Privacy should be part of the session design.

Notice at collection

At or before collection, this table describes the information involved, why it is needed, and the retention period or criterion currently used.

California disclosures: we do not sell these categories, share them for cross-context behavioral advertising, use them for targeted advertising, or use sensitive personal information to infer characteristics. MaestroGnome is not intended for children under 16.

How and why we use information

• Provide the service: authenticate accounts, publish private reviews, stream media, preserve version history, route invitations, and attach feedback to the right project and musical moment.
• Protect the service: detect abuse, keep uninvited people out, investigate failures, and maintain availability and integrity.
• Communicate: deliver invitations and respond to support, privacy, and operational messages.
• Improve the beta: use feedback and limited operational diagnostics. Optional product analytics will require a separate choice before activation.

For people in the EEA, UK, or Switzerland, the legal bases are performance of a contract or steps requested before entering one, our legitimate interests in securely operating and improving a private collaboration service, compliance with legal obligations, and consent only where a feature is genuinely optional and consent is required. Consent can be withdrawn without affecting earlier lawful processing.

Who receives information

If a producer invites you before you have an account, we receive your email address and optional name from that producer. The invitation is our first direct contact and links to this notice. Google supplies the verified profile fields only after you choose to sign in. Comments and playback actions come directly from you; technical data comes from your browser, device, and our hosting systems.

Information is visible to the producer and collaborators authorized for the relevant project, and to invited reviewers as needed for the review. Service providers may process information on our behalf for cloud hosting and storage, Google identity verification, media delivery, email delivery, security, and support. We may also disclose information when required by law, to protect rights and safety, or in a business transaction subject to appropriate safeguards.

Current infrastructure is primarily in the United States. If personal information from the EEA, UK, or Switzerland is transferred to the United States, we use applicable provider transfer mechanisms and contractual safeguards where required. We do not give an AI model blanket access to Gmail, Drive, or Calendar; any future connection must be separately authorized and scoped.

Your rights and choices

Depending on where you live, you may request access, correction, deletion, restriction, objection, or portability; withdraw consent; opt out of sale or sharing; limit qualifying sensitive-information use; or appeal a decision. You may also complain to your local data protection authority. California residents have the right not to receive discriminatory treatment for exercising applicable privacy rights.

We verify requests in proportion to their sensitivity. An authorized agent may submit a California request, but we may require proof of authority and direct identity confirmation. Some records may be retained when an exception applies—for example, security, legal compliance, or preserving another person’s rights.

Cookies, GPC, and analytics

MaestroGnome uses strictly necessary first-party cookies for authentication, return routing, OAuth security, and session continuity. Salsa Analytics is optional: its SDK is not downloaded, no analytics identifier is created, and no analytics event is sent until you select “Allow analytics.” Consented events pass through a MaestroGnome allowlist that removes private URLs and creative content before delivery to Salsa at cloud.salsas.io. See the Cookie Notice for exact browser storage.

We recognize Global Privacy Control as an opt-out signal and keep analytics off when it is present, even if an older browser choice said otherwise. You can withdraw permission at any time through the persistent Privacy settings control; withdrawal stops new events and clears the Salsa visitor and session identifiers. Advertising remains disabled.

Security and accountability

Safeguards include private review access lists, signed short-lived login state, secure and HTTP-only cookies, encryption in transit, restricted cloud storage, least-privilege access, no-store caching for private responses, and security headers. No system is perfectly secure; please report suspected exposure to security@maestrognome.com.

We may update this notice as the beta changes. Material changes will receive a new effective date and, when required, an in-product or email notice. We will not use previously collected information for a materially incompatible purpose without the notice or choice required by law.