1. Information we collect

We collect only the information needed to provide and improve Toplinevaults:

• Account information: your email address, display name, username, profile details, and basic identity information provided when you sign in with Google, Apple, or another supported provider.
• Creative content: recordings, imported audio, lyrics, notes, project settings, artwork, and other files you choose to add to a project.
• Collaboration information: project invitations, member roles, permissions, and activity needed to keep shared projects synchronized.
• Support and content reports: contact details, correspondence, content links or identifiers, and evidence you choose to send when asking for help or reporting a copyright, privacy, or abuse concern.
• Technical information: device, app version, diagnostic, security, and service activity data needed to operate, protect, and troubleshoot the service.
• Website information: aggregated website analytics and, when you voluntarily request beta access, your email address and acknowledgement of the beta notice. We use these to send the beta link and notice and keep in touch about your launch thank-you.

2. Local and cloud storage

Toplinevaults supports local and cloud-based workflows. Content marked as local stays on your device unless you choose to upload, synchronize, share, or back it up to the cloud. Content marked as cloud-saved is transmitted to and stored with our cloud service so it can be available across your devices and to collaborators you authorize. The app may show a cloud-status indicator so you can understand where a project or file is stored.

3. How we use information

We use information to create and secure accounts; store, synchronize, and restore cloud content; enable invitations and collaboration; provide support; prevent abuse; diagnose failures; and improve Toplinevaults. When Google Sign-In is used, we use the basic profile information Google provides only to authenticate you and establish your Toplinevaults account. Toplinevaults does not request access to Gmail or Google Drive.

We may also email you tips and reminders about setting up and using Toplinevaults, based on how far you have gotten in the app and when you last opened it. We match your account to this activity using an account identifier; we do not give your email address to our analytics provider. Every such email includes an unsubscribe link, and you can turn these emails off at any time in the app under Notifications. Invitations and account emails are not affected.

4. Collaboration and sharing

When you join or share a collaborative project, its content and relevant member information are visible to the people who have access to that project according to their assigned role. Project owners and authorized members can add, edit, or remove project content as permitted by the app. Review a project’s members before uploading sensitive material.

If you enable a link that allows anyone with the link to listen, recipients may forward it to other people. Use private or invitation-based access when that is more appropriate. Changing permissions, resetting a link, or removing access can limit future access through the service, but cannot recall copies that someone has already downloaded or otherwise kept.

Sharing settings control access within Toplinevaults; they do not establish copyright ownership or obtain permission from another rights holder. Only upload or share recordings, performances, images, and personal information that you are entitled to use for that purpose. The content licence and your responsibilities are explained in our Terms of Service.

5. Service providers

We use service providers to operate Toplinevaults, including Supabase for authentication, database, synchronization, and some cloud file storage; Cloudflare for media storage and delivery; Vercel for website hosting, analytics, and performance measurements; PostHog for app usage analytics and diagnostics; Google and Apple for optional sign-in; Resend for beta and app emails; and Kit for the existing early-access mailing list. Stripe and Apple process payments where their respective purchase options are available. These providers process information for the services they supply to us and under their own applicable terms and privacy commitments.

App usage analytics use an account identifier and limited activity and diagnostic information. Our app analytics configuration does not send recordings, lyrics, project titles, filenames, or email addresses to PostHog, and session replay is disabled. Content storage and delivery providers necessarily process the files you choose to upload or share.

6. Retention and deletion

We keep information for as long as your account is active or as reasonably necessary to provide the service, protect users, meet legal obligations, and resolve disputes. You can remove local content from your device using the app and use the account-deletion option where available. You may need to delete or transfer projects you own before account deletion can complete. To request access to, correction of, or deletion of your account and cloud data, contact us at the address below. Some information may remain temporarily in backups or security records where retention is reasonably required.

Copyright, privacy, and abuse reports and related correspondence may be retained as reasonably necessary to investigate a concern, document its resolution, address repeated violations, or meet legal obligations. Deleting your account does not remove copies held independently by collaborators or other recipients.

7. Security and international processing

We use reasonable administrative and technical safeguards, including access controls designed to separate account and project data. No internet service can guarantee absolute security. Our providers may process information outside your province, territory, or country, where it may be subject to local law.

8. Your choices and rights

You may choose whether to use cloud storage, whether to join a shared project, and whether to join our mailing list. Depending on where you live, you may have rights to access, correct, export, object to certain uses of, or request deletion of personal information. Contact us to make a request; we may need to verify your identity first.

9. Children

Toplinevaults is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child has provided personal information, contact us so we can review and address it.

10. Copyright, privacy, and abuse reports

Send a report to toplinevaults@gmail.com with enough information to locate the content and understand the concern. We use the information you supply to assess the report, contact the relevant people, respond, and take appropriate action. Please send only evidence relevant to the concern and avoid unrelated sensitive personal information.

We may share relevant allegations, content identifiers, or responses with an affected user or rights holder when needed to investigate or resolve the matter, or disclose information when required by law. A report is not a public post, but we cannot promise absolute confidentiality.

11. Changes and contact

We may update this policy as the service evolves. We will update the effective date and provide additional notice when required. Questions or privacy requests can be sent to toplinevaults@gmail.com.