Privacy Policy

1. Who is responsible for your data

The controller of your personal data is Tomáš Urban (“we”). For anything related to your personal data, write to tomurban@tomurban.one.

2. What we collect

Depending on how you use the site, we process:

• Account data — your e-mail address, a password (stored only as a secure hash, never in readable form), and optionally your first and last name, date of birth, gender, profile photo and where you listen to music (the platform, optionally a short note). Your full name, date of birth, gender and platform are seen by the author only; other signed-in fans see just your first name with the initial of your surname (“Jan N.”) and your photo next to comments and dedications.
• Preferences — interface language and theme, stored in your browser and on your account, and your time zone, which we read automatically from your browser settings at sign-up and sign-in (you can change it in your profile) so that scheduled e-mails, such as a birthday wish, arrive in your morning.
• Purchase records — if you buy something, payment is handled by Stripe; we never see or store your card number. We keep a record of what you purchased and its status.
• Security records — IP address and browser identification in sign-in protection, on requests for verification and password-reset e-mails, and in the administrative audit log (what changed, when and from where). On an anonymous visit through a sharing link the IP address is kept for one hour as a hash only, so the visit is counted once; it is not written anywhere.
• Notifications inside the app — to you about your account, to the author about activity on the site (see below).
• Email interaction: whether a message we sent you was opened and which links in it you followed. We record this with an invisible image and by routing links through our own address. You can ask us to stop at any time, and we do not use it for advertising or profiling.
• Community content — comments you post under songs (published only after the author approves them), messages you write in the private chat with the author, and the songs you mark as favorites. Approved comments are shown to other signed-in fans with your first name, the initial of your surname and your photo; chat messages are seen only by you and the author; favorites only by you.
• Sharing link — every account carries an opaque sharing code. When someone opens the site through your link, we count the visit and, if they create an account, we record that you invited them (the invited account stores a reference to yours). You see counts only; the author sees in the administration who invited whom. The code carries no personal data and is not passed to traffic measurement.
• Dedications — the author may dedicate a song to you; the dedication shows your first name with the initial of your surname and your profile photo to signed-in fans. You can ask for its removal at any time.
• Alerts for the author — when you register, post a comment or a chat message, or switch the news on or off (including any reason you give when unsubscribing), the author receives an alert in the administration and by e-mail with your name, e-mail address and a preview of the text. If he has phone alerts switched on, a short ping also reaches him through the Telegram app, carrying only your display name (“Jan N.”) — never your e-mail or the message text.
• The sign-in form can, if you ask it to, remember the e-mail address you last used; it is stored in your browser only.

3. Why we process it

Each purpose has its legal basis under the GDPR; how long we keep the data for each purpose is listed in section 6.

• Providing the service you signed up for — accounts, sign-in, purchased content. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Keeping accounts and content secure and preventing abuse — sign-in protection and the administrative audit log. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).
• Meeting legal obligations, such as accounting records for purchases. Legal basis: legal obligation (Art. 6(1)(c) GDPR).
• Sending you email news for fans — new music and releases, and in future other offers for fans such as courses — only while your news preference is switched on. Legal basis: our legitimate interest in direct marketing to our own fans (Art. 6(1)(f) GDPR, recital 47). You can object at any time and we stop immediately: every news email carries a one-click unsubscribe link, and the same switch is in your profile. The news include a short welcome series after you verify your account and a birthday wish if you filled in your date of birth.
• Anything we explicitly ask your consent for. Legal basis: consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
• Measuring site traffic with Google Analytics — which pages and songs are read and played, where visitors come from. Legal basis: consent (Art. 6(1)(a) GDPR), given in the cookie banner and withdrawable at any time via “Cookie settings” in the footer. Nothing is measured without consent.
• Running the community features you use — comments, the private chat, favorites, the sharing link and dedications. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Moderation of comments and chat rests on our legitimate interest in keeping the site civil (Art. 6(1)(f) GDPR).
• Alerting the author to activity on the site and moderating comments and chat — so he can respond quickly and keep the site civil. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).

4. Cookies

We use cookies and browser storage that the service needs to work or that keep a choice you made yourself, and — with your consent — the analytics cookies of Google Analytics:

We use no advertising cookies. The analytics cookies are set only after you choose “Accept all” in the cookie banner or switch analytics on in the settings; until then nothing measuring is stored in your browser and no request leaves for Google's servers. Rejecting has no effect on how the site works, and you can change your choice at any time via the “Cookie settings” link in the footer. We remember a consent for 12 months and a refusal for 6 months, then we ask again.

• auth_access — signs you in; httpOnly (inaccessible to scripts on the page), technical, expires after 15 minutes.
• auth_refresh — keeps you signed in between visits; httpOnly, technical, expires after 30 days.
• to-locale and NEXT_LOCALE — remember the language you chose; technical preference, kept for 1 year (when set by the server, only until you close the browser).
• to-profile-prompt-snoozed — remembers that we recently asked you to complete your profile so the window does not keep coming back; technical, kept 24 hours.
• to-consent — remembers your choice in the cookie banner (consent or refusal); technical, kept 12 months after consent, 6 months after refusal.
• _ga and _ga_<id> (Google Analytics) — only with your consent; a random browser identifier that tells visits and sessions apart, kept 2 years. Google Analytics 4 does not store IP addresses, and the data is not linked to your account.
• localStorage to-theme-color, to-theme-mode, to-left-menu-type and to-content-type — interface preferences (theme and layout), stored in your browser until you clear them.
• localStorage to-remembered-email — the e-mail address from the sign-in form, only if you chose to have it remembered; stored in your browser until you clear it.
• sessionStorage to-ref and to-ref-visited — the sharing code of the link that brought you here, so that a sign-up is credited to the fan who invited you; only until you close the browser tab.

5. Who we share data with

We never sell or rent your personal data. It is shared only with providers we need to run the service:

• Our hosting provider (server operations).
• Stripe (payment processing) — see stripe.com/privacy.
• The e-mail mailbox provider (SMTP) through which we send every e-mail — account e-mails and news alike; like any mail server it sees the recipient address and the message content.
• Google Ireland Limited / Google LLC (Google Analytics 4) — traffic statistics, only if you consented in the cookie banner; Google processes the data as our processor under the Google Ads Data Processing Terms, and the transfer to the USA is covered by the EU–US Data Privacy Framework. See policies.google.com/privacy.
• Telegram (Telegram FZ-LLC, United Arab Emirates) — only if the author has phone alerts switched on: a short message with your display name (“Jan N.”), without your e-mail and without any text. It is the only piece of data that leaves the EU through this channel; we rely on our legitimate interest in being informed promptly about activity on the site.
• Some of these providers may process data outside the EU (typically in the USA). Such transfers are covered by the European Commission's standard contractual clauses or an adequacy decision (such as the EU–US Data Privacy Framework).

6. How long we keep it

How long we keep data depends on its purpose:

• Account data — for as long as your account exists. Ask for deletion by e-mail; we handle it within 30 days and your comments, chat messages, favorites, dedications and referral records go with the account (except records we must keep by law, such as purchase and tax records). Records of sent e-mails and audit records live out their own periods listed below.
• Sign-in protection records — sign-in attempts expire within minutes; records of requests for verification and password-reset e-mails (including the IP address) are deleted 30 days after the link expired; refresh tokens are deleted as soon as they expire (30 days).
• Administrative audit log — what changed, when, from which IP address and browser, the e-mail address at registration and the reason given when unsubscribing from the news; kept long-term so that security-relevant actions remain traceable.
• Server backups, where made — 30 days at most.
• Sent emails and their open and click records: 12 months, then deleted automatically.
• Comments, chat messages, favorites and referral records — for as long as your account exists; deleting the account deletes them. You can delete your own comments at any time.
• Traffic statistics in Google Analytics — 14 months at the level of individual events, aggregated reports afterwards.
• Payment records received from Stripe — for as long as accounting and tax law requires.

7. Your rights

Under the GDPR you can at any time:

• Ask what data we hold about you and get a copy (access, portability).
• Have incorrect data fixed (rectification).
• Have your data deleted or its processing restricted.
• Ask us to delete your account — an e-mail from the account address is enough; we delete it within 30 days.
• Object to processing based on legitimate interest. For news emails the objection is unconditional: use the unsubscribe link in any of them or the switch in your profile, and no further news will be sent.
• Withdraw any consent you have given, at any time, with effect for the future.
• Complain to a supervisory authority — in the Czech Republic the Office for Personal Data Protection (uoou.gov.cz), or the authority in your country.

8. How we protect it

All traffic is encrypted (TLS). Passwords are stored only as strong hashes. Administrative actions are recorded in an audit log, and access to production data is restricted.

9. Age of users

The site and its accounts are meant for people aged 15 or over — the age from which a person can validly consent to data processing by online services in the Czech Republic. We do not knowingly collect data of younger children. If we learn that a child under 15 has created an account, we delete the account and its data. Parents and guardians can reach us at tomurban@tomurban.one.

10. Changes to this policy

If this policy changes, the new version will be published here with an updated date. Substantial changes will be announced to registered users.