Privacy Policy

This explains what GreenRoom collects, why, who can see it, and how to get rid of it. GreenRoom is a band-management tool for working adult musicians. It is built for bands that invite each other, not for the public.

What we collect

• Account details: your name, username, email address, and a password stored only as a one-way hash (we can't read it).
• Age confirmation and date of birth. GreenRoom is for adults. At sign-up you confirm that you are 18 or older, either by entering your full date of birth or by ticking a signed statement, depending on the sign-up form in use; existing accounts confirm once with their date of birth. We record when and how you confirmed. A date of birth is used for that and nothing else: it is never shown to other members, never exported, and is kept only while your account exists. If you enter a date that makes you under 18, we create no account and keep nothing you typed.
• Optional profile details: phone, address (street, unit, city, state or region, postal code, country; any part can be left blank), instruments, bio, links, a photo, and a birthday (day and month only, used for bandmate reminders). You choose who can see each one on the Privacy settings page, and you can leave them blank.
• Address maps: to draw the small map under your address on your profile, your address is sent from our server to OpenStreetMap (Nominatim) to find its position, and your browser then loads the map itself from openstreetmap.org. We remember the result so the same address is not looked up twice. Leave your address blank, or ask us to turn map lookups off, and nothing is sent.
• What you and your bands add: events, availability, RSVPs, setlists, songs, gear, tasks, notes, chat and comments, uploaded photos and files.
• Safety reports: if you report something, or someone reports your content, we keep the report, who made it, and what we did about it for one year. Report records are visible only to the site owner.
• Band activity log: each band keeps a short log of who created, changed or deleted things in the band (for example a member, a show, a song or a file), showing the person's name, what they did, and when. It holds short labels only, never passwords or message text, and the band's admins and owner can see it. It is on by default and an admin can turn it off in Band settings.
• Security and technical records: sign-in events with your IP address and browser type, used to spot break-in attempts and abuse. We delete them after 180 days.
• Payments (when billing is on): payment is handled by our payment processor. We receive the plan, amount, dates and the last four digits of your card. We never see or store your full card number.

Who can see it

Band information is visible to the members of that band. Your contact details are visible to people in your bands according to the settings on your account page. Notes marked "just for me" and draft setlists are visible only to you. Site administrators can see account and band information when they need to run the service, fix a problem, or deal with abuse.

Who helps us run it (service providers)

• Hosting: the servers that store your data.
• Email delivery: a mail service sends confirmation, reset and notification emails to your address.
• Payments: a payment processor, once paid plans start.
• Song lookup: when you search for a song we send the search text, and the song's title and artist, to public music databases (Apple, Deezer and GetSongBPM) to fill in details. Nothing that identifies you is sent.
• Sonar AI chat (only if switched on for you): your messages and recent chat turns are processed by AI models we run ourselves, and as a fallback by Ollama's cloud service (ollama.com). Platform administrators can view your chats when providing support. Chats are deleted after 30 days.
• Sonar web search: for questions about news, prices or dates, Sonar can search the web. Only the question you are asking at that moment goes out, with your name, username, email address and phone-like numbers removed and none of your chat history, as an anonymous query sent by GreenRoom's own server (not your device) to public search engines. The search engines see GreenRoom's server, not you. We keep no copy of the search results beyond the sources shown under your answer, which are deleted with the chat after 30 days.
• Link previews: when you paste a link from a site like YouTube, Spotify, SoundCloud, TikTok or Vimeo, our server fetches the title and thumbnail from that site.
• Google Calendar (optional, when offered): if you choose to connect it, we use your permission only to show GreenRoom events in your calendar. You can disconnect at any time from your account page or from your Google account.

These providers may only use your information to do their job for us.

What we don't do

We don't sell your data, rent it out, or show you ads. We don't build advertising profiles. We only email you about your account and about launch news if you sign up for it, and every news email can be unsubscribed.

Cookies and storage on your device

We use one essential cookie to keep you signed in, a short-lived cookie if a sign-up is declined for age, and your browser's local storage for preferences like light or dark theme. If you turn on push notifications, your browser gives us an address to send them to, and you can turn them off at any time. We don't use advertising or cross-site tracking cookies.

Where it is stored

Your information is stored on servers in the United States. If we move to a different hosting provider, we'll keep it in a place with comparable protection and update this page. If you use GreenRoom from outside the United States, you understand your information is processed here.

How long we keep it

• Your account and band content: while your account is open. When you delete your account, your profile is removed right away and what remains is purged within 30 days.
• Backups: daily, each kept 14 days, so deleted data can sit in a backup that long before it is overwritten.
• Sign-in and security records: 180 days.
• Band activity log: 30 days, or 180 days for a band on the Pro plan. Older entries are deleted automatically.
• Safety reports and the safety log: one year. The log holds what kind of event it was and when, with no personal details.
• If a legal request or a report to the authorities is open: we keep the relevant data for as long as the law or the request requires, which can be longer than the above.
• Payment records: as long as tax and accounting law requires.

If someone fails our age check at sign-up, nothing they typed is kept. If an existing account tells us its owner is under 18, the account and its data are deleted, and we keep no record of who they were.

We do not scan your private content for keywords. We act on reports and on plain counts (like a band with many members and no activity), and a person looks at anything flagged.

If you joined an artist's fan list

Some artists on GreenRoomGigs have a sign-up page or QR code where fans can join their email list. This part is for those fans. The artist decides to collect your details and what to send you, so the artist is responsible for their list. GreenRoomGigs only stores it for them.

• What a sign-up stores: your email address; your first name and your town or ZIP if you typed them; which page or QR code you came from; the exact wording you agreed to, the time you agreed (UTC) and that you said you are 18 or older; and a scrambled form of your network address (a keyed fingerprint, not the address itself) that we use only to limit abuse. The sign-up page sets no cookies and loads nothing from other companies.
• Why: so the artist can email you about shows and new music after you confirm. Nothing is emailed yet: today sign-ups are only saved, and you will get one email asking you to confirm before anything else.
• How long we keep it: if no confirmation email has been sent within 90 days of your sign-up, it is deleted automatically. If a confirmation email was sent and you do not confirm within 7 days, it is deleted. Once you confirm, it stays until you unsubscribe, the artist removes you, or the artist deletes their account. Deleted details can remain in our daily backups for up to 14 days.
• Unsubscribing: every email will carry a one-click link that deletes your name, town and other details at once. We keep only a scrambled fingerprint of your address so you are not added again by mistake.
• A copy of your data, or deletion, any time: use the contact page and choose "Fan data request". Give the email address you signed up with and the artist's name. We pass the request to the artist and make sure it is done, and you get an answer within 30 days.

Artists' private audio and video takes are visible only to the artist and to people the artist names for a limited time. They are not included in our site backups, and when a take, song, gig or account is deleted its file is removed from our server at the same time.

Your choices and rights

You can see and change most of your information on your account page. You can ask us for a copy of your data, to correct it, or to delete your account and personal details, through the contact page. We'll confirm it's really you and then do it, normally within 30 days. If you live somewhere with stronger privacy laws (for example California or the European Union), you have the rights those laws give you, and we'll honour them.

Deleting your account removes your profile. Things you contributed to a band, like a chat message or a setlist, may stay in that band's history under a neutral name so the band's records still make sense.

Security

Passwords are hashed, sign-in is protected by rate limits and optional two-factor sign-in, and the production site is served over an encrypted (HTTPS) connection. No system is perfectly secure. If we learn of a breach of your personal information, we'll tell you without unreasonable delay and no later than 30 days after we discover it (as Washington law, RCW 19.255.010, requires), and say what we're doing about it.

Adults only, no children

GreenRoom is not for anyone under 18 and we don't knowingly collect information from people under 18. If you think someone under 18 has an account, tell us through the contact page and we'll suspend it and delete what we hold.

Changes

If we change this policy in a way that matters, we'll tell signed-in members before it takes effect. The date at the top shows when it last changed.

Contact

Questions or requests: use the contact page.