio to train AI.

3. Matching people to ads

When someone posts a wanted ad, Collabspot can suggest people who might suit it. It ranks profiles automatically, using the roles and genres people chose for themselves and the credits they have agreed on Collabspot. Only the person who posted the ad sees the list, no score is shown, and nobody is contacted or excluded from anything because of it. It has no legal or similarly significant effect on you. You can object to being included by emailing privacy@collabspot.app.

4. Emails

We only send service email: a code to confirm your address, a welcome when you join, and a message when someone invites you to a project or to apply for an ad, when a credit is waiting for you to agree it or one of yours is taken down, when someone answers your ad or accepts your application, and when someone leaves notes, sends a message, uploads a version or approves one on your projects. We do not send marketing. You can turn off the emails about notes, messages and versions in Settings. The rest are part of using the account, and deleting your account stops them.

5. Cookies and storage

We do not use advertising, analytics or tracking cookies, and nothing on our site loads a third-party tracker, so there is no cookie banner. What we do keep in your browser is either needed for something you asked for, or a setting you chose yourself. It stays on your device, is never used to follow you around the web, and you can clear it at any time in your browser settings.

Staying signed in. The app keeps your sign-in in your browser's storage, through Google Firebase. Without it you would be signed out on every visit.
A song brought over from another site. If you send a song from Can You Ferry, it is held in your browser while you sign up, then deleted. Anything left behind is forgotten after a day.
Likes and your name on shared links. A shared link page remembers whether you liked a track, so it is not counted twice, and the name you last left a note under. If you create an account from a shared link page, it keeps you signed in there too.
A battle vote on its way. If you open a vote link before signing in, the app holds which battle it was while you sign in, then casts your vote. Anything left behind is forgotten after a day.
Your settings. Light or dark mode, whether you have seen the latest “what's new”, whether you hid the notes in a track, and where you arranged people on your map.

Our fonts are served from our own site, not a font service. If we ever add analytics, we will ask first and update this policy.

Because we do not track you, there is nothing for a browser's Do Not Track or Global Privacy Control signal to switch off: we treat every visitor as if it were on. We do not let other companies collect information about what you do on Collabspot to follow you across other sites over time.

These companies process data for us, under contracts that require them to protect it:

Google: through Firebase, sign-in, the database, server functions and the public pages; and the mailbox our privacy and support addresses forward to.
Cloudflare: storage for audio and profile photos, our domain, and forwarding mail sent to our addresses.
Resend: sending email.
Netlify: hosting the web app.
GitHub: our private issue tracker, which holds feedback you send from the app.
Discord: if you link your account, the server where we post new wanted ads, where you may be mentioned by your Discord name.
ntfy: push alerts to our own phone when someone joins or files a report. They carry an account ID and a report's reason, never a name, an email address or what was reported.

We only share it with anyone else in these cases:

The law. When we are legally required to, or to protect someone's safety or rights.
Advisers. Legal or financial advisers, where we need their help.
A change of ownership. If Collabspot becomes a company, merges or is sold, your data moves with it and stays protected by this policy.

7. Outside the UK

Some of our providers process data outside the UK, including in the United States. Where they do, the transfer is covered by the UK's adequacy regulations, or by standard contractual clauses with the UK International Data Transfer Addendum.

8. Keeping it safe

Everything travels encrypted between your device and our services.
Audio is kept in private storage. It is only reachable through a link that expires after a few hours, issued to someone allowed to hear it.
Database rules decide who can read and change each record, and automated tests check them.
Your email address is kept in the sign-in system only, never in the shared database.

No system is perfectly secure. If a breach puts you at risk, we will tell you and the ICO as the law requires.

9. How long we keep it

Your account and profile, until you delete your account.
A track you delete, and its notes, are deleted straight away.
Email invitation hashes, thirty days or until claimed.
Feedback you send from the app, for as long as it helps us fix or improve Collabspot. Email privacy@collabspot.app and we will delete yours.
Server logs, about thirty days.
Messages to us through Contact us, for as long as we need them to answer you and follow up.
Reports, including ones you filed and ones about you, are kept after an account is deleted, so a safety record cannot be erased by the person it is about.
Wanted ads you posted are closed when you delete your account. Applications you sent stay with the person who posted the ad, shown as a deleted user.
When you delete your account, your login and your profile go, you come off every project, and a project nobody else is on is deleted with its tracks. Your tracks and comments on shared projects stay, shown as a deleted user, because they are part of other people's work.
A credit is never erased outright. It can be withdrawn, and a withdrawn credit is kept as a record so a dispute about who made what can still be settled.

10. Your rights

You have the right to:

see a copy of the data we hold about you, and have it in a portable format;
have anything wrong corrected, most of which you can do yourself in the app;
have your data deleted, which you can do yourself from Settings;
object to, or ask us to restrict, anything we do on the basis of legitimate interest.

For anything you cannot do in the app, email privacy@collabspot.app. We may ask you to confirm it is your account before we act, and we answer within one month. If you are unhappy with our answer, you can complain to the Information Commissioner's Office at ico.org.uk, or to the data protection authority where you live.

11. Sensitive information

We do not ask for sensitive information such as your health, religion, ethnicity, politics or sexuality. Please do not put it in your bio, notes or ads. If you find some on Collabspot, tell us and we will look at removing it.

12. Children

Collabspot is for people aged 18 and over, and we ask your age when you sign up. If you believe someone under 18 has an account, tell us and we will remove it.

13. Changes

If we change this policy in a way that matters, we will tell you in the app or by email before it takes effect.