Privacy Policy
Effective date: June 28, 2026
This policy explains what data GND Lift collects, how we use it, and your rights. We've written it in plain language — if anything is unclear, email us at legal@gndlift.com.
1. What we collect
Account information
When you sign in with Google, we receive your name, email address, and Google profile photo. We store your email address to send you notifications and to identify your account. Your Google profile photo is offered as a default avatar but is not stored unless you explicitly save it.
Profile data
Everything you enter on your profile: display name, username, bio, city and state, instruments, genres, gear, availability status, and what you're looking for. This information is public by default and visible to all visitors.
Content you upload
Profile photos and band images you upload are stored and served via Supabase Storage. We don't host audio or video — you link to your work on Spotify, SoundCloud, YouTube, or similar platforms instead. You control whether your uploaded photos are public or private.
Messages
Direct messages between users are stored in our database so you can access your conversation history. Messages are not end-to-end encrypted — we can technically read them, but we don't. We access messages only when legally required.
Social data
Endorsements you give or receive, discography credits, and band memberships are stored as part of the platform's social graph.
Usage and logs
Our hosting provider (Vercel) logs standard web request metadata: IP address, browser, pages visited, and timestamps. We use this for debugging and platform health.
GND Lift also records two types of internal analytics events: profile views (when someone views your public profile) and streaming link clicks (when someone clicks a link to your Spotify, SoundCloud, or other music). These counts are stored in our database and shown to you in your dashboard — they are not shared with third parties or used for advertising.
2. How we use your data
- Display your profile to other users and in search results
- Send email notifications (new messages, endorsements, credit invitations)
- Operate platform features: messaging, band management, discography credits
- Investigate abuse reports and enforce our Terms of Service
- Improve the platform based on usage patterns
We do not sell your data. We do not use your data to train AI models. We do not serve advertising.
3. Third-party services
We rely on the following third parties to operate GND Lift. Each processes your data only as necessary to provide their service to us.
Your profile data, messages, and uploaded files are stored on Supabase's infrastructure (hosted on AWS in the US). Supabase is SOC 2 Type II certified.
GND Lift runs on Vercel's platform. Request logs and edge function telemetry are processed by Vercel. We also use Vercel Web Analytics to understand traffic patterns — it's cookieless and doesn't collect personally identifying information. Vercel is SOC 2 Type II certified.
When we send you a notification email, it is delivered via Resend. Resend receives your email address and the content of the notification only.
Sign-in is handled by Google OAuth. Google's Privacy Policy governs data Google collects during authentication.
To protect the platform from abuse, request rate limiting uses Upstash Redis. Upstash receives anonymized user identifiers and request counts — it does not receive your name, email, or profile data.
4. Data retention
We retain your data for as long as your account is active. When you delete your account:
- Your profile, bio, instruments, gear, and settings are deleted
- Your uploaded photos are removed from storage
- Your messages are deleted
- Endorsements and credits you gave to others may be retained in anonymized form (the credit remains on the release; your name is removed)
Vercel and Supabase may retain server logs for up to 30 days after deletion for operational purposes.
5. Your rights
Regardless of where you are located, you have the right to:
- Access — request a copy of the data we hold about you
- Correction — update inaccurate data (most data is editable directly on your profile)
- Deletion — delete your account and associated data from Account Settings
- Portability — request an export of your data
- Opt out of notifications — manage email preferences from Account Settings
To exercise any of these rights, email legal@gndlift.com and we'll respond within 30 days.
6. Cookies
GND Lift uses cookies only for authentication. We set a session cookie when you sign in so the platform knows who you are between page loads. We don't use tracking cookies or third-party advertising cookies.
7. Children's privacy
GND Lift is not directed at children under 13. We don't knowingly collect personal information from children under 13. If you believe we have inadvertently done so, contact us and we will delete the account.
8. Changes to this policy
We may update this policy as the platform evolves. When we make significant changes, we'll update the effective date. Continued use of GND Lift after changes take effect constitutes acceptance of the updated policy.
9. Contact
Questions or requests about your data: legal@gndlift.com