Privacy policy

What BandFox is

BandFox is a web app for bands to share a calendar, a song library, and set lists. It is operated as a personal project. If you have questions, contact the operator at the support email listed on the sign-in screen.

What we collect

When you sign in, we receive an account identifier and usually your email address, display name, and profile photo (when your sign-in provider shares them). We never ask for your Google or Facebook password, and we do not read your mail, social feed, or other data from those services.

You can sign in with Google, Facebook, or a one-time email link. Email sign-in sends a link to your inbox; we do not store a password for your account.

Everything you add inside a band — songs, events, set lists, attachments, invite links, and to-dos — is stored so your bandmates can see it. That content belongs to the band, not to BandFox as a product catalog.

How we use it

• To show your name and photo to other members of your bands.
• To keep you signed in on the same device between visits.
• To enforce who can see and edit each band's data.

We do not sell your data, run advertising against it, or use it to build marketing lists.

Where it is stored

Account data and band content are stored in a Supabase (PostgreSQL) database hosted in the United States. Authentication is handled by Supabase Auth. Reference links you paste (YouTube, Spotify, and similar) are stored as URLs; BandFox does not download those files unless you explicitly attach an uploaded file later.

Who can see it

Band data is visible only to signed-in members of that band. There is no public read-only view. Invite links reveal only the band name and member count before you sign in, so you know what you are joining.

How long we keep it

Data stays until you or a band leader deletes it, or until the band is removed. If you want your account deleted, contact the operator and we will remove your profile and membership records. Content you created inside a band may remain visible to that band unless a leader removes it.

Google account data

If you choose Google sign-in, BandFox's use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. We use Google sign-in only for authentication and profile display, not to access other Google services on your behalf.

Other sign-in providers

Facebook sign-in is used only for authentication and to show your name and photo to bandmates. Magic-link email sign-in uses your email address only to verify it is you; we do not send marketing email.

Changes

If this policy changes materially, the date at the top will be updated. Continued use of BandFox after a change means you accept the revised policy.