Privacy Policy

This policy explains what personal data Gostudios LLC collects when you use CheckTunes (the “Service”), why, and the choices you have. It covers both your account data and the creative material you store (“Your Content”).

What we collect

• Account data: your email address and a hashed password (handled by our authentication provider, Supabase Auth), and your artist profile (name, timezone, genres) once you complete onboarding.
• Your Content: the projects, releases, songs, lyrics, tasks, contacts, rights and split records, budget entries, and files you create or upload.
• Billing data: if you subscribe, our payment processor (Stripe) collects and holds your payment details. We store only a Stripe customer/subscription reference, the plan, and its status — never your card number.
• Product analytics: a small set of first-party events (sign-up, email confirmed, onboarding completed, checkout started, paid conversion) tied to your account ID, used to understand activation and conversion. No third-party advertising or tracking cookies.
• Operational logs and error reports: bounded technical records (timestamps, error codes, the feature involved, your account ID). We do not put Your Content in logs. Crash reports go to our monitoring provider, Sentry.

How AI processing works

When you run an AI assistant action, we send our AI provider (OpenAI) a limited, structured summary of the one project you are working on: titles you chose, counts, dates, statuses, and the readiness numbers the app already computes. Campaign suggestions also include the marketing choices you made for that release (goals, song focus, planned ideas). We deliberately do not send your lyrics, file contents, saved notes or drafts, contact names or emails, or identifiers such as ISRC/UPC. Text you type into an assistant request box is sent with that one request. OpenAI processes the request to return a result and, per its API terms, does not use it to train its models. AI features are optional; if you never use them, nothing is sent.

Why we can use your data (legal bases)

• To provide the Service you asked for — performance of our contract with you (account data, Your Content, billing).
• Legitimate interests — keeping the Service secure, preventing abuse, and understanding aggregate product usage.
• Legal obligation — keeping limited billing/tax records.

Sharing

We do not sell your personal data or Your Content. We share data only with the processors that run the Service on our behalf, under contract:

• Supabase — database, authentication, and file storage hosting.
• Stripe — subscription billing and payment processing.
• OpenAI — AI assistant responses (only the limited summary described above, and only when you use an AI feature).
• Sentry — error monitoring.
• Vercel — application hosting.
• Cloudflare Turnstile — bot protection on the sign-up, sign-in, and password-reset forms.

We may also disclose data if required by law, or to protect the rights, safety, or property of our users or us.

Storage and security

Data is stored on our providers’ infrastructure and may be processed in the regions where those providers operate. Access is protected by per-user row-level security and private, owner-scoped file storage; private files are served only through short-lived signed links. See our security practices for more.

Retention

• Account data and Your Content are kept while your account is active.
• After you delete your account we delete or de-identify your data within 30 days, except limited billing records we must retain for tax and accounting (typically up to 7 years).
• Operational logs are kept for a short rolling window.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can edit your profile and delete your content in the app; for anything else, contact nunu.blur.ops@gmail.com and we will respond within the time the applicable law requires. You may also complain to your local data-protection authority.

Children

The Service is not directed to children under 16 and we do not knowingly collect their data.

Changes

We may update this policy. Material changes will be notified by email or in the app before they take effect. This version is governed by the laws of the State of Georgia, USA.

Contact

Privacy questions or requests: nunu.blur.ops@gmail.com.