Privacy Policy

1. Information We Collect

When you create an account, we collect:

• Email address
• First and last name (provided during onboarding)
• Username and display name
• Profile photo (if you upload one)

When you use the Service, we store the content and settings you create:

• Copedent configurations
• Profile sections and content you add (equipment details, gear lists, photos, text)
• Audio recordings you upload, and tab annotations you create for them (where audio features are enabled)
• Forum signature settings and the generated signature image
• Favorites, copies of community copedents, and other community interactions
• Feedback submissions and ratings
• Preferences such as your chosen theme

We also process limited technical data:

• A one-way hash of the IP address of signed-out visitors to public profiles, used only to avoid double-counting profile views. These logs are deleted within 24 hours.
• Standard server request logs (including IP addresses) processed by our hosting provider to operate and secure the Service.

2. Analytics

Analytics are opt-in. When you first use the Service you are asked what you are comfortable sharing, and nothing beyond essential operation is collected unless you agree. You can change your choices at any time in Settings.

During the beta period, if you opt in, we use PostHog (a third-party analytics service) to understand how the app is used. Depending on what you opt into, PostHog may collect:

• Page views, navigation patterns, and click events
• Session replays of your activity within the app. Because you are signed in, replays are associated with your account.
• Performance metrics (page load times, web vitals)
• Device type and browser information

PostHog's data is processed in the United States. You can review PostHog's privacy policy for details. We plan to remove or reduce third-party analytics after the beta period ends.

We also collect first-party usage analytics (page visits, session duration, feature usage) in our own database, associated with your account. Raw events are automatically purged after 2 days; only anonymous, aggregated daily statistics are retained long-term.

3. How We Use Your Data

We use your information to:

• Provide and operate the Service
• Display your public profile and content you choose to share with other users
• Send account-related communications (email confirmation, password reset)
• Moderate the community and enforce our Terms of Service
• Understand usage patterns and improve the product

4. Data Storage

Account data and content records are stored in a PostgreSQL database hosted by Supabase in the United States, on SOC 2 compliant infrastructure, protected by row-level security policies. Media files (photos, audio recordings, avatars, signature images) are stored and delivered by Cloudflare R2. The application is hosted by Vercel.

The Service is operated from the United States. If you use it from elsewhere, your data is transferred to and processed in the United States.

5. Data Sharing

We do not sell, rent, or share your personal information with third parties for marketing purposes. The service providers that process your data on our behalf are:

• Supabase — database infrastructure and authentication
• Vercel — application hosting and request logs
• Cloudflare — media file storage and delivery
• Google — OAuth authentication (only if you choose to sign in with Google)
• PostHog — opt-in product analytics and session replay (beta period only)

6. Data Retention & Deletion

You can view and delete your content at any time in Settings → My Data— individually, by category, or everything at once. Deleting content removes both the database records and any associated media files from storage.

To delete your login account entirely, contact us at the address below and we will remove it promptly.

A few records are kept or handled differently:

• Credit and transaction records are retained for billing integrity
• Content-moderation reports and administrative audit records are retained for platform safety
• Raw analytics events are automatically deleted within 2 days (aggregates keep no personal data)
• Profile-view deduplication logs are automatically deleted within 24 hours
• If another user copied one of your public copedents before you deleted it, their copy remains in their account (see the Terms of Service, “Community Library”)

7. Your Rights

You can:

• Access and review your data in Settings → My Data
• Correct your profile information at any time in Settings
• Export your copedent configurations as CSV files
• Control your profile and copedent visibility (public or private)
• Choose whether to display your username on feedback submissions
• Opt in or out of analytics at any time
• Delete your content, and request deletion of your account

Depending on where you live, you may have additional legal rights over your personal data (such as under the GDPR or CCPA), including access, correction, deletion, and portability. To exercise any right you cannot action directly in the app, contact us at the address below and we will respond as required by applicable law.

8. Cookies

We use essential cookies required for authentication (Supabase session cookies to keep you signed in). Your theme choice is stored in your browser's local storage. If you opt into analytics during the beta period, PostHog may also set cookies (session identification and feature flags). We do not use advertising cookies.

9. Children

PedalSteelPro is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us so we can remove it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes via email or in-app notification. The “Last updated” date at the top of this page reflects the most recent revision.

11. Contact

If you have questions about this Privacy Policy or how we handle your data, contact us at support@pedalsteelpro.com.