Privacy Policy

Plugd In is a professional network for musicians and creatives, made by Plugd In Network LLC in Atlanta, Georgia. This policy covers the Plugd In mobile app and this website, plugdin.net. It explains what we collect, why, who can see it, who handles it for us, how long we keep it, and what you can do about it.

What we collect

You give us, in the app

• Email and password, to create and secure your account. Passwords are stored only as a cryptographic hash; nobody can read them, including us.
• Date of birth, collected at signup because the law requires it. We refuse accounts for people under 13, and for ages 13 to 17 we restrict who can send you direct messages. Your date of birth is private. It is never shown on your profile, never visible to other users, and other people cannot tell from the app whether an account belongs to a minor.
• Profile information: display name, handle, headline, bio, location (a city you type, never read from your device), skills, experience, niches, and collaboration status.
• Content you post: posts, audio clips, comments, discussions, replies, projects, endorsements, and credits.
• Direct messages: the messages you send and receive.
• Split sheets: song title, contributor names and roles, ownership percentages, and optionally PRO affiliation, IPI number, and publisher. If you sign one, we also record when you consented to sign electronically (and when you withdraw that consent), and which consent each of your signatures was made under.

Generated by using the app

• Profile views. When you view someone's profile we record it so they can see their view count, at most once per person per day. If they have Plugd In Plus, they can also see that it was you, how many days you visited in a period, and audience summaries (for example, which niches their visitors work in), unless you browse incognito. An incognito visit is only ever counted, never shown, and never used in a summary. Summaries only show groups of 3 or more people.
• Play counts. How many times a clip has been played, kept as a running total and as a daily total per clip. We do not store who played what. To stop counts being inflated, we keep how many plays an account started in the current hour (not which clips) and delete that after a day. Your own plays of your own clips are not counted.
• Press kit activity. Anonymous daily counts of visits, clip plays, and button taps on your public press kit, split only into "signed in" and "not signed in". No IP address, device identifier, cookie, or visitor identity is stored for this.
• Opportunity activity. When an opportunity listing is shown to you in the app we record the listing's ID, so its poster can see how many people saw it. Posters with Plus see a count, never who. If you have Plus and save an opportunity search, we store the filters you chose and which new listings matched it, so we can tell you about new matches.
• Likes, saves, follows, connections, blocks and reports: the actions themselves.
• Notifications: records of things that happened to you in the app.
• Usage events. A short record of certain actions in the app, like signing up, finishing onboarding, publishing a clip, or reporting something, with your app version and platform (iOS or Android). They are linked to your account so we can tell whether the app is working. They never contain the text of what you write or the audio you upload, and they go only to our own database. Deleting your account deletes them.
• Subscription status. If you open Plugd In Plus, subscribe, or restore a purchase through the App Store or Google Play, our subscription provider RevenueCat links the purchase to your account's random ID and tells us about it: the plan, the store, the price and currency, the country, purchase and expiry dates, and the store's transaction identifiers. We use this only to switch Plus on and off and to show you your subscription status. We also record steps like opening the Plus screen or starting, finishing, or cancelling a purchase, with a general reason if something failed, never payment details or receipts.
• Crash and error reports, only if switched on. The app includes Sentry, an error-reporting tool. It sends nothing unless we turn it on for a release. When it is on, a crash or error report includes the device model, operating system and app version, a short trail of the screens and taps that led to the problem, and timing information. It is set up not to include your name, email, messages, the content you post, request bodies, cookies, sign-in tokens or file links, and it is not linked to your account.

From this website

• Contact form. If you send us a message we keep your email address, the name you give (optional), the topic you chose, your message, and when you sent it.
• Deletion requests. If you ask us to delete an account through the website we keep your email address, the @handle you give (optional), any details you add, when you sent it, and where we are in handling it.
• Abuse prevention. With each form we keep a one-way code made from your IP address with a secret key (an HMAC), never the IP address itself, so we can limit how often one connection can send forms. That code cannot be turned back into your IP address.
• Hosting logs. Our website host, Vercel, receives your IP address, browser type, the page you asked for and the time, as any web server does, and keeps them for a limited time under its own policy for security and to keep the site running.

We do not collect

No advertising or device identifiers. No precise or approximate location from your device. No push notification tokens (the app has no push notifications). No third-party analytics or advertising tools, in the app or on this website. No browsing activity outside Plugd In. No card numbers or bank details: Apple and Google take payment, not us. No biometric data. No contacts or address book.

Cookies and local storage

This website sets no cookies and stores nothing in your browser. It loads nothing from other companies' servers and runs no analytics or tracking scripts, so there is no cookie banner.

The app keeps a sign-in session token on your device so you stay signed in between launches. Beyond that, it keeps only temporary working files for something you asked it to do, like a copy of a track you picked to upload, in the app's cache. The token is strictly necessary to provide the service you asked for, so under EU ePrivacy rules we do not need your consent to store it, but we are telling you here anyway.

Do Not Track. Because we do not track you across other apps or websites, there is nothing for a "Do Not Track" signal to switch off, so we do not treat one differently.

Who can see what

If you set your profile to Private, your profile, posts, clips, and discussions become visible only to people you have accepted a connection with. Following you is not enough.

Incognito browsing. If you turn it on, people whose profiles you view cannot see that it was you, and we enforce that technically, not just visually: the app cannot retrieve the identity of an anonymous viewer at all.

Why we collect it

We use your information to run the service: show your profile, deliver your posts to the right feeds, let people message you, keep the community safe, and meet legal obligations like the age rule. We use contact messages only to answer you, and deletion requests only to confirm who you are and delete the account. That is the whole list.

We do not use your information for advertising.

Legal bases (UK and EU users)

We do not rely on consent for anything in this policy. If we ever add third-party analytics or marketing, we will ask first.

Who handles it for us

We share your information only with the service providers that run Plugd In, who handle it on our behalf, and with others only where the law requires it:

• Supabase (and Amazon Web Services beneath it): our database, sign-in, file storage, and server functions, including the website forms. All app data and form submissions are stored here, in the United States (AWS us-east-1).
• Vercel: hosts this website. It receives the hosting log information described in section 1. Its servers are in the United States and other countries.
• RevenueCat: manages Plugd In Plus subscriptions. If you open Plus, subscribe, or restore a purchase, it receives your account's random ID (not your name or email) and the purchase details the App Store or Google Play reports. If you never open Plus, RevenueCat never receives your account ID. Its servers are in the United States.
• Sentry: receives the crash and error reports described in section 1, only if we switch it on for a release. Its servers are in the United States.
• Our email providers: when you email support@plugdin.net or dmca@plugdin.net, the message is forwarded by our domain registrar to the inbox we read it in.
• Apple and Google: app distribution and, if you subscribe, payment. They do not receive your Plugd In data from us.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

When you paste a music link into a credit, the app asks that platform (YouTube, Spotify, or SoundCloud) for the track's title so we can fill it in for you. That request tells the platform your IP address at that moment. If you would rather not, do not paste the link; the credit works without it.

We may also disclose information if we are legally required to, or where necessary to protect someone's safety.

Other people's information

If you add a collaborator to a split sheet who is not on Plugd In, you may enter their name and email address. Only enter someone else's details if you have their permission. We store that information to produce the split sheet record and for no other purpose. We do not market to them and we do not create an account for them.

How long we keep it

App information is kept until you delete your account. There is no automatic expiry before then.

When you delete your account (Settings, Delete account) we permanently delete, straight away: your account, sign-in and email address; your profile, @handle, settings and date of birth; your clips and posts, including the audio files themselves, and other people's comments, likes and saves on them; comments you wrote anywhere; your likes, saves, follows, connections and blocks; collab applications you made; credits you claimed; endorsements and awards you received; notifications sent to you; views of your profile; your usage events, saved searches and press-kit counts. This cannot be undone.

Some things stay, no longer linked to your account, because other people rely on them or because we must keep them. The text in them stays as it was written:

• Discussions you started, and your replies, so other people's replies survive. The author is shown as @deleted.
• Messages you sent, which stay in the other person's conversation, shown from "Deleted account".
• Endorsements you wrote, awards you gave, and credits you confirmed or that name you. A credit that names you keeps the name the other person typed.
• Split sheets you are on, draft or finalized, with the name you were listed under and your typed signature, because a signed record has to stay readable for the other contributors, along with the record of your consent to sign electronically.
• Projects and events you created.
• Your visits to other people's profiles, which still count toward their view total but no longer point to you.
• Reports you filed, moderation records, and beta feedback, so the team can still act on them and show how a complaint was handled.
• Plus purchase records, because tax and accounting rules and payment disputes can require them. They hold no name or email, only the store's purchase details and the random account ID they were made under, and we keep them only as long as those obligations last (generally up to seven years).

If Plus ends, nothing is deleted: your history, analytics, and saved searches stay (saved searches stop alerting), and a boosted post leaves the Plus rotation. They come back if you subscribe again, and they are deleted with your account.

Website information:

• Contact messages are kept for 12 months after you send them.
• Deletion requests are kept for 24 months, as a record that we handled them.
• Rate-limit codes (the one-way codes in section 1) are deleted after 2 days.

Backups. Our database provider keeps encrypted backups, so deleted information can remain in them until those backups expire, within seven days.

Your rights

Wherever you live, you can:

• Access a copy of your data
• Correct it (most of it directly in the app)
• Delete your account and data, in the app under Settings, Delete account, with no email needed, or through the request form on our Delete your account page if you cannot open the app
• Object to or restrict how we use it
• Take it with you: we will provide a machine-readable export

How to exercise them: email support@plugdin.net from the address on your account (or the address you used on the website). We respond within 30 days (45 for California requests, extendable where the law allows). For an export, see section 9. To delete an app account, the in-app button is immediate and is the surest way for us to know the request came from you; a website request is confirmed by email before anything is deleted.

UK and EU residents can also complain to their data protection authority. California residents can ask what we collect and why, ask us to delete or correct it, and limit use of sensitive personal information. We will not discriminate against you for exercising any right.

If you are in the European Economic Area or the UK

Plugd In Network LLC is the data controller for the information you provide and that the app and website generate about your use of them. The purposes and legal bases are in section 4.

Where your data lives. With Supabase (our database and storage provider), Vercel (website hosting), and, only if you open or subscribe to Plugd In Plus, RevenueCat, and, only if switched on, Sentry. These providers store data in the United States. Because that is a transfer of personal data outside the EEA and UK, we rely on the Standard Contractual Clauses (and, for UK users, the UK's approved equivalent) in our providers' data processing agreements (see section 12), and we send only what is needed.

Your rights. Beyond the list above, you can object to processing based on our legitimate interests, restrict processing in certain circumstances, and withdraw consent where we rely on it. You can lodge a complaint with your local data protection authority (find yours at edpb.europa.eu) or, in the UK, the Information Commissioner's Office at ico.org.uk. Because our processing for people in the EEA is incidental rather than targeted or large scale, we have not appointed an Article 27 EU representative. Contact us directly at the email below and we will respond within 30 days.

If something goes wrong. If we experience a data breach that risks your rights or freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and notify you directly without undue delay if the risk to you is high.

Automated decisions. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. The automated checks we run (the word filter described in our Terms, limits on how quickly an account can post, and the website form checks) only stop a single action, and you can rephrase or try again later.

Getting a copy of your data

Email support@plugdin.net with the subject "Data export" from your account's email address. We will send a JSON file containing your profile, posts, clips, comments, discussions and replies, messages you sent, split sheets you are party to, credits, connections, follows, settings, and your date of birth, within 30 days.

We may ask you to confirm the request from your account email before sending it, because sending someone's data to the wrong person is worse than sending it late.

Children

Plugd In is not for children under 13. We refuse those accounts at signup, and this website is not directed to children under 13. If you are 13 to 17, only people you have accepted a connection with can send you direct messages. Strangers cannot, including through an open collaboration post, and the app does not show other people that an account belongs to someone under 18.

If you believe a child under 13 has created an account or sent us a form, email support@plugdin.net and we will delete it.

Security

Access to app data is enforced by database-level row security rather than by the app alone, so the rules hold even if someone bypasses our interface. The website forms cannot read or change stored data at all: they can only send a new submission, which our server checks before storing. Passwords are hashed. Traffic is encrypted in transit. Private data (messages, date of birth, split sheets, reports, and form submissions) is restricted to the people who should see it, at the database.

No service is perfectly secure, and we will not pretend otherwise. If we discover a breach affecting your personal data, we will notify you and the relevant regulator as required by law.

International transfers

Your data is stored in the United States. If you are in the UK or EU, that is a transfer outside your jurisdiction; we rely on the Standard Contractual Clauses in our providers' data processing agreements (Supabase, Vercel, RevenueCat for Plugd In Plus, and Sentry when switched on), and, for UK users, the UK's approved equivalent.

Changes

If we change this policy, we post the new version here with a new effective date. If a change materially affects you, we will tell you in the app before it takes effect.

Contact

Plugd In Network LLC (a Georgia limited liability company) · support@plugdin.net · 8735 Dunwoody Place Ste N, Atlanta, GA 30350