Your information.
Explained.

Supabase Auth manages your account, email verification, sign-in and password recovery. We use your account identifier, email address and profile name to recognise you and connect you to the bands you join. Band members do not receive your password.

When you choose Continue with Google, Google handles the sign-in. RMONEY receives the account identifier, name, email address and basic profile information Google supplies, which can include a profile picture. RMONEY does not receive your Google password or request access to your Gmail, Calendar, Drive or Photos. Google sign-in appears only when it is available. Apple sign-in is planned and is not currently enabled.

The browser uses cookies for sign-in sessions and secure sign-in handoffs. A separate, short-lived cookie remembers your content choices during band setup.

We store the information you save: band profiles and contacts, availability, rehearsals, gigs, songs and lyrics, setlists, preparation tasks, promotion plans, payment records and booking conversations. This lets you and your band keep working from the same saved plan. Payment records do not initiate money transfers.

Joined members have access to their band’s shared information, including private songs, media, contacts, payment records and booking conversations. The lead controls invitations and access. Adding a roster contact alone does not give that person access; a Manager, Crew or Supporter label does not restrict an existing member’s access.

Publishing a gig opportunity makes its brief available on the gig board. Applying shares your application and selected media with that opportunity’s organiser. Review what you attach and what you write before sharing it.

New uploaded originals are stored in private Supabase Storage, with access checked against the account and band. We also store the filename, file type, size and creator credit. The supplied Dead Amigos demonstration photos, videos and researched archive are public demo material, separate from your private uploads.

Microphone tools ask for your browser’s permission and start when you choose them. The tuner and stage sound reaction work on your device. Voice memos upload when you select Save to your media; Echo uploads a take only when you choose Keep. Unsaved Echo takes disappear when you leave or reload.

Downloaded press kits, gig-day packs and promotional images are copies you can share outside RMONEY. Removing access cannot recall a file someone already downloaded. A downloaded pack can contain your gig notes and contact details, so check it before sending.

Vercel hosts the web app. Supabase provides authentication, the database and private uploads; the production Supabase project is in Sydney. Resend delivers account verification and recovery emails. Cloudflare R2 stores separate encrypted recovery copies, produced by our backup workflow on GitHub Actions during the approved backup pilot.

These services process information needed to provide hosting, authentication, delivery and recovery. The Sydney database region does not mean every service, log or recovery copy stays in Australia.

We use a limited, explicitly configured server-side PostHog integration to understand whether app requests succeed or fail. Events contain the operation category, a random request reference, app release and environment, and an error category or status when relevant. This is service monitoring, not a user opt-in setting.

Our event payloads exclude names, email addresses, band and media identifiers, lyrics, messages, files, passwords, cookies and sign-in tokens. We have not installed browser activity capture or session replay. PostHog person profiles and location enrichment are disabled for these events. Hosting and authentication providers also handle connection and security information to run their services.

Edit information through the app where your band permissions allow it, or ask your band lead about shared records and membership. Keep a separate copy of important original recordings and files.

During the pilot, contact us in the conversation where you received your RMONEY invitation for a privacy question or an access, correction or deletion request. See the pilot contact guidance. There is no self-service account-deletion workflow yet; requests need manual review, including effects on other band members’ shared records.

Account and band records remain stored for the running service. Separate encrypted recovery copies can remain after a change or removal from the app. The backup pilot does not provide automatic deletion of every retained copy at a fixed age. Ask us about the scope of a removal request rather than assuming all copies vanish immediately. Please do not send passwords or private sign-in links when contacting us.