Privacy Policy

Signing in with Google

You can only sign in to OurBand with a Google account. When you sign in, Google shares your name, your email address and your Google account identifier with us.

We never see your Google password, we do not use or store any password, and we do not ask for access to your calendar, your contacts or any other Google service.

Your name comes from Google and you can change it in the settings. Your email address cannot be changed in OurBand.

What we store

For your account, we store:

• your name, your email address and your Google account identifier
• the bands you are a member of, the band you last opened and when you last read your notifications
• your notification subscription, if you turn on push notifications

For your bands, we store the content shared by their members, such as:

• audio files, score files and images
• titles and BPM
• event details: date, type, title, description, location and link

We also store activity records, which are shown in the in-app notifications, for example to say that a member added a new song.

If you email us, we receive your email address and your message.

How we use your data

We use your data only to provide OurBand, that is to:

• sign you in and keep you signed in
• share each band's songs, calendar and artworks with its members
• show your bands' activity in the in-app notifications
• if you turn them on, send you push notifications when another member of your band adds something, such as a song, a new version, an artwork or an event, or joins the band
• provide each band's calendar subscription link
• keep OurBand secure and working properly
• answer your emails and handle reports about content

We do not use your data for analytics or advertising, we do not sell it, and we do not use it to make automated decisions about you or to build a profile of you.

The legal bases for these uses are:

• the performance of our contract with you (the terms and conditions), to provide OurBand
• your consent, for push notifications, which you can withdraw at any time by turning them off
• legitimate interests, ours and those of band members, for pending invitations, for the content that stays with a band after a member deletes their account, for keeping OurBand secure and for handling emails and reports about content
• legal obligations, when the law requires us to keep or disclose data

Who can see your data

The members of a band can see your name, your email address, the content you share with that band and the activity it generates.

We use the following service providers to run OurBand:

• MongoDB Atlas, which hosts our database
• Cloudinary, which stores the media files
• Vercel, which hosts the app
• Google, which handles the sign-in and our email
• the push service of your browser (for example Google, Apple or Mozilla), only if you turn on push notifications

We do not share your data with anyone else, unless the law requires it.

International transfers

Our service providers, including MongoDB Atlas, Cloudinary, Vercel and Google, may process data outside the UK and the European Economic Area, including in the United States.

These transfers rely on the safeguards that these providers offer, such as standard contractual clauses, the UK International Data Transfer Addendum or the UK-US data bridge.

Adding people to a band

Any member of a band can add a person to it with their email address. If the person already has an OurBand account, they join the band straight away. Otherwise, we keep their address as a pending invitation until they sign in to OurBand with Google using that address: they then join the band and the invitation is deleted.

Until then, the members of the band can see the pending address and cancel the invitation. The invitation is also deleted if the member who created it deletes their account. We never send any email to the person.

Push notifications

Push notifications are off until you turn them on. When you do, we store your notification subscription, and your notifications go through the push service of your browser (for example Google, Apple or Mozilla). Their content is encrypted, so the push service cannot read it.

You can turn them off at any time, in the app or in your browser's settings.

Calendar subscription link

Each band has a private calendar subscription link (ICS) that its members can add to Google Calendar, Apple Calendar or Outlook. Anyone who has this link can see the band's events, except the members' unavailabilities, even without an OurBand account, so it should not be shared outside the band.

Any member can reset the link, for example after someone leaves the band: subscriptions to the old link then stop working.

When a member adds the link to a calendar app, the band's events are also shown in that app, under the privacy policy of its provider.

Cookies

We only use strictly necessary cookies:

• a session cookie that keeps you signed in: it is signed by our server, holds only your account identifier and its expiry date, and expires after one year or when you sign out
• short-lived cookies used during the Google sign-in, to protect it

We use no analytics, advertising or tracking cookies, and no third-party tracker. As our cookies are strictly necessary, we do not show a cookie consent banner.

You can block or delete cookies in your browser's settings, but we then cannot keep you signed in.

How long we keep your data

We keep your account data and your activity records for as long as your account exists.

You can delete your account at any time from the settings. This removes you from all your bands and deletes:

• your account, including your notification subscription
• your own unavailability events
• the activity records you generated
• the pending invitations you created

The songs, versions, scores, artworks and events you shared with a band are not deleted: they stay available to the band's other members.

Any member of a band can delete what is shared in it. A deleted song or artwork is erased for good, with all its versions, its scores and their files, and so is a score or an event deleted on its own.

We keep emails for as long as we need them to handle your request. After a deletion, copies may remain for a limited time in the backups of our service providers.

Your rights

Under the UK GDPR and the GDPR, you have the right to:

• access your personal data and get a copy of it
• have your personal data corrected if it is inaccurate
• have your personal data erased
• restrict the use of your personal data
• receive your personal data in a portable format, or have it sent to another service
• object to the use of your personal data
• withdraw your consent at any time, where we rely on it

Some of these rights only apply in certain situations. To exercise them, email us at guillaume.gouchon@gmail.com, and we will answer within one month. You can also change your name and delete your account yourself, from the settings.

You also have the right to complain to the UK Information Commissioner's Office (ICO) or, if you live in the European Union, to the data protection authority of your country.

Children

To use OurBand, you must be old enough to hold a Google account.

If you think that a child who is too young has used OurBand, email us at guillaume.gouchon@gmail.com so that we can delete their data.

Changes to this policy

We may update this policy, for example when OurBand changes. The new version will be published on this page, with a new "Last updated" date.

Contact

If you have a question about this policy or about your personal data, contact us by email at guillaume.gouchon@gmail.com.