This policy explains what information Stdout Software LLC (“we”, “us”) collects when you use Ultimate Setlist on the web or iOS, how we use it, and the choices you have.
What we collect
- Account information: your email address, a display name and, if you enable it, two-factor authentication secrets.
- Band content: songs, chord charts, lyrics, setlists, notes, comments, venue details, band logos and photos, and song recordings you or your bandmates add.
- Subscription information: your plan, its status and renewal date, and a store transaction identifier. We never see your card number or Apple Account credentials.
- Technical information: standard server logs (IP address, browser or device type, timestamps) used for security and troubleshooting.
- Website analytics: this marketing site (not the app) uses Google Analytics to measure visits — pages viewed, approximate location, browser and device type. Google sets a cookie to do this; see Google’s privacy policy.
We do not sell personal information and we do not show advertising.
How we use it
- To run the Service: store and sync your bands’ content between members and devices.
- To send transactional email — account confirmation, password reset, band invitations.
- To manage subscriptions and enforce plan limits.
- To keep the Service secure and diagnose problems.
Who can see your content
Band content is visible to the members of that band. Your email address and display name are visible to people you share a band with. A band administrator may publish a public band page containing the band’s name, description, links, upcoming shows and, optionally, its song titles — never private notes, charts or recordings.
Service providers
We use the following providers to operate the Service. Each only receives what it needs for its role:
- Supabase — database, authentication, file storage and hosting (data stored in the United States).
- RevenueCat — subscription management; processes web payments through its partner Stripe.
- Apple — in-app purchases on iOS.
- Resend — transactional email delivery.
- Cloudflare Turnstile — bot protection on sign-up.
- Flagsmith — feature flags (receives no personal data).
- Google Analytics — visitor statistics for this website only.
Retention and deletion
We keep your data for as long as your account exists. You can export all of your data at any time from Settings. To delete your account and its data, email support@stdoutsoftware.com from your account address; content you added to bands you share with others may remain visible to those members unless you remove it first. Backups are purged on a rolling basis after deletion.
Security
Data is encrypted in transit and at rest. Access to your bands is enforced by per-row security rules in the database, and you can protect your account with two-factor authentication.
Children
The Service is not directed at children under 13 and we do not knowingly collect their information.
Changes
We may update this policy. Material changes will be announced in the Service or by email. Continued use after a change means you accept the updated policy.
Contact
Stdout Software LLC — support@stdoutsoftware.com