Privacy policy

1. Controller

The controller within the meaning of Art. 4 (7) GDPR for the processing of personal data via the website trupa.app, the app at app.trupa.app (web, Android, iOS), the operator dashboard admin.trupa.app and the Telegram bot is:

⟨FIRST AND LAST NAME / COMPANY⟩
⟨STREET AND NUMBER⟩
⟨POSTAL CODE, CITY⟩
⟨COUNTRY⟩

Email: ⟨CONTACT EMAIL⟩

Data protection officer: None has been appointed; the conditions of Art. 37 GDPR / § 38 BDSG are not met.

An informal message to the address above is enough for any data protection matter — access, erasure, objection.

2. What Trupa is, and what data arises at all

Trupa is an organisation tool for bands: songs and chord charts, setlists, rehearsals and gigs, polls, contacts, fee settlements and file attachments — shared inside a band, separated from every other band. On top of that comes an optional press kit, which a band shares by link with promoters and the press (§3.20–3.24).

Three facts shape everything below:

1. An account is an email address and a display name — nothing more. There is no password (login by one-time code), no address or payment data, no profile pictures, no advertising IDs.
2. Band content is shared content. What you create for a band — a song, a setlist, a poll, an attachment — is visible to every member of that band and stays with the band when you leave (then without your name, see §8).
3. There is no tracking. No analytics tools, no ad networks, no profiling, no automated decision-making within the meaning of Art. 22 GDPR. The public website runs no analytics script and no external font; it sets no cookies.

3. The processing in detail — purpose, data, legal basis, duration

3.1 Account and sign-in (email one-time code)

• Data: email address, display name (pre-filled from the local part of the email address on first login), optionally a chosen language, the time the account was created and the email confirmed.
• How it works: you enter your email address, we send a six-digit code. Only a hash of the code is stored, never the code itself, along with its expiry and a failed-attempt counter. The code is valid for 10 minutes.
• Legal basis: Art. 6 (1) (b) GDPR (performance of the contract — no account, no app).
• Duration: account data until you delete the account (§8). One-time codes are deleted one day after expiry.

3.2 Sessions and devices

• Data: one session record per signed-in device, holding the user ID, the expiry and the HMAC hash of the session token. The plaintext token only ever lives on your side — on the web as the httpOnly cookie trupa_session (Secure, SameSite=Lax, 30 days), in the mobile app in the encrypted device keystore (expo-secure-store) as a bearer token.
• Legal basis: Art. 6 (1) (b) GDPR; for the storage on your device § 25 (2) no. 2 TDDDG — the cookie is strictly necessary for the service you explicitly requested, which is why there is no consent banner.
• Duration: 30 days from sign-in, immediately on sign-out; expired sessions are removed by an hourly cleanup job.

3.3 Device pairing via Telegram

If you want to unlock the app on a new device without email, you can pair it through the Telegram bot.

• Data: a short-lived pairing record (public ID, hash of a secret, timestamps), linked to the Telegram user ID that confirms it. Lifetime about 3 minutes.
• Legal basis: Art. 6 (1) (b) GDPR.
• Duration: deleted one day after expiry.

3.4 Bands, memberships, invitations, join requests

• Data: band name, slug, country, currency, time zone, language and settings; per member the role (member/admin/owner) and join date; invitations with a hash of the invite code, an optional recipient email, expiry, use counter and creator; join requests with applicant, status, decider and time.
• Purpose: access control — the entire tenant separation rests on who holds which role in which band.
• Legal basis: Art. 6 (1) (b) GDPR; for invitation emails to third parties additionally Art. 6 (1) (f) GDPR (the band’s legitimate interest in reaching its members — an invitation is a single, requested message, not a newsletter).
• Duration: until the membership ends or the band is deleted; expired or revoked invitations are deleted after 60 days.

3.5 Songs, chord charts, setlists, stage view

• Data: title, artist, lyrics and chords (ChordPro), key, tempo, notes, duration as well as rights metadata (composer, lyricist, arranger, publisher) — the latter for reporting to collecting societies. Setlists with order, sets and transition notes. Each with the ID of the member who created the entry.
• Personal reference: arises through authorship and through names typed freely into notes and metadata.
• Legal basis: Art. 6 (1) (b) GDPR.
• Duration: until the band deletes it, then a 30-day recovery window before the record is removed for good. If you delete your account the content stays with the band and its authorship is anonymised (§8).

3.6 Attachments — links and uploaded files

An attachment is either a link to something hosted elsewhere (YouTube, SoundCloud, Drive, Dropbox …) or an uploaded file.

• Data (both cases): title, kind (audio/document), notes, uploading member, timestamps.
• Uploads only: file name, MIME type, size, the object key in storage and the file itself. Only audio/mpeg, audio/mp4, audio/x-m4a, audio/m4a and application/pdf are accepted; each band has a storage quota (currently 1 GiB). Recordings can themselves be personal data — a rehearsal take contains voices.
• Links only: we store the URL. Opening a link takes you out of Trupa; the provider then receives your IP address and may set its own cookies. We have no influence over that; there are no embedded players and we fetch no previews.
• No public file link: uploaded files are not served through presigned URLs but by the server on every request, after it has checked band membership. A URL that leaves the app therefore cannot outlive the access check.
• Legal basis: Art. 6 (1) (b) GDPR.
• Duration: deleting an attachment deletes the file in object storage immediately; the metadata row follows after 30 days (the window for an accidental deletion).

3.7 Rehearsals, attendance, reminders

• Data: title, location, start (wall-clock time in the band’s time zone), notes, series details, reminder time and time sent; per member the yes/no answer including a comment.
• Purpose: scheduling; an hourly job sends due reminders to the bound Telegram chats and as push notifications to registered devices.
• Legal basis: Art. 6 (1) (b) GDPR.
• Duration: until the band deletes it, then a 30-day recovery window; members’ RSVPs go with the date.

3.8 Gigs, RSVPs and the public date feed

• Internal data: title, venue and address, start and duration, status, internal notes, ticket link, members’ RSVPs.
• Public feed (optional, off by default): a band admin can enable a feed. Doing so mints a random token (shown in plaintext once; only its SHA-256 hash is stored) behind two anonymous endpoints: a JSON list and an ICS calendar to subscribe to; the website can render an embeddable dates page from it.
• What becomes public: only title, start (with time zone), duration, the free-text venue, public notes, ticket link and status — never RSVPs (not even as a count), internal notes, contacts or IDs. Gigs not marked public never appear.
• Important: anyone who knows the feed URL can read it — it is a capability key, not a login. It can be rotated or switched off at any time; either ends access through every previously shared URL immediately.
• Legal basis: internally Art. 6 (1) (b) GDPR; for publication Art. 6 (1) (f) GDPR (the band’s interest in promoting its dates) — enabling the feed is a deliberate decision by the band.

3.9 Polls and date-finding

• Data: question, description, options (including proposed dates), who proposed which option, who voted how, opening and closing time. Votes are not anonymous within the band.
• Legal basis: Art. 6 (1) (b) GDPR.
• Duration: until the band deletes it, then a 30-day recovery window; the votes go with the poll, and are deleted with your account in any case.

3.10 Fee splits (the shared kitty)

• Data: title, currency, income and expenses with description, amount and who paid, share weights or fixed cuts, settlement transfers and their status; participants are members or free-text guests (then just a name).
• Personal reference: financial details about named people — deliberately minimal: no bank details, no payment processing, no payment provider.
• Legal basis: Art. 6 (1) (b) GDPR; for free-text guests Art. 6 (1) (f) GDPR (interest in a settlement everyone can follow).
• Duration: until the band deletes it, then a 30-day recovery window.

3.11 Contacts (third-party data)

Bands can keep a small address book: name, role (e.g. promoter, engineer), email, phone, notes.

• These people are not registered with us. The data comes from the band, not from the data subject — Art. 14 GDPR. The band decides what it enters and is responsible for informing the person concerned and for having a legal basis.
• Legal basis: Art. 6 (1) (f) GDPR (interest in organising gigs and working together).
• Access/erasure: on request to ⟨CONTACT EMAIL⟩ we help data subjects and pass the matter on to the band responsible.
• Duration: until the band deletes it. The record then stays for a 30-day recovery window and is afterwards removed from the database automatically and completely — name, email, phone and notes included.

3.12 Push notifications

• Data: one Expo push token per device plus the platform (ios/android), linked to your account.
• How it works: the app asks for the system permission first; without your consent no token is created. Signing out removes that device’s token; tokens the push platform reports as invalid are deleted automatically by the reminder job.
• Legal basis: Art. 6 (1) (a) GDPR (consent through the system prompt), technically carried by Art. 6 (1) (b) GDPR.
• Duration: until the device signs out, the permission is withdrawn or the account is deleted.

3.13 Telegram bot and group binding

The bot is an older, frozen surface; new features only appear in the app.

• Data: Telegram user ID and chat/group ID, the mapping of a group to a band, the state of running dialogs (step and intermediate input) and the IDs of poll messages sent.
• Important: as soon as you use the bot, Telegram processes the communication under its own terms (§5). If you do not use the bot, nothing is processed there.
• Legal basis: Art. 6 (1) (b) GDPR.
• Duration: until the group binding is removed or the account is deleted; dialog states are short-lived.

3.14 Abuse protection (rate limiting)

• Data: for the sign-in, pairing, invitation and feed endpoints, and for press-kit pages and the report form (§3.23), we store a counter per time window. Its key contains the IP address of the call as supplied by the Cloudflare edge — for the report form only the /64 prefix of an IPv6 address — or, when no visitor IP is available, a SHA-256 hash of the feed token or of the press kit’s link token instead. The key never contains the token itself.
• Press photos: each server instance counts press-photo requests in memory only, per IP address (otherwise per hash of the link token) and 10-minute window. This counter is never written to the database; each entry is discarded once its 10-minute window has passed, at the latest with the server instance.
• Purpose: protection against brute-force and abuse.
• Legal basis: Art. 6 (1) (f) GDPR (security of the service).
• Duration: at most 24 hours — older counter rows are deleted by the hourly cleanup job. Beyond that, IP addresses are not stored in the application database; in particular the security event log (§3.15) deliberately holds neither IP addresses nor user agents.

3.15 Security log (audit log)

• Data: sign-ins, creation/redemption/revocation of invitations, role changes, joins and removals, group bindings, enabling and rotating the date feed, deleting a band, publishing, unpublishing, a new link and an address change of the press kit, and operator moderation actions (§3.24) — each with the acting person, band, event kind, time and a data-minimal subject field (IDs and masked values).
• One exception to “IDs and masked values”: deleting a band writes a second, band-independent entry that holds the deleted band’s name alongside its ID. It exists so the remaining owners can still be told who deleted the band and when, after the band itself — and with it every entry attached to it — has been erased 30 days later. It is therefore the one audit entry that outlives the band it describes, for up to the 365 days below.
• No free text: for a press-kit takedown and a dismissed report the entry holds the IDs and only the length of the operator’s reason or note, never its text; a restore holds only IDs (§3.24).
• Legal basis: Art. 6 (1) (f) GDPR (traceability of security-relevant operations, Art. 32 GDPR).
• Duration: 365 days, then deleted automatically. If you delete your account the event remains as band history and the acting person is anonymised.

3.16 Operator dashboard

A very small, configuration-defined set of operator accounts can view bands, user accounts (email, display name, status) and plan states at admin.trupa.app, in order to provide support and prevent abuse, and handle press-kit reports (§3.24). Legal basis: Art. 6 (1) (f) GDPR. Access happens only when there is a reason for it.

3.17 Public website and download page

trupa.app serves prerendered pages: start page, download page (the QR code is generated locally in the browser), imprint, this policy, sitemap and the embedded dates page (§3.8); press kits (§3.20) and their report form are rendered on each request. No cookies, no analytics, no external fonts or scripts. Loading a page produces the usual server connection data at the host (§3.18).

3.18 Server and operational logs

As the operator of the infrastructure, Cloudflare logs connection data (IP address, time, requested path, status code, user agent among others) in order to deliver the service, defend against attacks and find faults; Worker observability (runtime logs) is enabled. When an email cannot be sent, the runtime log records the kind of email and the provider’s status code — not the recipient’s address. We do not analyse this data on a personal basis. Legal basis: Art. 6 (1) (f) GDPR. Retention: as specified by the provider (⟨LOG RETENTION⟩).

3.19 Data on your device

So the app stays usable without a network, it keeps a copy of the band content you last read in device storage (expo-file-system), in plaintext. The session token lives in the system’s encrypted keystore. The chord chart editor stores drafts in the browser’s localStorage. We do not move this data off your device; signing out or uninstalling removes it. Legal basis: § 25 (2) no. 2 TDDDG (strictly necessary for the service you requested) in conjunction with Art. 6 (1) (b) GDPR.

3.20 Press kit (EPK)

A band can create a press kit — a page for promoters and the press.

• Data: the band’s display name, tagline, genres, hometown, “for fans of”, short and long bio, links to music and social platforms, up to three videos (only the provider and video ID, YouTube or Vimeo), latest release, press photos (§3.22), line-up (§3.21), contacts (role, name, email and/or phone), order and visibility of the sections, and design. Also the time of the last publish and the member who published.
• Draft and published version: band admins edit a draft that every member of the band can see in the app. Only what is copied at publish becomes public; later edits appear with the next publish. Hidden sections are not served — with two exceptions: one hero photo and one primary contact (booking, otherwise the first contact) always appear.
• Who sees the page: publishing creates a link of the form trupa.app/b/<slug>?k=<token>. Anyone holding that link can view the page without signing in and download the photos — it is a capability key, like the feed URL (§3.8). The page is unlisted: no directory, no search, no sitemap, noindex for search engines, Referrer-Policy: no-referrer. There is currently no publicly discoverable press kit. Only the SHA-256 hash of the token is stored; the link is shown once.
• Ending access: Unpublish or New link invalidates every link shared before, immediately (browsers may cache the page and images for up to 60 seconds); so does deleting the band. When the band’s plan ends, the page is no longer served but stays stored.
• Contacts in the press kit are third-party data (Art. 14 GDPR) and separate from the band’s address book (§3.11), which is never public. The band decides whom it lists and is responsible for informing that person.
• Videos: the YouTube (youtube-nocookie.com) or Vimeo player loads only when a visitor clicks Play video; only then does the provider receive their IP address and device data. Links to other platforms lead out of Trupa (§3.6).
• Legal basis: editing in the app Art. 6 (1) (b) GDPR; publishing Art. 6 (1) (f) GDPR (the band’s interest in presenting itself to promoters and the press) — it is a deliberate decision by a band admin; loading a video player Art. 6 (1) (a) GDPR and § 25 (1) TDDDG (click after notice).
• Duration: the draft until the band is deleted, then 30 days. The published version until Unpublish: that deletes the link and the stored published version (including its contacts and line-up) immediately — the draft remains, and publishing again publishes it anew. During an operator takedown (§3.24) the published version is kept until the takedown is lifted, at most until the band is finally deleted. Otherwise it is replaced by the next publish and deleted with the band after 30 days.

3.21 Your line in the line-up

• Data: each member can create one line for themselves: a name of their choosing and up to six instruments or roles. Only you write your line; nobody else — no admin either — can put your name in the press kit.
• How it works: the band’s members see the line in the app. It becomes public with the next publish and then stays unchanged until the one after. The published copy holds your user ID — never served — so it can be removed precisely.
• Removed immediately from the app and from the published page when you remove yourself from the line-up, leave the band, are removed from it or delete your account — the band does not have to publish again.
• Legal basis: Art. 6 (1) (a) GDPR — creating the line is the consent. Withdraw it at any time with Remove me from the line-up, even when the band has no active plan.
• Duration: until withdrawal, the end of the membership or account deletion.

3.22 Press photos

• Data: the photo in three sizes (longest edge up to 4000, 2048 and 640 pixels; at most 12 photos per band, at most 10 MB per file), credit (required), alt text, pixel size, the uploading member and the time of the rights confirmation; per stored size the file type, size, storage location and a SHA-256 checksum of the file (for the block list, §3.24).
• No camera metadata: the app re-encodes every photo on the device as JPEG before upload. This drops EXIF data, including the GPS position. The server accepts only JPEG and refuses any file that still carries EXIF or XMP data; other formats (e.g. PNG, WebP), whose metadata it does not check, are refused outright. Nothing is converted on the server.
• Rights confirmation: before every upload the uploading member confirms they hold the rights to the photo and have the consent of everyone shown (§ 22 KUG). People shown are third parties within the meaning of Art. 14 GDPR; the band is responsible for that consent.
• Storage and delivery: in Cloudflare R2 object storage (§5). Visitors receive photos only through trupa.app, and only photos of the published version; every request re-checks the link. After Unpublish a photo is no longer part of any published version and the band can delete it at once. A published photo is immutable — a different picture is a new photo.
• Legal basis: Art. 6 (1) (b) GDPR; for publishing, as in §3.20, Art. 6 (1) (f) GDPR; for the people shown, their consent, which the band confirms.
• Duration: until the band deletes the photo; file and record are then removed immediately. A photo the published version shows can only be deleted after the band has published again without it. Unfinished uploads are deleted automatically after one day. After a band is deleted, its photos are removed with it after 30 days.

3.23 Press-kit reports

• Data: anyone holding a press kit’s link can report it or a single photo: a reason (choice), the report’s text (10 to 1000 characters), optionally an email address for a reply, and the time. No IP address (only the rate-limit counter from §3.14). When an operator handles the report, the outcome, the note or reason, the handling person and the time are added. When a band publishes again after a takedown (§3.24), the system itself files a report with no personal data.
• Notification: there is no email per report. At most once a day the operators receive a summary by email (Brevo, §5): counts, and per report the band name, the press kit’s address, the reason, whether a photo is concerned, and the time — neither the text nor the reporter’s email address. Those are only in the operator dashboard.
• Cap: at most 50 open reports are stored per band; beyond that a report is confirmed but not stored.
• Purpose and legal basis: review by the Trupa team and action against unlawful content (Art. 16 DSA); Art. 6 (1) (c) and (f) GDPR.
• Duration: until resolved, then 180 days. A report left open for 180 days is closed as expired; its text and email address are deleted at once, the rest 180 days later. When a band is finally deleted, its reports go with it.

3.24 Press-kit moderation

• How it works: operators (§3.16) review reports against the published version, including photos and line-up. Every photo an operator views is logged with their account ID in the runtime logs (§3.18). A report can be dismissed (optionally with a note), a single photo removed, or the whole press kit taken down.
• Taking a press kit down: the page goes offline and the link stops working. Stored: the time, the reason and the operator. The published version is kept unchanged as the basis of the decision — even if the band unpublishes in the meantime — so the operator can review what was taken down. While the takedown stands, the band can edit the draft but not publish. It can still delete photos; a deleted photo is then removed completely — files, credit and alt text — from the kept published version too. Only an operator lifts it; lifting deletes the reason and the kept published version, and the band then decides whether to publish again.
• Removing a photo: its files are deleted and the photo leaves the draft and the published version. The SHA-256 checksums of its files go on the band’s block list, so exactly the same file cannot be uploaded again. The block list holds only checksums, no image.
• Statement of reasons to the band: the band’s owners receive the reason by email (Brevo, §5) and can reply to it (Art. 17 DSA).
• Legal basis: Art. 6 (1) (c) GDPR in conjunction with Art. 16 and 17 DSA; Art. 6 (1) (f) GDPR (protecting those affected and the service).
• Duration: the takedown, its reason and the kept published version until it is lifted, at most until the band is finally deleted; the block list until the band is finally deleted. A dismissal note or takedown reason recorded on a report is deleted with the report (§3.23). Takedowns, restores and dismissals are recorded in the security log (§3.15, 365 days) without any text — only the IDs and, for takedowns and dismissals, the text’s length.

4. Data export (right to portability) inside the app

Under Account you can request a complete JSON export at any time (GET /api/account/export). It contains: profile, linked identities, band memberships, your votes, your rehearsal and gig RSVPs, songs, setlists and attachments you created (metadata and links), polls, split entries, registered push devices, your press-kit line-up lines, the metadata of press photos you uploaded (credit, alt text, time of the rights confirmation; not the image files) and the audit events concerning you.

5. Recipients and processors

We do not pass data on for advertising purposes and we do not sell data. Only service providers necessary for operating the service are involved:

There is no payment processing: Trupa involves no payment provider and stores no payment data.

Third-country transfers: transfers to the USA take place on the basis of the EU standard contractual clauses (Art. 46 (2) (c) GDPR) or — where the provider is certified — the EU-US Data Privacy Framework (Art. 45 GDPR). For Telegram (UAE, no adequacy decision): using it is entirely voluntary; without the bot no processing happens there.

6. Retention at a glance

7. Security of processing (Art. 32 GDPR)

• Transport encryption (TLS) on every connection; encryption at rest at the database and object storage providers.
• No secret in plaintext: session tokens are HMAC-hashed; one-time codes, invite codes, pairing secrets, feed tokens and press-kit links are stored as hashes. A database leak yields no working credentials.
• Tenant separation in code: every band-scoped access runs through one central membership and role check — there is no path around it.
• Uploads: strict MIME allowlist, server-side size and quota checks, delivery only after a membership check (no presigned URLs). Press photos: JPEG only; camera metadata is removed on the device and checked by the server; delivery only through trupa.app after the link is checked.
• Per-host security headers, an authenticated Telegram webhook, rate limiting on every sign-in path.
• Data minimisation by default: no IP addresses in the audit log, no payment or location data, no analytics scripts.

8. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), to object to processing based on legitimate interests (Art. 21) and to withdraw consent with effect for the future (Art. 7 (3)).

How Trupa implements this:

• Access and portability: self-service through the export (§4).
• Rectification: display name and language at any time in the account settings; band content in the respective screen.
• Erasure: in the account settings (Delete account, DELETE /api/account/me). Deleted immediately and permanently: profile, linked identities, sessions, memberships, votes, RSVPs, push tokens, Telegram dialog states and your press-kit line-up lines — from already published pages too. Shared band content (songs, setlists, attachments, press photos, polls, splits, audit events) stays with the band; its authorship is rewritten to an anonymous placeholder (“[deleted user]”) that is not an account, can never sign in and appears in no member list. If you own a band you have to hand it over or delete it first. This anonymisation is irreversible and is how Art. 17 GDPR is implemented for jointly created content.
• Objection/withdrawal: revoke the push permission in your operating system, block the Telegram bot or unbind the group, switch the date feed off, remove yourself from a press kit’s line-up — each takes effect immediately.

Right to lodge a complaint: you can complain to a data protection supervisory authority, in particular in the member state of your residence, your place of work or the alleged infringement (Art. 77 GDPR). The authority responsible for us is ⟨SUPERVISORY AUTHORITY⟩.

9. Whether you have to provide data

Without an email address and a display name there is no account and therefore no app — that is a contractual requirement, not a statutory one. Everything else (Telegram, push, uploads, the public date feed, the press kit, contacts, splits) is voluntary; if you do not use it, you leave no data there.

10. Changes to this policy

We update this policy when features or the services we use change. The version published at trupa.app/en/privacy is the one that applies.

Last updated: 29 September 2026.