Privacy policy

The data controller is [Owner name or company], tax ID [NIF / CIF], [Postal address], Barcelona, Spain. For anything about your data, write to [legal@dubgenerator.com].

• Account: your email, your password (stored only as a secure hash by our authentication provider), sound name, avatar, and when you accepted these terms. If you sign in with Google, we receive your email address and profile picture from Google.
• Mixes: the recorded audio, its name, visibility, length, the waveform and the moves you made in the mixer, and how many times it was played.
• Activity: simple events such as mix page visits, plays and share clicks, linked to the mix and, if you are signed in, to your account. If you sign up after opening someone's shared mix, we note which mix brought you.
• Usage statistics (only if you accept cookies): Google Analytics records pages visited, approximate location (country/city), device, browser and how you arrived, linked to a random identifier stored in a cookie, not to your account.
• Contact form: your name, email, project, location, message and links, plus a one-way hash of your IP address to stop spam.
• Technical data: our hosting and database providers process IP addresses and request logs to deliver the site and keep it secure.

If you record a mix without an account, it stays in your browser and never reaches our servers until you sign in and choose to publish it.

• To provide the service (your account, saving and sharing mixes, showing who made them): necessary to perform our agreement with you (art. 6.1.b GDPR).
• To keep it safe and working (spam and abuse prevention, save limits, error logs): our legitimate interest (art. 6.1.f).
• To understand how it's used (counting plays, shares and sign-ups, also to report to artists and sponsors as totals, never as personal data): our legitimate interest (art. 6.1.f).
• To measure visits with Google Analytics (which pages work, where visitors come from): your consent from the cookie banner (art. 6.1.a). You can withdraw it at any time with the “Cookies” link in the footer.
• To answer your messages from the contact form: our legitimate interest, or steps before a possible agreement with you as an artist or sponsor (art. 6.1.b and 6.1.f).
• To send service emails (confirming your account, resetting your password). We don't send newsletters without asking you first.

Your sound name and avatar are public, and so is every mix you publish as public, together with its name, play count and credit. Unlisted mixes can be opened by anyone who has the link. Private mixes are only visible to you. Your email is never shown to other users.

We use a few service providers who process data on our behalf, under data processing agreements:

• Supabase (database, file storage for mixes and avatars, authentication). Data stored in [Supabase region, e.g. EU (Frankfurt)].
• Vercel (website hosting and delivery).
• Resend (sending emails: contact messages to our team and, once enabled, account emails).
• Google: sign-in, only if you choose “Continue with Google”; and Google Analytics (Google Ireland Ltd.), only if you accept cookies. Advertising features and Google signals are turned off.

Some of these companies are based in the United States. Where data leaves the European Economic Area, it is protected by the EU–US Data Privacy Framework or the European Commission's standard contractual clauses. We don't sell personal data or share it with advertisers.

• Account and mixes: while your account exists. When you replace a mix, the old one is deleted with its audio file.
• When you delete your account, your profile and mixes are deleted; activity events stay only as anonymous counts, no longer linked to you.
• Contact messages: up to two years after our last exchange, unless they lead to an agreement.
• Google Analytics: 14 months, then deleted by Google.
• Provider logs: for the short periods each provider keeps them for security.

We don't use advertising cookies, and analytics cookies only with your consent. You can change your choice at any time with the “Cookies” link at the bottom of every page. We use:

• Sign-in cookies (named sb-…): keep you signed in. Strictly necessary; they last while your session is active.
• Shared mix cookie (dg_ref), optional: only if you click “Accept” in the cookie banner. When you open someone's mix, it remembers that mix for 30 days so we can credit it if you sign up. It contains only the mix ID.
• Google Analytics cookies (_ga, _ga_…), optional: only if you click “Accept”. They tell visits apart with a random ID and last up to 2 years. Choosing “Only essential” later stops Analytics and deletes them.
• Browser storage: your cookie choice (localStorage), a mix you recorded without an account (IndexedDB, until you publish or delete it), and the shared mix waiting for your cookie choice (sessionStorage, cleared when you close the tab).

You can ask us to access, correct, delete or export your data, to restrict its use, or object to how we use it, by writing to [legal@dubgenerator.com] from the email of your account. You can change your sound name, avatar and mix visibility yourself on your profile. We answer within one month. If you think we haven't handled your data properly, you can complain to the Spanish Data Protection Agency (aepd.es) or the authority of your country.

Dub Generator accounts are for people aged 18 or over. If we learn that an account belongs to someone younger, we will delete it.

Connections are encrypted, passwords are never stored in plain text, and access to the data is limited by database security rules so each user can only change their own profile and mixes. No system is perfectly secure: if a breach affects your data, we will tell you and the authorities as the law requires.

If we change this policy in a way that matters, we will tell you on the site or by email before the change applies. The date at the top shows the current version.