Privacy policy
Draft: this text describes how the app actually works but has not been reviewed by a lawyer yet.
1. Controller
Marius Gröh
c/o POSTFLEX PFX-962-271, Emsdettener Straße 10, 48268 Greven, Germany
Email: support@sessionmates.app
Contact form: sessionmates.app/support
2. In short
Sessionmates is an iPhone app for songwriters, producers, artists and music publishers to find each other, chat and plan sessions. This policy covers the app and this website. We do not sell data and use no advertising trackers and no analytics services.
3. Data in the app
3.1 Account
Email address, password (stored only in encrypted form) and your confirmation that you are at least 18. Purpose: sign-in, account security, confirmation and password emails. Legal basis: Art. 6(1)(b) GDPR (contract).
3.2 Profile
What you enter yourself: name, photo, bio, home city, roles, genres, instruments, strengths, languages, how you work, experience, publishing status, background and links. Complete profiles are visible to other signed-in users. Legal basis: Art. 6(1)(b) GDPR.
3.3 Stays and approximate location
Where and when you are available (city, dates, free days, “Available now”). If you use “approximate location” and allow it, your iPhone determines your position; we only store a position rounded to about 1 km or the nearest city. Others only see the city and an approximate distance, never an exact position. Legal basis: Art. 6(1)(b) GDPR; for location access your consent (Art. 6(1)(a)), which you can withdraw in the iPhone settings.
3.4 Messages, chats and attachments
Contact requests, chat messages, voice messages, photos, videos, documents, reactions, replies, read receipts, online status and typing indicator (the last three can be switched off). Content is only visible to the members of the chat. Your iPhone asks for permission before microphone, camera or photo access. Legal basis: Art. 6(1)(b) GDPR.
Link previews: when you write a link, your iPhone loads title and image directly from the linked website, which receives your IP address. GIFs and stickers: search terms and IP address go to GIPHY (see section 5).
3.5 Sessions and songs
Proposals, times, time zones, place and studio address (visible to the others only once confirmed), private details, open calls and applications, group pictures; for songs: title, status, audio file, lyrics, credits and splits. Visible to the participants of the session. The place search uses Apple Maps on your iPhone (search terms go to Apple). Legal basis: Art. 6(1)(b) GDPR.
3.6 Publisher features
Music publishers can find, message and invite writers to their roster unless the writer switched this off (“Visible to publishers”). If you accept a roster invitation, your profile shows “Published by …” and the publisher sees the songs from your sessions (including audio, lyrics and credits) and can export them. For camps and sessions a publisher organises, the publisher sees the songs made there. Legal basis: Art. 6(1)(b) GDPR.
3.7 Safety and moderation
Blocks, reports (with reason and, where relevant, a message excerpt) and moderation decisions, to protect users and enforce the terms. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a safe platform).
3.8 Push notifications
If you allow it, we store a device token to notify you about new messages, requests and sessions, sent via Expo’s push service and Apple Push Notification service (sender name and a short text). Legal basis: consent (Art. 6(1)(a) GDPR); switch off in the app or iPhone settings.
3.9 On your device
Stored only on your iPhone (not with us): sign-in state, light/dark setting, “recently viewed” in the people search and hints you dismissed.
3.10 App updates
The app downloads updates from Expo; technical data such as IP address, app version and device type are transmitted. Legal basis: Art. 6(1)(f) GDPR.
4. This website
Our host Cloudflare processes technically necessary data (IP address, time, page, browser) in server logs to deliver the site and protect it from attacks. Legal basis: Art. 6(1)(f) GDPR. No cookies, no analytics, no third-party content (fonts are hosted by us).
Contact form: name, email, topic and message are forwarded to us by email (via Resend) to answer you. Legal basis: Art. 6(1)(b)/(f) GDPR. We delete requests once they are resolved and no retention duty applies.
5. Service providers
- Supabase (USA) – database, sign-in, file storage. Server location: EU (Ireland).
- Resend (USA) – emails.
- Expo / EAS (650 Industries, USA) – push notifications and app updates.
- Apple – App Store, TestFlight, push service, Apple Maps; mailbox (iCloud Mail) for messages to support@sessionmates.app.
- GIPHY (USA) – GIF and sticker search (only when you use it).
- Cloudflare (USA) – hosting of this website.
Data processing agreements under Art. 28 GDPR are in place or being concluded. Transfers to the USA rely on the EU-US Data Privacy Framework where the provider is certified, otherwise on EU standard contractual clauses.
6. Retention
- We keep your data while your account exists.
- Chats you delete stay in “Deleted chats” for 30 days and are then emptied for you.
- If you delete your account (Profile → Settings → Delete account), your profile, stays, photos and settings are deleted. Messages you sent remain visible to the recipients without your name (“Deleted account”), so their chat history stays complete.
- Reports and moderation decisions are kept as long as needed to protect users. Closed reports are deleted no later than 12 months after the decision.
7. Your rights
You have the right of access, rectification, erasure, restriction, data portability and to object (Art. 15–21 GDPR), and you can withdraw consent at any time. Much of this works directly in the app (edit profile, Settings → Export my data, delete account). For anything else, write to us. You may lodge a complaint with a data protection authority, e.g. the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).
8. Minimum age
Sessionmates is only for people aged 18 and over.