Privacy Policy

1. Privacy at a Glance

JamBench is a music learning platform for musicians on any instrument. We collect and process personal data solely to provide and improve our service. This privacy policy describes exactly what data we collect, how we use it, and which third-party services are involved.

2. Responsible Party & Your Rights

Responsible Party

The party responsible for data processing on this website is:

Your Rights Under GDPR

You have the following rights regarding your personal data at any time:

• Access (Art. 15 GDPR) — What data we have stored about you
• Rectification (Art. 16 GDPR) — Correction of inaccurate data
• Erasure (Art. 17 GDPR) — Deletion of your data, unless legal retention obligations apply
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR) — Receive your data in a common format
• Objection (Art. 21 GDPR) — In particular against processing based on legitimate interests

To exercise these rights, contact damir@jambench.com. You also have the right to lodge a complaint with the competent supervisory authority (Art. 77 GDPR). For Bavaria, Germany: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA).

Withdrawal of Consent

Where processing is based on your consent, you may withdraw it at any time with effect for the future. The lawfulness of processing carried out prior to the withdrawal remains unaffected.

Revoking YouTube consent: Your consent to load the YouTube player is stored in your browser's Local Storage under the key yt_consent. You can revoke this consent at any time by clearing your browser's site storage:

• Chrome: Settings → Privacy → Clear browsing data
• Firefox: Settings → Privacy → Cookies and Site Data
• Safari: Settings → Privacy → Manage Website Data

Obligation to Provide Data

Providing the mandatory information required for registration (email address and password) is necessary for the performance of the user agreement (Art. 13(2)(e) GDPR). Without this information we cannot make the service available to you. All other information is optional; not providing it has no disadvantageous consequences other than waiving the corresponding feature.

Automated Decision-Making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you.

3. Hosting & Infrastructure

JamBench is externally hosted. Personal data collected on this website is stored on the servers of the following providers:

Legal basis: Contract fulfillment (Art. 6(1)(b) GDPR) and legitimate interest in secure, fast delivery (Art. 6(1)(f) GDPR). Application data (Supabase) is stored in the EU; no transfer of personal data to third countries takes place as part of the hosting itself. Where technical administrative access by the parent company Supabase Inc. (Singapore) or by Vercel Inc. and Upstash Inc. (USA) cannot be excluded in individual cases, we rely on the providers' EU Standard Contractual Clauses (SCC) (Art. 46(2)(c) GDPR).

4. Data We Collect

Account Data

When you register for and use JamBench, we collect:

• Required: Email address, password (stored hashed by Supabase Auth)
• Profile data (optional): Username, first name, last name, city, country, profile picture, timezone, preferred currency
• Account status: whether you subscribe to JamBench+ (status, price level, end of term, Stripe customer ID, subscription ID)
• Song counter: which songs you added to My Songs, including songs you later deleted (song identifier and time only), so the free limit of three songs applies

Legal basis: Contract fulfillment (Art. 6(1)(b) GDPR).

Practice Data

When you use JamBench for practice, we store your practice sessions. This includes:

• Date, duration, and type of practice session
• BPM used, time signature, instrument
• Personal notes on sessions
• Streak data (current and longest practice streak)
• Total and weekly practice time

Legal basis: Contract fulfillment (Art. 6(1)(b) GDPR) — this data is the core of the service.

Library Data

You can build a personal library of presets, lists, and tracks in JamBench. We store:

• Preset data: title, BPM, time signature, subdivision, artist, album, genre
• Track data: YouTube URL and video ID (library pointers); JamBench song title and artist (your practice identity — not stored YouTube API metadata); sections; notes
• Lists: title, assigned presets

Legal basis: Contract fulfillment (Art. 6(1)(b) GDPR).

Calendar Sync

You can optionally generate a personal calendar subscription link (webcal URL) in the History. This link makes a read-only summary of your practice sessions available to any calendar application you choose (e.g. Google Calendar, Apple Calendar, Outlook).

The feed contains:

• Date and time of each practice session
• Duration of each session
• Activity titles (e.g. song name, exercise name)

The link is secured by a personal secret token (a randomly generated UUID). Anyone who possesses the link can access this data without logging in — we therefore recommend keeping the link private. You can revoke access at any time by regenerating the link in the History, which immediately invalidates the previous URL.

We do not receive any data from your calendar application in return — the feed is strictly one-directional (JamBench → your calendar). No data is shared with Google or any other third party; the calendar application fetches the feed from our server directly.

Legal basis: Data portability (Art. 20 GDPR) and contract fulfillment (Art. 6(1)(b) GDPR). Use of the calendar sync feature is entirely optional.

Benchmates

Benchmates are people you connect with in JamBench so you can see each other's practice activity. A connection only exists when you share your personal invite link and someone accepts it, or when you accept someone else's link. There is no public profile, no search for strangers and no leaderboard.

Connected Benchmates see about each other:

• Name, username, profile photo and instruments
• Practice time this week, the date of the last practice and whether they practiced today
• Up to five recently practiced songs (title and artist)
• Accepted challenges and progress in them
• Number of songs, setlists and completed challenges
• Since when you have been connected

Never shared, in particular: email address, login method, journal notes and tags, details and history of individual practice sessions, and settings. Individual songs or challenges cannot be hidden; the information above is always shared with all your Benchmates. This list is shown to you before every connection.

Invite page: anyone who opens your invite link sees your name, profile photo and instruments, even without signing in. The link contains a randomly generated token and cannot be guessed. You can generate a new link at any time, which immediately disables the old one. You receive an in-app message for every new connection, so nobody can connect without you noticing.

If you open an invite without being signed in, we store the link's token in a strictly necessary cookie (bb_benchmate_invite, see section 5) so the connection can be created after you sign in. We record the opening of an invite as an internal event; for visitors who are not signed in, without a user ID or any other identifier.

Anonymous song statistics: on the home page we show songs from the official JamBench catalog that at least three musicians practiced in the last 7 days, together with that number and the most recent session shown as "Someone" (minutes rounded to 5, the day only as today, yesterday or this week). Names, usernames or photos are never shown, and songs with fewer than three learners never appear. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

Ending a connection: you can remove a Benchmate at any time from their profile. Visibility ends immediately in both directions; the other person is not notified. Once your account is scheduled for deletion, your Benchmates no longer see you and your invite link stops working; at final deletion after 30 days, all connections, invite links and removal records are deleted.

Legal basis: contract fulfillment (Art. 6(1)(b) GDPR), since you activate the feature yourself by sharing or accepting a link. Using Benchmates is entirely optional.

Preferences

Your personal settings (e.g., theme, metronome configuration, benching preferences) are stored as JSON in your user profile.

Attribution Data

Upon registration, we capture UTM parameters (utm_source, utm_medium, utm_campaign, utm_content), the referring external website, and the path of the JamBench page where you clicked the sign-up link (e.g./learn/very-ape-nirvana; path only, no parameters). These values travel in the sign-up link itself and are not stored on your device. They are used for internal analysis of where new users come from and which pages lead to sign-ups, and are not shared with third parties.

Legal basis: Legitimate interest (Art. 6(1)(f) GDPR).

Internal Event Data

We log certain application events (e.g., page views, feature usage) in an internal database. This data contains your user ID, event name, page path, and a session ID. We do not use advertising trackers.

Legal basis: Legitimate interest in improving the service and understanding product adoption (Art. 6(1)(f) GDPR).

Anonymous Visitors

We do not store an anonymous visitor ID (includingbb_anon_presence_id in Session Storage) and we do not send presence heartbeats for visitors who are not signed in. We count the opening of a Benchmates invite link without a user ID or any other identifier (see Benchmates).

Anonymous page statistics on public song pages: On the public pages under /learn we count how often a page is opened, whether the sample player is started, a section is looped or the speed is changed, and whether a save / sign-up button is clicked. We store only the event name, the page path, the button position, the referring domain, coarse device and browser information, and the country our hosting provider derives from the request. We store no user or visitor ID, read or store nothing on your device, and store no IP address. The IP address is used only briefly for abuse protection (limiting requests per minute) and then discarded. The entries cannot be linked to a person.

Server Log Files

The hosting provider (Vercel) automatically collects server log data: browser type, operating system, referrer URL, IP address, and time of access. This data is not merged with other data sources.

Legal basis: Legitimate interest (Art. 6(1)(f) GDPR).

Chrome Extension (JamBench Song Looper for YouTube)

Using the extension is optional. It adds a JamBench panel below the player on YouTube video pages (youtube.com/watch) and runs on jambench.com to take over your JamBench sign-in. It does not run on other websites.

What the extension reads on YouTube:

• The video ID from the page address
• The playback state of the video (position, length, playing or paused, speed, volume), only to run loops, the section map and the practice timer
• The video's title, channel name, YouTube category, length and whether it is a live stream, as YouTube's player provides them. The extension uses these in your browser only to decide whether the video could be music. They are not sent to us.

It does not read your YouTube account, watch history, comments, search queries or other content of the page.

Stored only in your browser (Chrome extension storage):

• Song maps per video (deleted after 30 days without use)
• Practice sessions not yet saved to your account (until they are saved, at most 30 days)
• Your JamBench sign-in token and a profile snapshot for display (name, initials, profile picture address, total practice time)
• A random installation ID and panel settings (for example, whether the panel is collapsed)

Sent to JamBench (our servers, see section 3), only as far as needed:

• For videos that could be music, also when signed out: the video ID, the installation ID and the extension version, to load a suggested song map. The installation ID is used for abuse protection (limiting requests per minute). For videos that are clearly not music (for example gaming, news, sports, tech reviews, brand ads, live streams, or very short or very long videos), the extension sends nothing, and watching them does not count as practice unless you start it with a JamBench control.
• When signed in: changes to song maps of songs in your library, and practice sessions (video ID, start, end, duration, time zone). We also record which installation belongs to your account, with the extension version and the dates it was first and last used.
• Error reports: when the extension cannot find the YouTube player or video (for example after YouTube changed its page), it sends the name of the failed check, the installation ID and the extension version. No page content, no address, no user ID.
• On removal: Chrome opens a JamBench page with the installation ID so we can record that the extension was removed.

Sign-in: when you open jambench.com while signed in, the site hands the extension a sign-in token valid for up to 30 days. Logging out of JamBench invalidates it.

We do not sell this data, do not use it for advertising and do not track you across websites. The use of information received from Chrome extension APIs complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. Removing the extension in Chrome deletes the data stored in your browser.

Legal basis: Contract fulfillment for the features you use (Art. 6(1)(b) GDPR); legitimate interest in abuse protection and in keeping the extension working (installation ID, error reports; Art. 6(1)(f) GDPR).

5. Cookies

JamBench uses technically necessary cookies, Local Storage and Session Storage for sign-in, UI and cache-busting, plus consent-based YouTube / campaign storage and first-party measurement of traffic source. We donot use third-party advertising cookies and do not engage in advertising-based third-party tracking. Every public key is listed in the tables below.

Technically necessary cookies

Legal basis: § 25(2) No. 2 TDDDG in conjunction with Art. 6(1)(b) and (f) GDPR — no consent required, as these cookies are strictly necessary for technical operation and contract performance.

You can delete or block cookies in your browser settings at any time. Without the authentication cookie, sign-in is not possible.

Consent-based cookies

The following cookie is set when you explicitly agree to our Terms of Service and this Privacy Policy at registration (consent checkbox on the sign-up form). For users who are already signed in, it may also be set when they open a campaign link.

Legal basis: § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR (consent). You can delete this cookie in your browser settings at any time. Using JamBench is not affected.

First-party measurement (not essential)

The following cookies support internal campaign/traffic attribution. They are not strictly necessary cookies under § 25(2) No. 2 TDDDG and not third-party advertising cookies.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in measuring the effectiveness of our own content). Not described as strictly necessary under § 25(2) No. 2 TDDDG.

Local Storage & Session Storage

In addition to cookies, we use your browser's Local Storage and Session Storage to store preferences, consent, technical session data, and first-party attribution. Local Storage entries remain on your device; Session Storage entries are deleted when the browser tab is closed. Entries marked with * may be sent to our servers at registration (campaign attribution), not for anonymous visitor identification.

Legal basis for yt_consent: Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG (consent). Sign-up attribution needs no entry here: it is carried in the sign-up link and not stored on your device (see “Attribution Data”). Legal basis for all other entries: § 25(2) No. 2 TDDDG — no consent required; strictly necessary for the function requested by the user.

6. Third-Party Services

Stripe (Payment Processing)

We process JamBench+ subscriptions through Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Dublin 2, Ireland). When you subscribe, you are redirected to Stripe's payment page (Stripe Checkout). There you enter your payment details, name, email address and billing address; Stripe processes this data. We pass your email address and user ID to Stripe so the payment can be matched to your account.

JamBench does not store card or bank details, only the Stripe customer ID, the subscription ID, its status and the end of the term. Stripe collects the yearly renewal payments from the stored payment method. Stripe may transfer data to the USA (Stripe, Inc.); the EU Standard Contractual Clauses and Stripe's certification under the EU-US Data Privacy Framework apply. Stripe processes payment data in accordance with the Stripe Privacy Policy.

Legal basis: Contract fulfillment (Art. 6(1)(b) GDPR) and the statutory obligation to retain accounting records (Art. 6(1)(c) GDPR in conjunction with § 147 AO, § 257 HGB).

YouTube API Services

JamBench uses YouTube API Services, including the YouTube Data API v3, the oEmbed API, and the IFrame Player API. We use them to check whether a video can be embedded, to look up display metadata and Made for Kids status, and to play official embeds in the app. JamBench does not use YouTube sign-in or Authorized Data (no YouTube OAuth).

Provider: Google LLC / YouTube, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. The YouTube Terms of Service and the Google Privacy Policy apply. Further detail is in the YouTube API Services Developer Policies.

YouTube (Metadata Retrieval)

When you add a song to your library, JamBench fetches metadata (video title, channel name) and status fields (for example whether the video is public, embeddable, or Made for Kids) server-side via YouTube API Services (oEmbed and Data API v3). No personal data is transmitted to YouTube in this process. We persist the YouTube URL and video ID. Title, channel name, and status flags are used in the request to identify the song and configure the player; they are not stored as YouTube API Data.

Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) — server-side request with no contact between your browser and YouTube.

YouTube (Video Player)

To play videos inside the app, the YouTube IFrame Player API is loaded. Because YouTube may set cookies on your device and collect usage data in the process, we ask for your explicit consent before loading the player. Only after you click "Allow & load video" will the YouTube IFrame API (youtube.com/iframe_api) be loaded in your browser. For videos marked Made for Kids, or when that status is unknown, we use YouTube's privacy-enhanced embed host (youtube-nocookie.com) and do not attach extra analytics to that iframe.

The same consent covers YouTube video thumbnails. We load them directly from YouTube's image server (i.ytimg.com), which sends your IP address to Google. Without consent we show a neutral placeholder instead of the thumbnail.

Your consent is stored in Local Storage under yt_consent and remains valid until you revoke it (see Section 2).

Legal basis: Art. 6(1)(a) GDPR (consent).

Anthropic (AI)

We use Anthropic (Claude, Anthropic PBC, San Francisco, CA, USA) to help identify songs when you add them. For that request we may send a YouTube video title and channel name fetched at that moment; we do not store those as YouTube API Data, and we do not send your account or profile data. Anthropic processes this in accordance with the Anthropic Privacy Policy. For transfers to the USA, Anthropic's EU Standard Contractual Clauses apply (Art. 46(2)(c) GDPR).

Legal basis: Legitimate interest (Art. 6(1)(f) GDPR).

Cloudflare Turnstile (CAPTCHA)

To protect against automated abuse, we use Cloudflare Turnstile on registration and magic-link login pages. A script is loaded from challenges.cloudflare.com and a verification token is sent to Cloudflare.

Cloudflare may process technical data (IP address, browser information) in the process. The Cloudflare Privacy Policy applies.

Legal basis: Legitimate interest in protection against abuse (Art. 6(1)(f) GDPR).

Resend (Email Delivery & Tracking)

We use Resend Inc., 2261 Market St #5665, San Francisco, CA 94114, USA to send transactional emails. Resend is used for:

• Waitlist confirmation: Double opt-in email after signing up for the waitlist
• Newsletter confirmation: Double opt-in email after subscribing to the newsletter
• Welcome email: Sent once after account registration
• Sign-in link: Magic link for passwordless authentication
• Learning reminders, JamBench Weekly and product news: only with your consent (optional checkbox at sign-up or in your account settings)
• Contract confirmation: confirmation after subscribing to and cancelling JamBench+
• Account notifications: Deletion confirmation, restoration, and EU withdrawal receipts

Your email address and, where applicable, your first name are transmitted to Resend for delivery. Resend processes this data in accordance with the Resend Privacy Policy. For data transfers to the USA, Resend's EU Standard Contractual Clauses (SCCs) apply. A Data Processing Agreement (DPA) is in place with Resend.

Email open and click tracking

Our transactional emails may contain an invisible tracking pixel and tracked links. When you open an email or click a link, Resend records the event (timestamp, approximate location derived from IP address, device type) on their infrastructure. We receive only the aggregated event type (e.g. “opened”, “clicked”) — we do not store your IP address or user-agent in our own database.

The purpose of tracking is to monitor the deliverability and effectiveness of service-critical communications and to improve re-engagement emails. You can disable email tracking by configuring your email client to block remote images (which prevents the pixel from loading) and by not clicking tracked links. Reminder, Weekly and news emails include an unsubscribe link, and you can withdraw your consent at any time in your account settings.

Legal basis: Contract fulfillment (Art. 6(1)(b) GDPR) for the waitlist confirmation; consent (Art. 6(1)(a) GDPR) for the newsletter confirmation as part of the double opt-in process; consent (Art. 6(1)(a) GDPR, § 7(2) No. 2 UWG) for learning reminders, JamBench Weekly and product news; contract fulfillment (Art. 6(1)(b) GDPR) for the purchase confirmation, the welcome email, sign-in links and account notifications; legitimate interest (Art. 6(1)(f) GDPR) for email tracking (interest: ensuring reliable delivery of service-critical communications and optimising re-engagement for existing users; outweighs the minimal privacy impact given the existing user relationship and available opt-out).

Google OAuth (Sign in with Google)

You can optionally sign in to JamBench using your Google account ("Continue with Google"). This establishes an OAuth connection to Google. In this process, Google transmits your email address and name to JamBench, provided you have consented to the transfer.

Provider: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. The Google Privacy Policy applies. For data transfers to the USA, Google's EU Standard Contractual Clauses apply.

Legal basis: Art. 6(1)(a) GDPR (consent) — use of Google OAuth is optional; you can alternatively sign in via magic link without a Google account.

Google Fonts (Local Hosting)

This site uses Google Fonts (Inter) for consistent font rendering. The fonts are downloaded at build time and served locally. No connection to Google servers is made when you visit the website.

7. Data Security & Retention

SSL/TLS Encryption

This website uses SSL/TLS encryption. All data transmissions between your browser and our servers are encrypted.

Retention Period

Your personal data is stored for as long as your user account exists and the purpose of processing continues to apply. After account deletion, all associated data is removed, unless legal retention obligations require otherwise. Specifically, the following concrete periods or criteria apply:

Account Deletion

You can schedule your account for deletion at any time in your account settings. Upon deletion, all your data is removed: profile, practice sessions, library, Benchmates connections, preferences, and internal event data. Contract and invoice data for JamBench+ are excepted: we keep them for 10 years under statutory retention obligations (§ 147 AO, § 257 HGB); Stripe manages its payment data under its own retention policies.

Contact for Privacy Questions

For questions about data protection, please contact: damir@jambench.com