Privacy Policy

1. Privacy at a Glance

JamBench is a practice-tracking platform for bass players. We collect and process personal data solely to provide and improve our service. This privacy policy describes exactly what data we collect, how we use it, and which third-party services are involved.

2. Responsible Party & Your Rights

Responsible Party

The party responsible for data processing on this website is:

Your Rights Under GDPR

You have the following rights regarding your personal data at any time:

• Access (Art. 15 GDPR) — What data we have stored about you
• Rectification (Art. 16 GDPR) — Correction of inaccurate data
• Erasure (Art. 17 GDPR) — Deletion of your data, unless legal retention obligations apply
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR) — Receive your data in a common format
• Objection (Art. 21 GDPR) — In particular against processing based on legitimate interests

To exercise these rights, contact damir@jambench.com. You also have the right to lodge a complaint with the competent supervisory authority (Art. 77 GDPR). For Bavaria, Germany: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA).

Withdrawal of Consent

Where processing is based on your consent, you may withdraw it at any time with effect for the future. The lawfulness of processing carried out prior to the withdrawal remains unaffected.

Revoking YouTube consent: Your consent to load the YouTube player is stored in your browser's Local Storage under the key yt_consent. You can revoke this consent at any time by clearing your browser's site storage:

• Chrome: Settings → Privacy → Clear browsing data
• Firefox: Settings → Privacy → Cookies and Site Data
• Safari: Settings → Privacy → Manage Website Data

Obligation to Provide Data

Providing the mandatory information required for registration (email address and password) is necessary for the performance of the user agreement (Art. 13(2)(e) GDPR). Without this information we cannot make the service available to you. All other information is optional; not providing it has no disadvantageous consequences other than waiving the corresponding feature.

Automated Decision-Making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you.

3. Hosting & Infrastructure

JamBench is externally hosted. Personal data collected on this website is stored on the servers of the following providers:

Legal basis: Contract fulfillment (Art. 6(1)(b) GDPR) and legitimate interest in secure, fast delivery (Art. 6(1)(f) GDPR). Application data (Supabase) is stored in the EU; no transfer of personal data to third countries takes place as part of the hosting itself. Where technical administrative access by the parent company Supabase Inc. (Singapore) or by Vercel Inc. and Upstash Inc. (USA) cannot be excluded in individual cases, we rely on the providers' EU Standard Contractual Clauses (SCC) (Art. 46(2)(c) GDPR).

4. Data We Collect

Account Data

When you register for and use JamBench, we collect:

• Required: Email address, password (stored hashed by Supabase Auth)
• Profile data (optional): Username, first name, last name, city, country, profile picture, timezone, preferred currency
• Account status: all accounts are currently free; no payment or subscription status

Legal basis: Contract fulfillment (Art. 6(1)(b) GDPR).

Practice Data

When you use JamBench for practice, we store your practice sessions. This includes:

• Date, duration, and type of practice session
• BPM used, time signature, instrument
• Personal notes on sessions
• Streak data (current and longest practice streak)
• Total and weekly practice time

Legal basis: Contract fulfillment (Art. 6(1)(b) GDPR) — this data is the core of the service.

Library Data

You can build a personal library of presets, lists, and tracks in JamBench. We store:

• Preset data: title, BPM, time signature, subdivision, artist, album, genre
• Track data: YouTube URL and video ID (library pointers); JamBench song title and artist (your practice identity — not stored YouTube API metadata); sections; notes
• Lists: title, assigned presets

Legal basis: Contract fulfillment (Art. 6(1)(b) GDPR).

Calendar Sync

You can optionally generate a personal calendar subscription link (webcal URL) in the History. This link makes a read-only summary of your practice sessions available to any calendar application you choose (e.g. Google Calendar, Apple Calendar, Outlook).

The feed contains:

• Date and time of each practice session
• Duration of each session
• Activity titles (e.g. song name, exercise name)

The link is secured by a personal secret token (a randomly generated UUID). Anyone who possesses the link can access this data without logging in — we therefore recommend keeping the link private. You can revoke access at any time by regenerating the link in the History, which immediately invalidates the previous URL.

We do not receive any data from your calendar application in return — the feed is strictly one-directional (JamBench → your calendar). No data is shared with Google or any other third party; the calendar application fetches the feed from our server directly.

Legal basis: Data portability (Art. 20 GDPR) and contract fulfillment (Art. 6(1)(b) GDPR). Use of the calendar sync feature is entirely optional.

Preferences

Your personal settings (e.g., theme, metronome configuration, benching preferences) are stored as JSON in your user profile.

Attribution Data

Upon registration, we capture UTM parameters (utm_source, utm_medium, utm_campaign, utm_content) and the HTTP referrer. This data is used for internal analysis of where new users come from and is not shared with third parties.

Legal basis: Legitimate interest (Art. 6(1)(f) GDPR).

Internal Event Data

We log certain application events (e.g., page views, feature usage) in an internal database. This data contains your user ID, event name, page path, and a session ID. We do not use advertising trackers.

Legal basis: Legitimate interest in improving the service and understanding product adoption (Art. 6(1)(f) GDPR).

Anonymous Visitors

We do not track logged-out visitors. We do not store an anonymous visitor ID (including bb_anon_presence_id in Session Storage) and we do not send presence heartbeats for visitors who are not signed in.

Server Log Files

The hosting provider (Vercel) automatically collects server log data: browser type, operating system, referrer URL, IP address, and time of access. This data is not merged with other data sources.

Legal basis: Legitimate interest (Art. 6(1)(f) GDPR).

5. Cookies

JamBench uses technically necessary cookies, Local Storage and Session Storage for sign-in, UI and cache-busting, plus consent-based YouTube / campaign storage and first-party measurement of traffic source. We donot use third-party advertising cookies and do not engage in advertising-based third-party tracking. Every public key is listed in the tables below.

Technically necessary cookies

Legal basis: § 25(2) No. 2 TDDDG in conjunction with Art. 6(1)(b) and (f) GDPR — no consent required, as these cookies are strictly necessary for technical operation and contract performance.

You can delete or block cookies in your browser settings at any time. Without the authentication cookie, sign-in is not possible.

Consent-based cookies

The following cookie is set when you explicitly agree to our Terms of Service and this Privacy Policy at registration (consent checkbox on the sign-up form). For users who are already signed in, it may also be set when they open a campaign link.

Legal basis: § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR (consent). You can delete this cookie in your browser settings at any time. Using JamBench is not affected.

First-party measurement (not essential)

The following cookies support internal campaign/traffic attribution. They are not strictly necessary cookies under § 25(2) No. 2 TDDDG and not third-party advertising cookies.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in measuring the effectiveness of our own content). Not described as strictly necessary under § 25(2) No. 2 TDDDG.

Local Storage & Session Storage

In addition to cookies, we use your browser's Local Storage and Session Storage to store preferences, consent, technical session data, and first-party attribution. Local Storage entries remain on your device; Session Storage entries are deleted when the browser tab is closed. Entries marked with * may be sent to our servers at registration (campaign attribution), not for anonymous visitor identification.

Legal basis for yt_consent: Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG (consent). Legal basis for bb_utm: Art. 6(1)(f) GDPR — first-party measurement, not essential under § 25(2) No. 2 TDDDG. Legal basis for all other entries: § 25(2) No. 2 TDDDG — no consent required; strictly necessary for the function requested by the user.

6. Third-Party Services

Stripe (Payment Processing)

JamBench is currently free of charge. We do not currently use Stripe for payment processing and do not store credit card numbers or bank details.

If paid plans are introduced in the future, we would use Stripe Inc., 354 Oyster Point Blvd, South San Francisco, CA 94080, USA for payment processing. You would then be redirected to Stripe for payment entry (Stripe Checkout). JamBench would not store credit card numbers or bank details; only a Stripe customer ID and Stripe subscription ID would be stored to manage the subscription. Stripe processes payment data in accordance with the Stripe Privacy Policy.

Legal basis in the event of a payment: Contract fulfillment (Art. 6(1)(b) GDPR).

YouTube API Services

JamBench uses YouTube API Services, including the YouTube Data API v3, the oEmbed API, and the IFrame Player API. We use them to check whether a video can be embedded, to look up display metadata and Made for Kids status, and to play official embeds in the app. JamBench does not use YouTube sign-in or Authorized Data (no YouTube OAuth).

Provider: Google LLC / YouTube, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. The YouTube Terms of Service and the Google Privacy Policy apply. Further detail is in the YouTube API Services Developer Policies.

YouTube (Metadata Retrieval)

When you add a song to your library, JamBench fetches metadata (video title, channel name) and status fields (for example whether the video is public, embeddable, or Made for Kids) server-side via YouTube API Services (oEmbed and Data API v3). No personal data is transmitted to YouTube in this process. We persist the YouTube URL and video ID. Title, channel name, and status flags are used in the request to identify the song and configure the player; they are not stored as YouTube API Data.

Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) — server-side request with no contact between your browser and YouTube.

YouTube (Video Player)

To play videos inside the app, the YouTube IFrame Player API is loaded. Because YouTube may set cookies on your device and collect usage data in the process, we ask for your explicit consent before loading the player. Only after you click "Allow & load video" will the YouTube IFrame API (youtube.com/iframe_api) be loaded in your browser. For videos marked Made for Kids, or when that status is unknown, we use YouTube's privacy-enhanced embed host (youtube-nocookie.com) and do not attach extra analytics to that iframe.

Your consent is stored in Local Storage under yt_consent and remains valid until you revoke it (see Section 2).

Legal basis: Art. 6(1)(a) GDPR (consent).

Anthropic (AI)

We use Anthropic (Claude, Anthropic PBC, San Francisco, CA, USA) to help identify songs when you add them. For that request we may send a YouTube video title and channel name fetched at that moment; we do not store those as YouTube API Data, and we do not send your account or profile data. Anthropic processes this in accordance with the Anthropic Privacy Policy. For transfers to the USA, Anthropic's EU Standard Contractual Clauses apply (Art. 46(2)(c) GDPR).

Legal basis: Legitimate interest (Art. 6(1)(f) GDPR).

Cloudflare Turnstile (CAPTCHA)

To protect against automated abuse, we use Cloudflare Turnstile on registration and magic-link login pages. A script is loaded from challenges.cloudflare.com and a verification token is sent to Cloudflare.

Cloudflare may process technical data (IP address, browser information) in the process. The Cloudflare Privacy Policy applies.

Legal basis: Legitimate interest in protection against abuse (Art. 6(1)(f) GDPR).

Resend (Email Delivery & Tracking)

We use Resend Inc., 2261 Market St #5665, San Francisco, CA 94114, USA to send transactional emails. Resend is used for:

• Waitlist confirmation: Double opt-in email after signing up for the waitlist
• Newsletter confirmation: Double opt-in email after subscribing to the newsletter
• Welcome email: Sent once after account registration
• Sign-in link: Magic link for passwordless authentication
• Practice reminders: Personalised re-engagement emails for registered users (reactivation)
• Daily practice plan: Optional email with your scheduled bass plan for the next day
• Account notifications: Deletion confirmation, restoration, and EU withdrawal receipts

Your email address and, where applicable, your first name are transmitted to Resend for delivery. Resend processes this data in accordance with the Resend Privacy Policy. For data transfers to the USA, Resend's EU Standard Contractual Clauses (SCCs) apply. A Data Processing Agreement (DPA) is in place with Resend.

Email open and click tracking

Our transactional emails may contain an invisible tracking pixel and tracked links. When you open an email or click a link, Resend records the event (timestamp, approximate location derived from IP address, device type) on their infrastructure. We receive only the aggregated event type (e.g. “opened”, “clicked”) — we do not store your IP address or user-agent in our own database.

The purpose of tracking is to monitor the deliverability and effectiveness of service-critical communications and to improve re-engagement emails. You can disable email tracking by configuring your email client to block remote images (which prevents the pixel from loading) and by not clicking tracked links. Reactivation emails include an unsubscribe link that opts you out of all future re-engagement emails.

Legal basis: Contract fulfillment (Art. 6(1)(b) GDPR) for the waitlist confirmation; consent (Art. 6(1)(a) GDPR) for the newsletter confirmation as part of the double opt-in process; legitimate interest (Art. 6(1)(f) GDPR) for all other service emails and for email tracking (interest: ensuring reliable delivery of service-critical communications and optimising re-engagement for existing users; outweighs the minimal privacy impact given the existing user relationship and available opt-out).

Google OAuth (Sign in with Google)

You can optionally sign in to JamBench using your Google account ("Continue with Google"). This establishes an OAuth connection to Google. In this process, Google transmits your email address and name to JamBench, provided you have consented to the transfer.

Provider: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. The Google Privacy Policy applies. For data transfers to the USA, Google's EU Standard Contractual Clauses apply.

Legal basis: Art. 6(1)(a) GDPR (consent) — use of Google OAuth is optional; you can alternatively sign in via magic link without a Google account.

Google Fonts (Local Hosting)

This site uses Google Fonts (Inter) for consistent font rendering. The fonts are downloaded at build time and served locally. No connection to Google servers is made when you visit the website.

7. Data Security & Retention

SSL/TLS Encryption

This website uses SSL/TLS encryption. All data transmissions between your browser and our servers are encrypted.

Retention Period

Your personal data is stored for as long as your user account exists and the purpose of processing continues to apply. After account deletion, all associated data is removed, unless legal retention obligations require otherwise. Specifically, the following concrete periods or criteria apply:

Account Deletion

You can schedule your account for deletion at any time in your account settings. Upon deletion, all your data is removed: profile, practice sessions, library, preferences, and internal event data. If payment data is ever processed by Stripe, it is managed by Stripe according to their retention policies.

Contact for Privacy Questions

For questions about data protection, please contact: damir@jambench.com