Privacy Policy
Last updated: 14 July 2026
GigCharts is a tool for making chord charts. This policy explains what personal data we handle, why, and the rights you have. We designed the product to collect as little as possible: it is local-first, so your songs live in your own browser and only reach our servers if you sign in and use cloud sync.
Who we are
GigCharts ("we", "us") operates the marketing site at gigcharts.app and the app at app.gigcharts.app. For any privacy question, or to exercise a right below, email [email protected]. We are the data controller for the personal data described here.
What we collect
What reaches our servers depends entirely on how you use GigCharts:
| How you use it | What reaches our servers |
|---|---|
| Anonymous | Nothing. Your charts live only in your browser's localStorage — nothing reaches our servers. |
| Signed in (free) | Your email address and sign-in token — your own charts still stay in your browser (the free library limit is checked on your device, not on a server). Only what you deliberately hand over travels: a chart you share with a contact, or a chart you add to a band. Band charts belong to the band and live on our servers so the whole band sees them. |
| Pro | All of the above, plus your library — cloud sync is the Pro feature that uploads your charts so they follow you across devices — and billing, handled by the merchant of record, so we never see your card details. |
In more detail:
- Nothing, if you just use the app anonymously. While you are signed out, charts are stored only in your browser (localStorage) and are never sent to us.
- Your email address, if you create an account. We use passwordless sign-in, so we store your email and an authentication token — not a password. Signing in does not upload your charts: a free account's library stays on your device.
- Charts you deliberately share: sending a chart to a contact, or adding it to a band, stores that chart on our servers so the other people can see it. Band charts belong to the band. Everything else in your library stays local.
- Your songs and setlists, if you are a Pro subscriber with cloud sync. These are stored so they sync across your devices. They are private to your account and never made public or searchable. They are visible to other people only when you share them or add them to a band.
- Billing information, if you subscribe to Pro. Payments are processed by our merchant of record, Stripe (via Stripe Managed Payments) — we do not see or store your card details.
- Aggregate, anonymous usage statistics: we measure traffic with Cloudflare Web Analytics — cookieless and aggregate (page views, country, referrer). It sets no cookies and does not identify you.
Why we use it (legal bases)
- To provide the service — signing you in and syncing your songs (performance of our contract with you).
- To take payment for Pro (performance of contract).
- To keep the service secure and working, and to understand aggregate usage (our legitimate interests, balanced against your privacy).
- To send you product or early-access emails, only if you asked for them (consent — you can withdraw it anytime).
Who we share it with (subprocessors)
We don't sell your data. We use a small number of trusted providers to run the service:
- Supabase — database, authentication and cloud storage for accounts.
- Stripe — payments and subscription billing, as our merchant of record (Stripe Managed Payments).
- Resend — sending sign-in and account emails.
- Cloudflare — hosting and content delivery. We do not currently run analytics; if we ever do, it will be Cloudflare Web Analytics, which is cookieless and aggregate.
Each acts as our processor under a data-processing agreement. Some are based in the United States; where your data is transferred internationally, that transfer is covered by Standard Contractual Clauses or an equivalent safeguard.
Your rights
You can access, export, correct, or delete your data at any time. The app has built-in controls: from your account menu you can export all your data as a file, and delete your account, which permanently removes your account and all songs, setlists and folders stored with it. You can also just email us and we'll do it for you.
If you are in the EU/UK, you also have the right to object to or restrict processing, to data portability, and to lodge a complaint with your local data protection authority. If you are in California, you have the rights described by the CCPA/CPRA, including that we do not sell or "share" your personal information.
Retention
Account data is kept for as long as your account exists. When you delete your account, your songs, setlists and folders are deleted from our systems and roll off backups shortly after. Anonymous, local-only data lives only in your browser until you clear it.
Cookies
We use only an essential cookie to keep you signed in. We do not use advertising or cross-site tracking cookies. See our Cookie Policy for details.
Security
Data is encrypted in transit. Cloud data is protected by row-level security, so an account can only ever read or write its own rows. No system is perfectly secure, but we take reasonable measures to protect your information.
Children
GigCharts is not directed to children under 16 (or the minimum age in your country), and we don't knowingly collect their personal data.
Changes
If we make a material change to this policy, we'll update the date above and, for significant changes, let account holders know.
Contact
Questions, or want to exercise a right? Email [email protected].
This page is provided in good faith for transparency and is not legal advice. If anything here is unclear, or you need it in another form, email us and we'll help.