Privacy Policy

The person in charge of the protection of personal information for JamList is Florian Duchateau, reachable at contact@jamlist.app. Under Law 25, this person holds this role by default until a formal delegation is made.

JamList collects the following information:

• Account data: email address and password (managed by our authentication provider, Supabase), display name chosen by the user
• Avatar: algorithmically generated — no photo is ever requested or stored
• Service usage data: membership in one or more bands, proposed songs, votes, rehearsal availability and attendance, concerts entered
• Minimal technical data required for operation (e.g. PWA installation)

JamList does not collect date of birth, phone number, precise geolocation data, or payment information. The Service's default privacy settings are set to the highest level of protection, in accordance with Law 25.

Information is collected to: create and manage an account and bands, operate the Service's features (votes, rehearsal and concert planning), ensure the security of the Service and prevent fraudulent use, and improve the Service based on aggregated, anonymized statistics.

The collection and use of your personal information is based on your consent, given freely and with full knowledge when you create your account, for the purposes described in section 3. No information is used for commercial prospecting without separate, prior consent. You may withdraw your consent at any time, subject to legal limits and the impact this may have on your access to the Service.

Information is accessible to the members of the user's band(s), to the extent necessary for the Service to function (e.g. name, avatar, proposed songs, votes visible to members of the same band).

Information is also processed by our technical subprocessors: Supabase (database and authentication hosting, on servers located in Canada) and PostHog Inc. (audience measurement and usage analytics, on servers located in the United States — see sections 6 and 11). When searching for a song, the search terms entered may be sent to Apple (iTunes Search API) and YouTube, without any associated account data being transmitted.

Our primary data hosting (Supabase) is located in Canada. The pseudonymized usage data described in section 11 (audience measurement and session recording) is processed by PostHog Inc. on servers located in the United States. Some occasional subprocessors (Apple, YouTube/Google) may also process information outside Quebec, notably in the United States, solely within the scope of the song searches performed by the user.

In accordance with Law 25, any transfer of personal information outside Quebec is or will be subject to a privacy impact assessment to ensure that the information receives protection equivalent to that provided in Quebec before any transfer. This contractual verification is underway with each of our subprocessors.

Information is retained for as long as the account is in use. Upon account deletion, personal information is deleted or anonymized within a reasonable time, unless a longer legal retention obligation applies.

Access to data is restricted by technical rules (Row Level Security) ensuring a user can only access data from their own bands. Exchanges between the application and our servers are encrypted (HTTPS).

In the event of a confidentiality incident presenting a risk of serious harm, JamList undertakes to keep a record of it, to notify the Commission d'accès à l'information (CAI) and to inform the individuals concerned, in accordance with Law 25.

In accordance with Law 25 and, where applicable, PIPEDA, every user has the right to access, rectify, withdraw consent for, and port their personal information (transfer to another organization, in a structured, commonly used technological format). These rights can be exercised by writing to contact@jamlist.app. JamList undertakes to respond within 30 days at most.

In the event of a persistent disagreement, users may lodge a complaint with Quebec's Commission d'accès à l'information (CAI) — www.cai.gouv.qc.ca — or, for users located outside Quebec, with the Office of the Privacy Commissioner of Canada — www.priv.gc.ca.

Registration of users under 14 requires the consent of their legal guardian, in accordance with Law 25. JamList does not carry out any marketing profiling or share a minor's information for advertising purposes.

JamList uses technical cookies strictly necessary for the Service to function, in particular login session management.

To improve the Service, JamList also uses the PostHog analytics tool to measure how the application is used: pages viewed, actions performed (for example proposing a song, voting, responding to a rehearsal) and session recording (a replay of on-screen navigation, used exclusively for product improvement). This data is pseudonymized: it is linked to a random technical identifier, never to your name or email address, and any text typed into the application's fields (passwords, emails, content) is automatically masked and never appears in the recordings.

This data is not used for any advertising profiling and is not shared with any third party for commercial purposes. No advertising tracker is used. For any question, or to object to this processing, write to contact@jamlist.app.

JamList may send strictly transactional emails related to using the Service (account confirmation, band invitation), exempt from express consent under Canada's Anti-Spam Legislation (CASL). Any promotional communication would be subject to the prior consent required under that law.

This privacy policy may be updated to reflect changes to the Service or applicable regulations. The last update date appears at the top of this page.

For any question about the protection of your personal information: contact@jamlist.app