Privacy Policy

What we collect

Account and profile. Your email address, name, and whatever you choose to add to your profile: photo, city and country, discipline, bio, links, interests. The profile fields are optional; the email address is required because it is how you sign in.

What you make and do here. Posts, replies, messages, listings, shared resources, featured works, song submissions, class enrollments, connections, and similar activity. Direct messages are stored so they can be delivered and shown to you and your recipient; we do not read them except where required to investigate abuse.

Purchases. A record of what you bought, when, and for how much. Payments are processed by Stripe; your card number never touches our servers and we cannot see it.

Sign-in and activity records. When you sign in and which days you visit, so we can understand whether the Commons is alive and being used. System logs (such as IP addresses in hosting logs) exist for operation and security, as with any website.

Analytics, without cookies

We use PostHog, hosted in the European Union, to understand how the site is used: which pages get visited, how long people actively spend on them, and where the signup and checkout flows lose people. It runs without storing analytics cookies or identifiers on your device. When you are signed in, this usage is linked to your account, because “does this member actually use what they paid for” is a question we need to answer honestly. Staff accounts are excluded so our own clicking does not distort the numbers.

Session replay on payment pages. On the pages where people decide whether to pay (the subscribe, membership, and class pages) we may record a replay of how the page was used: scrolling, clicking, hesitating. Text you type is masked, and card entry happens on Stripe’s pages, which we cannot record. We use these replays to find confusing checkout steps, nothing else.

Email

We send sign-in links, purchase confirmations, and access notices through Resend. These are transactional: they exist so the product works. Optional notification emails are controlled by you in your settings, and anything resembling marketing is opt-in and can be objected to at any time, no justification needed.

Where your data lives

We use a small set of service providers as data processors: Vercel (hosting), Neon (database), Upstash (caching), Stripe (payments), Resend (email), Mux (video), Pusher (realtime delivery), and PostHog EU (analytics). Each processes data only to provide its service to us. Some of these providers operate in the United States, so using the Commons involves transferring data there; where European data protection law applies, these transfers rest on the providers’ standard contractual safeguards.

How long we keep things

Analytics and replay data is kept only as long as it remains useful for understanding how the Commons is used. Your account, content, and purchase records are kept for as long as your account exists, and purchase records as long as tax and accounting law requires. If you delete your account, your profile and personal details are scrubbed; some content may remain in anonymized form so conversations other members took part in still make sense.

Your rights

You can ask us at any time to: access a copy of your data, correct it, delete it, restrict or object to its processing, receive it in a portable format, or withdraw a consent you previously gave. Where processing rests on our legitimate interests you may object on grounds relating to your situation; for anything resembling direct marketing you may object unconditionally. You can also lodge a complaint with your data protection authority.

Requests are free, go to privacy@foundsoundnation.org, and we answer as quickly as a small team can, within whatever timelines the law requires.

Legal bases

Where European data protection law applies, we process personal data because: it is necessary to provide the service you signed up for (account, content, purchases, transactional email); we have a legitimate interest in understanding and improving the Commons (analytics, security, logs); the law requires it (payment records); or you have consented (anything optional, which you may withdraw).

Personal data may also be used to establish or defend legal claims or where public authorities lawfully require disclosure.

Changes and small print

If this policy changes in a way that matters, we will note it here, and ask for consent again where the law requires it. The date at the top is the date of the last change. This site does not respond to browser “Do Not Track” signals; our answer to tracking is the cookieless setup described above. This policy covers Found Sound Commons only, not other Found Sound Nation sites or programs.