Privacy Policy

Your music. Your choices.

Session Route, LLC operates sessionroute.com and the Session Route apps for artists, engineers, producers, and studios. This policy explains how we handle personal information across our services.

• We do not sell personal information or use it for cross-company targeted advertising.
• You control what you publish and share. Public profiles and shared links have different audiences from your private library.
• Optional permissions stay optional. Browse without sharing your current location and manage notifications in device settings.
• You can request your data or delete your account. Steps and retention exceptions are explained below.

1. Information we collect

Accounts and professional relationships

We collect the name, email address, sign-in information, username, role, and profile details you provide. These can include a phone number, city, images, biography, genres, social links, and credits. Studio details include business addresses, rooms, equipment, photos, availability, team members, prices, and policies. Contacts stores relationships within Session Route, such as collaborators, clients, saved contacts, and blocked accounts; it does not import your device address book.

Music, bookings, and communications

We store content you upload or create, including audio, artwork, photos, videos, playlists, projects, file metadata, notes, and licenses. We also process session dates and services, participants, availability, invitations, messages and attachments, reviews, and support requests. Content may include information about other people. Only share material you are entitled to provide.

Payments, earnings, and Apple purchases

Stripe processes supported payments and payouts. We receive customer and payment identifiers, limited payment-method details, billing information, amounts, status, refunds, disputes, earnings, and payout records. Stripe may collect bank, tax, or identity-verification details directly during payout setup. We do not store full card numbers or card security codes.

If a studio requires identity verification, Stripe can request a government ID and a matching selfie through its hosted verification flow. This can involve biometric processing under Stripe’s verification notices. We send an account reference and contact details and retain verification identifiers, status, and result information. We do not copy ID images or verification selfies into our account database. Authorized staff may access verification records through Stripe, and the studio can see whether its verification requirement has been met. See Stripe’s verification privacy choices, or contact us about records processed for Session Route.

Apple processes memberships bought through iOS in-app purchase. We verify transaction identifiers, products, subscription status, purchase and expiration dates, and related purchase information to activate benefits, restore purchases, and handle renewals or refunds. These records are associated with your Session Route account. Apple does not give us your full payment-card details.

Location and maps

Profile cities, studio addresses, and map searches help you find studios. If you choose the current-location control and grant permission, your device supplies coordinates, which may be precise, for nearby results and drive times. Drive-time coordinates go directly from the app to Google Maps. We do not save your device’s current coordinates to your Session Route profile or collect background location. Google receives request information, including IP addresses and map parameters, under its policies. You can use a city or browse the map without granting location access.

Usage, devices, and diagnostics

We process IP addresses, browser and device characteristics, app versions, request times, and security logs. Push notifications use a device token associated with your account. Interactions such as onboarding progress, membership choices, and shared-music listening activity help provide and improve features; some events are linked to your account. Analytics can include approximate geography.

Crash reports, error details, performance measurements, and operational alerts help us fix problems. Our diagnostic tools filter many personal fields and private URLs, but some operational records and app-health sessions can still be associated with account, installation, or request identifiers. We do not describe all diagnostics as anonymous. We do not enable Sentry session-replay recordings or screenshots.

Connected sign-in providers may supply an identifier, name, and email address. Payment, calendar, and music-credit services supply information needed for the features you use, as described below.

2. How we use and share information

We use information to manage accounts and workspaces; find studios and coordinate bookings; deliver files and collaboration features; process payments, memberships, and licenses; send service messages; provide support; personalize relevant features; improve reliability; prevent fraud and abuse; resolve disputes; and meet legal obligations.

Studios may use client and booking activity to send rebooking invitations, unfinished-booking reminders, or membership recommendations through Session Route. These messages use contact details and relevant session history and include a way to stop those studio messages. If you subscribe to a Session Route newsletter, we use your email address and subscription information to send the updates you requested.

With participants: Studios, assigned engineers, and authorized booking participants receive the contact, schedule, payment-status, and preparation information needed for the session. Collaborators and workspace members receive access according to their role and sharing permissions. Recipients receive messages you send. Shared-music owners may see listening activity and feedback associated with their shares.

Public and shared content: Published profiles, listings, storefronts, credits, and reviews may be publicly visible. Depending on its access settings, a shared link may be usable by anyone it is forwarded to. Revoking access does not remove copies already downloaded. Uploading to your private library does not by itself make the content public.

Operational and legal needs: Authorized staff and providers access information needed for support, security, and service operation. We may disclose information when legally required or reasonably necessary to address fraud, disputes, or threats to rights and safety. Information may transfer during a merger, reorganization, or sale, subject to applicable privacy requirements.

3. Providers and integrations

The providers used depend on your platform and features:

• Supabase: Authentication, databases, file storage, and real-time features.
• Vercel: Hosting, content delivery, request logs, Web Analytics, and Speed Insights. Analytics include usage, performance, approximate geography, and device/browser characteristics. Our integration removes private path identifiers and query strings from analytics page URLs.
• Stripe: Payments, connected accounts, payouts, identity verification, and fraud prevention. See Stripe’s Privacy Policy.
• Apple: Sign in with Apple, App Store purchases, and Apple Push Notification service, including notification tokens and alert content. See Apple’s privacy information.
• Google: Sign-in, connected calendars, maps, and Firebase Cloud Messaging on supported platforms. Our use of Google Maps is subject to Google’s Privacy Policy and Google Maps terms.
• Resend: Recipient addresses and message content for email delivery.
• Sentry: Filtered errors, crashes, app-health sessions, and performance diagnostics.
• Upstash and Cloudflare Turnstile: Request-derived identifiers and security checks for rate limiting and abuse prevention.
• Discord: Restricted operational and support alerts for our team, including record references and limited issue details. Alert formatting filters sensitive fields.
• Backblaze: Encrypted recovery copies of service data and files.
• Muso.ai: Public music-credit and profile information for supported profiles or connections. Connecting a profile link does not give us your Muso.ai password.

Providers process information to supply their services. Some, including payment, sign-in, and map providers, also determine how information is used for their own legal, security, or service purposes. External services you open have their own privacy practices.

Google Calendar and Limited Use

We retain authorization tokens for calendars you connect. For studios, we create, update, and remove booking-related events. For engineers, we synchronize busy times to prevent overlaps. Engineer availability records retain an opaque event identifier, start/end times, all-day status, and time zone; we do not retain event titles, descriptions, locations, guests, or organizer details.

Our use and transfer of information from Google APIs adheres to the Google API Services User Data Policy, including Limited Use. We use calendar data for the calendar feature, not advertising. Disconnect in calendar settings or revoke access through your Google Account permissions.

4. Retention, deletion, and security

We retain information while needed to provide features, maintain transaction and entitlement records, resolve disputes, protect the service, or meet legal obligations. The period depends on the information, relationship, outstanding obligations, and applicable requirements.

Account deletion closes account access, handles active bookings and payment obligations, disconnects supported providers, and removes account-owned profiles and private library files. Unresolved payments, refunds, or disputes can delay completion. Required financial and audit records, and session deliverables other participants are entitled to receive, may remain. Recipients may retain content already received.

Recovery copies are separate from the active service and expire through backup rotation; account deletion does not instantly erase every backup. Access to recovery copies is restricted. Independent providers may retain their own records under their policies and legal obligations.

We use encrypted connections, authentication, access controls, private file storage, and monitoring. Access depends on account, workspace, booking, and sharing permissions. No online service can guarantee absolute security.

5. Your privacy choices

• Review and correct: Update personal information and available visibility preferences in profile or account settings.
• Download your information: Open your account using the profile/avatar control, then Settings, and choose Download Your Data. You can also request a portable copy by email.
• Delete your account: Choose Delete Account in account settings and complete identity confirmation. If you cannot sign in, contact us for a verified deletion request. Uninstalling the app does not delete your account.
• Manage subscriptions: Manage Apple subscriptions in your Apple account’s Subscriptions settings. Deleting the app or your Session Route account does not by itself cancel an Apple subscription.
• Control permissions: Manage location, photos/camera, and notifications in device or browser settings. Restricting access may limit the relevant feature.
• Manage sharing: Change supported visibility, collaboration, and shared-link permissions. Block other users through Contacts.
• Disconnect integrations: Use integration settings or the provider’s account controls.
• Stop promotional emails: Use the unsubscribe link in newsletters or Stop these studio messages in studio follow-ups. Essential account, security, payment, and booking messages may still be sent.

Send privacy requests to privacy@sessionroute.com. We may verify your identity and authority before disclosing or deleting records. Do not send passwords or full payment-card details. We respond within the period required by applicable law and explain any permitted exceptions or extensions.

California and other applicable rights

Depending on your location and applicable law, you may have rights to know and access your information, receive a portable copy, correct inaccuracies, request deletion, and appeal a decision on a request. California law also provides rights to opt out of sale or sharing for cross-context behavioral advertising and to limit certain uses of sensitive information. We do not sell information or share it for that advertising purpose. We use sensitive information for requested services and permitted operational purposes, and do not discriminate for exercising applicable privacy rights.

The categories, sources, purposes, and recipients above describe our information practices. You or an authorized agent can contact us to make a request; we may require proof of authorization. Use the same address to ask us to reconsider a response or raise a privacy concern.

6. Cookies and local storage

Cookies and app/browser storage keep you signed in, remember preferences, secure requests, and support playback and local caches. Blocking essential storage may prevent sign-in or other functionality. Vercel Web Analytics does not use advertising cookies. Session Route does not use advertising identifiers or combine your activity with other companies’ apps and websites for targeted advertising. Connected services process information as described in Section 3.

7. Age requirements and international access

Session Route is intended for people 18 and older. We do not knowingly collect information from children. Contact us if you believe someone under 18 has provided information so we can investigate and take appropriate action.

We operate from the United States. Providers may process information in the United States and other countries where they operate. Privacy protections can differ; we apply safeguards required by applicable law to international transfers.

8. Policy updates

We update this policy when practices change and show the effective date above. For material changes, we provide additional notice where appropriate or required, such as an in-app notice or email. We obtain consent where applicable law requires it.

9. Contact us