Privacy policy

Last updated 11 September 2026

This explains what Collabspot holds about you, why we hold it, who helps us run the service, and what you can ask us to do about it. It is written to meet the UK General Data Protection Regulation and the Data Protection Act 2018.

1. Who we are

Collabspot is run by Andrew Taylor, a sole trader based in the United Kingdom, trading as Collabspot. For everything in this policy, Andrew Taylor is the data controller.

Write to privacy@collabspot.app about anything here. For help with the app, use support@collabspot.app.

2. What we hold, and why

• Your account. Your email address and password, or your Google sign-in. If you use Google, Google shares your name, email address and profile photo with our sign-in provider; your Collabspot profile only shows what you enter yourself. We use your email address to let you in and to send you mail about your account, and it is never shown to other people. We also record that you confirmed you are 16 or over. Lawful basis: performing our contract with you.
• Your profile. Your artist name, and anything you choose to add: a photo, a bio, a location, your roles and genres. Other signed-in people can see it, and anyone can see it if you turn on your public profile. Lawful basis: contract.
• What you make and share. Projects, audio files, notes and replies, credits, wanted ads and applications. They are shared with the people you work with or send a link to. Lawful basis: contract.
• People you invite by email. If you invite someone who has no account, we store a one-way hash of their address, not the address itself, so we can match the invitation if they sign up. It expires after thirty days. We send them one email about it. Lawful basis: legitimate interest, yours and theirs, in finishing a track together.
• Listeners on a shared link. Someone opening a link you sent can leave a note under a name they type. We keep the name and the note with your track. Lawful basis: legitimate interest in running the feedback you asked for.
• Messages to us. What you send to our support or privacy address, or through Contact us or Feedback in the app, so we can answer it or fix what you report. Feedback is copied into our private issue tracker on GitHub with your artist name and account ID, never your email address. Lawful basis: legitimate interest.
• Safety. Reports and blocks, so we can review abuse and keep people apart. Lawful basis: legitimate interest and our legal obligations.
• Technical records. Our hosting and server providers log requests, including IP address, browser and device details, and errors. We also count how many accounts, projects and plays there are. We use these to keep the service running and secure, not to profile you. Lawful basis: legitimate interest.

We do not sell your data, we do not show ads, and we do not use your audio to train AI.

3. Matching people to ads

When someone posts a wanted ad, Collabspot can suggest people who might suit it. It ranks profiles automatically, using the roles and genres people chose for themselves and the credits they have agreed on Collabspot. Only the person who posted the ad sees the list, no score is shown, and nobody is contacted or excluded from anything because of it. It has no legal or similarly significant effect on you. You can object to being included by emailing privacy@collabspot.app.

4. Emails

We only send service email: when someone invites you, credits you, answers your ad, accepts your application, or leaves notes on your project, and a welcome when you join. We do not send marketing. You can turn note emails off in Settings. The rest are part of using the account, and deleting your account stops them.

5. Cookies and storage

We do not use advertising, analytics or tracking cookies, so there is no cookie banner. The app keeps you signed in using your browser's storage. A shared link page remembers, in your browser only, whether you liked a track and the name you last left a note under. Our public pages load the DM Sans font from Google Fonts, which means Google sees your IP address when the page loads. If we ever add analytics, we will ask first and update this policy.

6. Who we share it with

These companies process data for us, under contracts that require them to protect it:

• Google: through Firebase, sign-in, the database, server functions and the public pages; and the mailbox our privacy and support addresses forward to.
• Cloudflare: storage for audio and profile photos, our domain, and forwarding mail sent to our addresses.
• Resend: sending email.
• Netlify: hosting the web app.
• GitHub: our private issue tracker, which holds feedback you send from the app.

We only share it with anyone else in these cases:

• The law. When we are legally required to, or to protect someone's safety or rights.
• Advisers. Legal or financial advisers, where we need their help.
• A change of ownership. If Collabspot becomes a company, merges or is sold, your data moves with it and stays protected by this policy.

7. Outside the UK

Some of our providers process data outside the UK, including in the United States. Where they do, the transfer is covered by the UK's adequacy regulations, or by standard contractual clauses with the UK International Data Transfer Addendum.

8. Keeping it safe

• Everything travels encrypted between your device and our services.
• Audio is kept in private storage. It is only reachable through a link that expires after a few hours, issued to someone allowed to hear it.
• Database rules decide who can read and change each record, and automated tests check them.
• Your email address is kept in the sign-in system only, never in the shared database.

No system is perfectly secure. If a breach puts you at risk, we will tell you and the ICO as the law requires.

9. How long we keep it

• Your account and profile, until you delete your account.
• A track you delete, and its notes, are deleted straight away.
• Email invitation hashes, thirty days or until claimed.
• Feedback you send from the app, for as long as it helps us fix or improve Collabspot. Email privacy@collabspot.app and we will delete yours.
• Server logs, about thirty days.
• When you delete your account, your login and your profile go, you come off every project, and a project nobody else is on is deleted with its tracks. Your tracks and comments on shared projects stay, shown as a deleted user, because they are part of other people's work.
• A credit is never erased outright. It can be withdrawn, and a withdrawn credit is kept as a record so a dispute about who made what can still be settled.

10. Your rights

You have the right to:

• see a copy of the data we hold about you, and have it in a portable format;
• have anything wrong corrected, most of which you can do yourself in the app;
• have your data deleted, which you can do yourself from Settings;
• object to, or ask us to restrict, anything we do on the basis of legitimate interest.

For anything you cannot do in the app, email privacy@collabspot.app. We may ask you to confirm it is your account before we act, and we answer within one month. If you are unhappy with our answer, you can complain to the Information Commissioner's Office at ico.org.uk, or to the data protection authority where you live.

11. Sensitive information

We do not ask for sensitive information such as your health, religion, ethnicity, politics or sexuality. Please do not put it in your bio, notes or ads. If you find some on Collabspot, tell us and we will look at removing it.

12. Children

Collabspot is for people aged 16 and over, and we ask your age when you sign up. If you believe someone under 16 has an account, tell us and we will remove it.

13. Changes

If we change this policy in a way that matters, we will tell you in the app or by email before it takes effect.