Privacy Policy

1. Who we are

mixBase ("we", "our", "the app") is a music version-control and release-management tool. We are operated as an independent product. Questions can be directed to privacy@mixbase.app.

2. Information we collect

• Account data — your email address and hashed password, used to authenticate you.
• Audio files — the audio files you upload. These are stored in Supabase cloud storage and are private to your account unless you explicitly share them.
• Project metadata — titles, BPM, key, genre, notes, and release information you enter.
• Artwork images — cover art you upload or generate via AI.
• Feedback — comments left by collaborators on your shared tracks (includes the reviewer name they provide).
• Usage data — standard server logs (IP address, request timestamps, response codes) retained for up to 30 days for debugging.

3. How we use your information

• To operate and maintain your account and its associated music projects.
• To deliver core features: audio playback, version tracking, release pipeline, and share links.
• To send transactional emails (password reset, account notices) — we do not send marketing email.
• To diagnose technical issues using anonymised log data.

We do not sell, rent, or share your personal data or audio files with third parties for advertising purposes.

4. Third-party services

• Supabase — database and file storage provider. Data is stored in the US-East-1 region. Supabase Privacy Policy.
• Railway — application hosting. Railway Privacy Policy.
• Replicate — optional AI artwork generation. Only invoked when you explicitly request artwork generation; your prompts are sent to Replicate's API. Replicate Privacy Policy.

5. Data retention

Your account and all associated data (projects, audio files, artwork) are retained for as long as your account is active. You may delete individual projects, versions, or your entire account at any time. Deleted audio files are removed from storage within 24 hours.

6. Security

All data is transmitted over HTTPS. Passwords are hashed by Supabase Auth using bcrypt and are never stored in plaintext. Audio files are stored in private Supabase buckets; public URLs are only generated when you create a share link. Share links expire when you delete the corresponding version.

7. Your rights

Depending on your jurisdiction you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your account and all associated data.
• Export your data in a portable format.

To exercise any of these rights, email privacy@mixbase.app. We will respond within 30 days.

8. Children

mixBase is not directed at children under 13 (or under 16 in the EU). We do not knowingly collect personal data from children. If you believe a child has created an account, contact us and we will delete it promptly.

9. Changes to this policy

We may update this policy occasionally. Material changes will be communicated via the email address on your account. The "last updated" date at the top of this page always reflects the current version.

10. Contact

Privacy questions or requests: privacy@mixbase.app