Privacy policy
Last updated: 6 November 2026
In short
CollaBand needs an account with a name and a passkey. No email address or password is required. We set no tracking cookies and sell no data. We store only what your band needs for the shared song. Songs and recordings are deleted automatically after 30 days at the latest.
Controller
The controller responsible for data processing is Nord Spot, [email protected] (see Legal notice). The Swiss Federal Act on Data Protection (FADP) applies and, where applicable, the GDPR.
What data we process
Account: your stage name, the public key of your passkey (not biometric data; your face and finger never leave your device), a device label such as “iPhone”, usage timestamps and a hashed recovery key. Songs: title, band name, parts, the demo file, technical synchronization data and who is in the band. Takes: your part, your audio and video recording and synchronization data. To protect against abuse we briefly process your IP address and store only an irreversible, salted hash of it for no more than 24 hours.
Purpose and legal basis
The data is processed exclusively to provide your account and your bands’ shared songs (performance of a contract, or your consent when you upload a recording). There is no advertising, no profiling and no disclosure to third parties for their own purposes.
Who has access
Only the members of a band can see its song. You become a member by opening an invite link with your account. The secret part of the link is after the # and never reaches our server logs. The person who created the song can renew the link at any time. Share the link only with your band.
Cookies
We set exactly one cookie: a strictly necessary session cookie that keeps you signed in (httpOnly, HTTPS only, at most 90 days). We store only a hash of it. There are no tracking or advertising cookies.
Retention and deletion
Songs and all recordings are deleted automatically 30 days after they are created. The person who created a song can delete it immediately at any time, and you can delete your own take at any time. Your account remains until you delete it; deleting it immediately removes your songs, takes, passkeys and sessions. The finished video is created on your device and is not stored by us.
Processors
We host with Cloudflare, Inc. (Cloudflare Pages, D1 and R2, with Western Europe as the preferred storage location). Cloudflare is certified under the Swiss-U.S. and EU-U.S. Data Privacy Framework and processes the data only on our behalf.
Local storage on your device
Your browser stores locally your theme, your last chosen part, the measured latency and cached media files. These are not tracking cookies, and you can delete them at any time in your browser settings.
Your rights
You have the right to access, rectification, erasure and data portability. You can change your name and delete your account yourself under “Account”, and download your recordings as stems. For requests, write to [email protected]. You can also lodge a complaint with the FDPIC or your competent supervisory authority.