LAST UPDATED 11 NOVEMBER 2026

Privacy policy

GigAlong is operated by Daniel Seixas, trading as Hyperthings, established in Spain. Contact the controller about privacy or to exercise your rights at dpo@hyperthings.es.

Information we use

GigAlong stores account details such as your name, email, instrument and authentication information, as well as recent activity, group memberships, charts, setlists, notes and activity. Content you enter may contain personal information. Members of a shared group can see content shared with that group. Account credentials and personal notes are not shared with other members.

When you use connected features, information may be sent to the relevant provider, such as Google or Facebook for sign-in, Spotify for playback, MusicBrainz and Cover Art Archive for recording information and artwork, or Ultimate Guitar for chart searches. Their own privacy policies apply to their processing. Email delivery and hosting providers may also process information on our behalf.

Beta and newsletter signups

On the temporary GigAlong launch site, you may voluntarily submit your email address to join beta testing or receive GigAlong news. The address is sent directly to the relevant GigAlong mailbox and is not stored in a separate website database. We use beta signup details to contact you about beta participation and newsletter signup details to send the requested news. The legal basis is your consent. You can withdraw consent at any time by contacting dpo@hyperthings.es.

Why information is used

Account and group information is used to provide the songbook, synchronise your content, authenticate you, manage shared access and respond to service requests. Security and activity information helps protect accounts and investigate misuse. The bases are performance of the service agreement for requested features, legitimate interests in protecting and operating the service where applicable, consent for optional beta and newsletter communications, and compliance with legal obligations where relevant.

The service is not intended for children under 16. GigAlong does not use advertising or analytics on the temporary launch site. If those practices change, this policy and any required choices will be updated before they are enabled.

Storage and recipients

Production is hosted in-house in Madrid, Spain. Hyperthings does not plan to transfer hosted data internationally. Optional third-party services operate independently and may process information internationally; their processing locations and any applicable transfer safeguards should be checked for each service.

We intend to review accounts after 24 months of inactivity, with advance notice before deletion. Deleted charts and setlists remain in the trash until permanently deleted by an authorised user. The intended backup retention is 30 days, subject to operational backup and restoration procedures. Legal obligations and legitimate requests may affect retention.

Cookies and storage on your device

The GigAlong app uses an HttpOnly session cookie and stores a separate CSRF value and revocation-only capability on the device. Local storage holds the offline library, including your profile, charts, notes, setlists and group information, as well as display and performance preferences. Session storage holds the current view and, when you connect Spotify, information needed to complete the connection and its session tokens. The service worker caches app files for offline use.

When you choose Google or Facebook sign-in, the app sets an oauth_google or oauth_facebook cookie to protect the sign-in request. It expires after ten minutes or is removed when the sign-in returns. Those providers may use their own cookies on their sites. The temporary launch site does not use analytics or advertising cookies.

Your choices and requests

You can update your name and instrument in your profile and download an account-data export there. For access, correction, erasure, restriction, objection or portability requests, contact dpo@hyperthings.es. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD) or another competent data protection authority. The availability of particular rights depends on the circumstances.

Account deletion is not yet available as a self-service feature. You can request it using the contact above. Data in backups, on other members’ devices or held by third parties requires separate handling.