Privacy Policy

The person in charge of the protection of personal information for JamList is Florian Duchateau, reachable at contact@jamlist.app. Under Law 25, this person holds this role by default until a formal delegation is made.

JamList collects the following information:

• Account data: email address and password (managed by our authentication provider, Supabase), display name chosen by the user
• Avatar: algorithmically generated — no photo is ever requested or stored
• Service usage data: membership in one or more bands, proposed songs, votes, rehearsal availability and attendance, concerts entered
• Minimal technical data required for operation (e.g. PWA installation)

JamList does not collect date of birth, phone number, precise geolocation data, or payment information. The Service's default privacy settings are set to the highest level of protection, in accordance with Law 25.

Information is collected to: create and manage an account and bands, operate the Service's features (votes, rehearsal and concert planning), ensure the security of the Service and prevent fraudulent use, and improve the Service based on aggregated, anonymized statistics.

The collection and use of your personal information is based on your consent, given freely and with full knowledge when you create your account, for the purposes described in section 3. No information is used for commercial prospecting without separate, prior consent.

Usage measurement and session recording are subject to separate consent, requested on your first visit and switched off by default. Until you answer, these technologies remain inactive. Dismissing the request without answering counts as a refusal: the absence of a choice is never treated as acceptance.

You can change or withdraw that choice at any time from My account, under Privacy. Withdrawal takes effect immediately and takes no more steps than accepting. Refusing has no effect on your access to the Service or on any of its features.

Information is accessible to the members of the user's band(s), to the extent necessary for the Service to function (e.g. name, avatar, proposed songs, votes visible to members of the same band).

Information is also processed by our technical subprocessors: Supabase (database and authentication hosting, on servers located in Canada) and PostHog Inc. (audience measurement and usage analytics, on servers located in the United States — see sections 6 and 11). When searching for a song, the search terms entered may be sent to Apple (iTunes Search API) and YouTube, without any associated account data being transmitted.

Our primary data hosting (Supabase) is located in Canada. The pseudonymized usage data described in section 11 (audience measurement and session recording) is processed by PostHog Inc. on servers located in the United States. Some occasional subprocessors (Apple, YouTube/Google) may also process information outside Quebec, notably in the United States, solely within the scope of the song searches performed by the user.

In accordance with Law 25, any transfer of personal information outside Quebec is or will be subject to a privacy impact assessment to ensure that the information receives protection equivalent to that provided in Quebec before any transfer. This contractual verification is underway with each of our subprocessors.

Information is retained for as long as the account is in use. Upon account deletion, personal information is deleted or anonymized within a reasonable time, unless a longer legal retention obligation applies.

Access to data is restricted by technical rules (Row Level Security) ensuring a user can only access data from their own bands. Exchanges between the application and our servers are encrypted (HTTPS).

In the event of a confidentiality incident presenting a risk of serious harm, JamList undertakes to keep a record of it, to notify the Commission d'accès à l'information (CAI) and to inform the individuals concerned, in accordance with Law 25.

In accordance with Law 25 and, where applicable, PIPEDA, every user has the right to access, rectify, withdraw consent for, and port their personal information (transfer to another organization, in a structured, commonly used technological format). These rights can be exercised by writing to contact@jamlist.app. JamList undertakes to respond within 30 days at most.

In the event of a persistent disagreement, users may lodge a complaint with Quebec's Commission d'accès à l'information (CAI) — www.cai.gouv.qc.ca — or, for users located outside Quebec, with the Office of the Privacy Commissioner of Canada — www.priv.gc.ca.

Registration of users under 14 requires the consent of their legal guardian, in accordance with Law 25. JamList does not carry out any marketing profiling or share a minor's information for advertising purposes.

JamList distinguishes three categories of technology. Only the first is active without your agreement.

Necessary — technical cookies strictly required for the Service to work, in particular login session management and remembering your language. This category also covers JamList’s internal usage measurement: actions performed in the application (for example proposing a song, voting, responding to a rehearsal) are recorded in JamList’s own database, hosted in Canada, in order to understand what works and improve the product. This data is linked to a technical identifier, never leaves JamList, is not shared with any third party and serves no advertising purpose. It is deleted together with your account.

Usage measurement (optional, off by default) — with your agreement, the pages you view and the actions you perform are also sent to PostHog Inc., an analytics tool hosted in the United States. This data is pseudonymized: it is linked to a random technical identifier, never to your name or email address.

Session recording (optional, off by default, separate from usage measurement) — with explicit and separate agreement, PostHog records how you navigate on screen, in order to understand a problem that is hard to describe. All displayed and typed text is automatically masked: no passwords, email addresses or content appear in those recordings. Accepting usage measurement never switches on session recording: these are two separate consents.

No advertising tracker is used and no marketing category is active. None of this data is sold or shared for commercial purposes.

Retention: session recordings are kept for 30 days and then deleted automatically. Internal measurement data is kept for the life of the account and deleted with it. [TO BE COMPLETED: retention period for events held by PostHog — to be checked in the project settings and stated here.]

You can change your choices at any time from My account, under Privacy, or write to us at contact@jamlist.app.

JamList may send strictly transactional emails related to using the Service (account confirmation, band invitation), exempt from express consent under Canada's Anti-Spam Legislation (CASL). Any promotional communication would be subject to the prior consent required under that law.

This privacy policy may be updated to reflect changes to the Service or applicable regulations. The last update date appears at the top of this page.

For any question about the protection of your personal information: contact@jamlist.app