Privacy Policy

Last updated: 2026-11-04

This policy explains what bandcue does with data: the Android app (name.gpm.bandcue) and the web app at https://bandcue-app.gpm.name, which is the same account and the same library as the phone app, in a browser.

The web app has no half of its own. It is static files, served from the same address as bandcue’s service: the page is only the program, and every request for a sheet goes from your browser to the service described under “The cloud library”. It is for the desk — songs, setlists, bands, your account — and for a stand: the capo, a page-turner pedal, a setlist played through, a tuner, a song’s backing track. It does not join the band’s stage sync. What it keeps in the browser is what it needs to work: your session key (in the browser’s local storage), your choice of language and theme, how you read each song (transposition, capo, length), the pedal and playing options, the running order of the setlists you opened, which guides you have already seen, and a flag so that the offer of Italian is made only once. bandcue sets no cookies. Signing out removes the key and all of that local state; so does clearing the site’s data. The sound bank a backing track is played with is downloaded the first time you press play on one (about 32 MB) and kept in the browser’s cache: it is the same file for everybody and says nothing about you, and clearing the site’s data removes it too.

It also covers the connector for assistants at https://bandcue-app.gpm.name/mcp, through which an AI assistant you connect reads your cloud library and, if you allow it, changes it. See “Assistants”.

The short version: your songs are files on your phone, and in the folder you chose. bandcue fetches no chord sheet from anywhere, and hands none to anybody who does not already have it.

Four things can leave the device, all of them named below, and the first three only because you chose them: what you type into the report or messages screens; your library, if you turn on the optional cloud copy; your address, if you make an account so a band can invite you. The fourth is the Play build’s crash reports and usage statistics, which are on when you install it and which the app asks you about on the first launch. See Diagnostics.

One more thing can leave the cloud library, and only if you connect it: what an assistant reads there goes to whoever runs that assistant. See “Assistants”.

Who is responsible

Gabriele Proietti Mattia is the data controller for the processing described here. Contact: apps@gpm.name.

What the app does, in data terms

bandcue keeps each song as a ChordPro text file in its own private storage, and everything on screen is drawn from those files. When you point it at a folder — with Android’s own folder picker — it can read and write the same kind of file in that folder and nowhere else: there is no storage permission, and the app never sees anything you did not point it at.

Songs go into that folder, and come out of it, when you tap, and a song already on your phone is never overwritten by one from the folder.

The cloud library is the one thing that does sync on its own, and only when you are signed in. The app uploads a song a few seconds after you change it, and syncs again when you come back to it, so that a song written at a rehearsal is not only on that phone at the gig. Without an account nothing of the kind runs. See “The cloud library”.

bandcue has no catalogue and nothing is ever fetched on your behalf: every song in your library is one you put there. Since September 2026 one of the ways to put one there is a search you type, and it is worth saying exactly what that is — a chord site opened in a browser view on your own device, on your own connection, one page for the search and one for the result you choose to open. The app reads the text of that page only when you ask it to, shows it to you, and keeps nothing until you say keep. There is no crawl, no list fetched in the background and no copy of anybody’s transcription anywhere in the app.

None of your library is transmitted unless you turn on the cloud copy, which is off until you open it and is described under “The cloud library” below.

Writing in, and reading the answers

bandcue has a report screen — something is wrong, or an idea — and a messages screen where you can read what was written back. Both are in the Info tab, both are optional, and neither runs on its own: nothing is sent until you write something and press send.

This, the store’s billing in the Play build and the donation ask in the F-Droid build, are the only reasons the app asks for internet access at all.

What a report carries

• What you wrote: whether it is a bug or an idea, the title and the description.
• What makes it fixable: the app’s version, your Android version, the phone’s manufacturer and model, and your language tag. Typed into the message by the app — none of it is read from an identifier.
• A screenshot, only if you pick one. Nothing is captured for you. The picture is shrunk and re-encoded on your phone, and what you see before sending is exactly what leaves it — so if part of the screen has nothing to do with the problem, remove it first.
• Your email address, only if you type one. Without it a report is anonymous and cannot be answered; with it, it is how you get a reply.
• A random identifier for that single report, so that sending twice on a bad connection is not counted as two. It is not a device id, it is not stored on your phone, and a second report gets a different one.
• The IP address it was sent from. It is stored with the report, and only the moderator sees it.
• A fingerprint of your device, made from its Android ID (Settings.Secure.ANDROID_ID), which the app reads without any permission. Android gives every app its own value, tied to the app’s signing key, so two apps by Gabriele Proietti Mattia see different ones, and a factory reset changes it. The service keeps only a keyed one-way hash of it, never the value itself, and never shows it to anyone.

Both are there to keep abuse out, so that someone who sends abuse can be banned by device. See “Keeping abuse out” below.

It goes to bandcue-app.gpm.name, bandcue’s own service, which passes it on as it is to apps-management.gpm.name, where the reports of all of Gabriele Proietti Mattia’s apps are read. Both are run by the author, and bandcue’s service keeps nothing of a report on the way through. It is not shared with anyone, not used to build a profile and not published: reports are read, given a state and answered by hand.

Never the advertising id, and no install id of our own. The fingerprint above is the only thing that identifies the device. And nothing about your library is attached to a report: not a title, not an artist, not a lyric, not the name of the folder you bound — unless you type it in yourself, or it is in a screenshot you chose to attach.

Keeping abuse out

A report containing obscene words is not stored and not forwarded to anybody. Its sender is banned, without being told:

• by the device fingerprint, permanently;
• by the IP address, for 30 days;
• by the account or address, permanently, but only if you were signed in or had verified the address. An address you merely typed into the form is never banned.

The owner can lift any ban. If you think you were banned by mistake, write to apps@gpm.name.

Reading the answers, and the key that costs

A report is answered by email, to the address you typed into it. That is the whole of what is needed, and if you never open the messages screen nothing below applies to you.

That screen shows what you sent and everything written back, without going to find the mail. Since your reports are yours, it has to be sure it is you: it asks for the address and sends a six-digit code there. Once the code is checked the app keeps a key, and it is the one thing here that resembles a login, so it is worth being exact about it:

• it hangs from the address you proved, never from your phone — nothing about the device goes into it, two phones that prove the same address get two separate keys, and removing the app throws the key away rather than recovering it;
• it works for bandcue only, and opens nothing in any other app;
• the service stores a one-way hash of it, not the key itself;
• it stops working after a year without use, and Sign out withdraws it at the service and not only on your phone.

Sending a report needs none of this. You can report something having proved nothing, and that report carries no key or login — only the IP address and the device fingerprint described above.

Your name on the supporters list

The app can show who paid for it, and that list is public — on this site and in the app. Being on it is a separate decision from paying, taken on a screen of its own, and both defaults are no: somebody who never opens that screen is never listed.

• What is published is the name you typed, and nothing else. Never your address, never an amount, never a date, and never a position — the list is shuffled every time it is drawn.
• How you prove it is yours depends on how you paid. If you bought on Google Play, the app presents the purchase token it is holding — Play never tells an app who bought, so there is nothing to type and no address involved. If you donated, you prove the address you donated from, and the service checks whether a donation is recorded against it.
• The choice belongs to this app. Supporting bandcue is not asking to be named anywhere else.
• It is reversible in one tap, from the same screen.

What stays on your device

• Your songs, one ChordPro file each, exactly as they arrived — the text you pasted or opened is kept whole, so a sheet that displays wrong is never a song that is lost.
• How you play each one: the transposition, the capo and the length you set for the scroll. These stay here on purpose. A transposition is a property of your phone and not of the song, because the file in the folder is the whole band’s.
• Your setlists, their order and your notes on them. Notes never reach the folder.
• The settings: the theme, the stage theme, the font size, the count-in, auto-advance.
• Which folder you bound, as the permission Android gave you for it — not a copy of its contents.
• A backing track that is a recording (mp3, wav and the other audio files). It is never uploaded: not to the cloud library, not to the band’s folder, not to Android’s backup. A MIDI backing track is different: it goes with its song to the cloud library (see “Backing tracks”).

All of it is in the app’s private storage. Uninstalling removes it, as for any app, and it is included in Android’s backup so that a new phone starts where the old one left off.

The permissions, and what each is for

• No storage permission at all. The band’s folder is reached through Android’s Storage Access Framework, which grants access to the one directory you picked. This is checkable on the released APK, and it is meant to be.
• Internet — the report and messages screens, billing in the Play build, and the donation ask in the F-Droid build. No request in the app reaches a chord site, and that is also checkable.
• Notifications — asked for the first time you sign in. They carry: an invitation to a band; a finished import, when the app is not in front of you; changes in your bands (see “Band notifications”); and, in the F-Droid build, the weekly donation ask. Each has its own channel in Android’s settings.
• Microphone — the tuner, and the tempo listener on the tempo pad. Both are off until you open them: nothing listens in the background, ever. What the microphone hears is measured as it arrives and thrown away — how high a note is, and how far apart the beats are. No audio is recorded to a file, and none of it leaves the phone, in either build.

In the web app, the tuner and “follow it live” on a sheet use the browser’s microphone. The page says what it is for before anything is asked, and only a press of its button asks; the browser then asks for its own permission, which you can take back from the address bar. It listens while the tuner is open, or, for “follow it live”, while you have it on, that song is open and the tab is in front; a reload starts with it off. What it hears is measured as it arrives and thrown away. Nothing is recorded, stored or sent, and the microphone is released when you leave.

Keeping the screen on is a window flag rather than a permission. A sheet holds it while it is open and the tuner does the same; the On a stand switches in Settings can hold it for the whole app, and it is given back the moment the app is not in front of you.

Diagnostics

This depends on which build you have, and the two are not the same. This page said “there are none, in either build” for longer than that was true, and the correction is below rather than quietly folded into a sentence: the Play build has collected crash reports and usage statistics since version 2026.8.16.

The F-Droid build has none. No crash reporting, no analytics, no usage counters. It does not contain the libraries that would do it, which is the only claim worth making about a build you did not compile yourself.

The Play build contains Firebase Crashlytics and Firebase Analytics, and since 2026.9.5 both are behind a switch under Settings → Diagnostics. What each does, and the default it has:

• Crashlytics — on by default — sends, when the app crashes, the stack trace, the device model, the Android version, the app version and a Crashlytics-generated installation identifier. It does not include your songs or the folder you bound.
• Analytics — on by default since 2026.9.9 — records the automatic events the SDK collects, together with the identifiers it collects by default, which include the Android Advertising ID, an app instance identifier, the device model, the OS version and a coarse region. From the Play build after 21 September 2026, bandcue also logs a handful of events of its own about the way to Pro: that the support sheet was opened and which control opened it, the plan chosen and whether it started with a free trial, and whether a trial or a subscription actually began. Nothing about which songs you have, what you typed, or what you played — none of it is about you or your data, and all of it stops the moment this switch does.

Both are on, and the app asks you about them on the first launch — a sheet with the two switches on it, before the app has been used, which you can leave alone or move. That is the same in every app in this family since 4 September 2026.

Usage statistics were off by default until 2026.9.9, and the argument for that is worth keeping because it is the argument for changing back: they carry the Android Advertising ID, which is a cross-app identifier, and — until September 2026 — bandcue logged no events of its own, so what they sent was Google’s automatic collection and nothing that was asked for. What decided it the other way is that two apps by the same person, answering the same question differently, is a difference nobody can explain to somebody using both; and that a switch you are shown before you have used the app is a fairer thing than a switch nobody mentions.

If that trade is not one you want, the switch is under Settings → Diagnostics and it takes effect immediately — and the F-Droid build contains neither SDK at all.

Neither switch existed before 2026.9.5, and both SDKs collected from first launch. This page said the opposite for longer than it should have; the correction and the switch shipped together. Firebase is operated by Google; see the Firebase privacy documentation and the Google Privacy Policy.

Beyond that, the Play build differs from the F-Droid build in containing Google Play Billing.

What the app never does

• No password, anywhere. There is an optional account — see “The account” below — and it is proved by a code sent to an address, or by signing in with Google. Nothing here stores a password, and the app works fully without an account at all.
• No fetching of anybody’s chord sheet on your behalf. There is no scraper, no proxy and no “convenience” endpoint, in either build, behind any flag. Songs get in because you put them in — including through the in-app search, which is your own browser opening the page you asked for and keeping nothing until you keep it.
• No advertising, and no sale or sharing of data with anyone.
• No advertising in the app, and nothing about you sold or shared with anybody for their own purposes. The Play build’s Analytics does collect the Android Advertising ID — that is named under Diagnostics above rather than denied here.
• No location, no contacts, no messages, no photos or files beyond the folder you bound and the single screenshot you may attach to a report. A report also carries the IP address it was sent from and a hashed fingerprint of the device, to keep abuse out.

The account

Optional, and the app is a whole app without one. With no account bandcue keeps every song on this phone, with no limit on how many, and the sheet, the scroll, the transposition and the export work with the radios off and always will. Writing and importing songs is part of bandcue Pro, and works offline too once it is yours.

An account exists for the two things a phone on its own cannot do: keep a copy of your library off this phone, and be invited to a band by somebody who knows your address.

It is bandcue’s own account. Since 14 September 2026 it lives in bandcue’s service, bandcue-app.gpm.name, and not in a service shared with Gabriele Proietti Mattia’s other apps. Before that date it was kept in the shared one, which this page said; the accounts were moved across with their ids and their sign-in keys, so nobody’s bands changed and nobody was signed out.

How you prove it is yours, in either build:

• A code sent to your address. Six digits, typed into the app, mailed by bandcue’s service through Mailjet (see “E-mail”). Nothing else is stored about the address, and no password is created.
• Signing in with Google, in the Play build only. Google tells the service your address, your Google account identifier and the name on the account — and nothing else: no contacts, no Drive, no calendar, and no permission to act as you anywhere. The consent screen names gpm-apps, the name of the Google project Gabriele Proietti Mattia’s apps share, rather than this app alone.
• A second address may be attached once a code has proved you can read it, so a work address and a personal one are one account rather than two.

What is kept, and where. The account — the address, any second address, an optional display name you choose and in what form, whether you have Pro, and the sign-in keys (as one-way hashes) — is kept by bandcue’s service, bandcue-app.gpm.name, in its own database, beside which bands you are in and the bands’ songs. Other members of a band see your address and the name you chose, in the form you chose, because that is what a band is for. The service keeps no password. It asks one question of a second service run by Gabriele Proietti Mattia, apps-management.gpm.name: whether your address holds a licence for Pro. Reports, the messages screen and the supporters list go to that second service too (see “Writing in, and reading the answers”). What is kept nowhere: a password.

Leaving. Closing the account from inside the app takes you out of every band, deletes the bands left with nobody in them and the songs you kept under your own account, and then removes the account itself. Closing it also deletes every phone and browser registered for notifications. An account removed any other way — by asking, or because nobody used it for six months — is removed from bandcue’s service within a day. Your songs are on your phone throughout, and export in full, always — paid, lapsed, or never signed in at all. Pictures you chose go with the account.

The cloud library

Your songs, setlists and notes can be kept on bandcue’s service, under your account, and that is what the web app shows you too. Songs you make in a band belong to that band. It is in this version, and the sentences above about the app talking to no service do not cover it.

What the service holds, it can read. A song is stored as the text you typed, with its title and artist, in a form the service can read; it travels over TLS. It is not encrypted in a way that hides it from Gabriele Proietti Mattia, and you should not use the cloud library for anything you would not want read. The account is what opens the library, and the same account opens the same library on the phone and in the browser.

Pro is on the account. Making and changing songs needs it; reading and export never do, and a lapsed Pro keeps everything readable and exportable.

What is true either way:

• Nothing is public. No catalogue, no search across accounts, no browsing, no share links, and no way to reach a song without being signed in to the account that holds it or being in the band that does — or through an assistant that such an account connected (next section). One account cannot read another’s.
• Nothing is fetched. There is no scraper and no proxy. Every sheet is there because somebody typed, pasted or imported it.
• What is sold is the making and changing of songs, never content.
• The shared folder needs none of this — no account, no service — and it is still what most bands should use.

A song can be deleted from the app or the web app, and closing the account deletes the songs you kept under it, as described under “The account”.

Assistants

An AI assistant — Claude, ChatGPT, the assistant in an editor — can be connected to your cloud library through bandcue’s connector at https://bandcue-app.gpm.name/mcp, an MCP server (the protocol these assistants use for tools). It is part of bandcue Pro, nothing is connected until you connect it, and it reaches the cloud library only: never the phone, never the folder you bound. How to connect one is on a page of its own.

You decide, on bandcue’s own page. The assistant sends you to the web app, where you sign in if you are not already, and are shown the name of the app that is asking, where your answer goes back to, and what it will be able to do: read — your library and your bands’ songs, setlists and notes, and searching them — or read and change — also adding, editing and deleting songs and setlists and writing notes, wherever you can write. The assistant never sees your sign-in codes, and what it is given opens the connector and nothing else: not your account’s settings, not your addresses, not closing the account.

What it reads goes to its provider. A song’s text, its notes, a setlist, the answer to a search: whatever the assistant reads is sent to whoever runs it — Anthropic for Claude, OpenAI for ChatGPT, the model’s provider in an editor — and from then on is handled under that provider’s terms and privacy policy, not this one. bandcue cannot take it back. That includes the songs and notes of the bands you are in, which other people wrote: connecting an assistant is your decision about them too.

What it changes, you changed. A change in a band is recorded as the band’s change with you as its author, and the other members are told about it as about any change of yours (see “Band notifications”).

What the service keeps for it:

• the assistant: the name it gave, or the address of the document that names it, and the addresses your answer may go back to. When an assistant names itself by a web address, the service reads that short document — from its own address, sending nothing about you — and reads it again after a day;
• each connection: your account, which assistant, whether it may read or also change, when you connected it, when it was last used, and when it was disconnected;
• its keys: an access key that lasts an hour and a renewal key that lasts 90 days from its last use, kept only as one-way hashes, like the app’s sign-in keys;
• a line in the service’s log for each call: which tool, the account, the connection, how long it took and whether it worked — never what the assistant asked for or what it was given.

Disconnecting is on the web app’s account page, under Connected apps, and stops the assistant at once. Closing the account deletes every connection, and blocking an account disconnects them (see “Blocked accounts”). A connection is limited to 120 calls a minute, 20 of them changes.

E-mail

All of bandcue’s e-mail is sent through Mailjet, a mail delivery service, from noreply-apps@gpm.name: sign-in codes, band invitations, the warning before a quiet band or account is deleted, and band notifications (next section). Mailjet receives the recipient’s address and the message, which is plain text. There is no tracking pixel and no link that identifies you; the only link that does anything for you alone is the unsubscribe link in a notification, which holds a signed token for your account and turns notification e-mail off.

Band notifications

When somebody else changes something in a band you belong to, bandcue can tell you. It is on by default, for every channel, and each one can be switched off.

What triggers one, and only in a band’s own content, never in anybody’s own library: songs added, changed or deleted; setlists created, changed or deleted; notes written for the whole band (not a member’s personal note on a song); members joining or leaving, including being removed and closing their account. Not: covers looked up by the service, pictures, renames and role changes.

What it says. The band’s name, who did it — by the name they chose, or by their address if they chose none, as the band’s members list shows them — how many of each kind, and a link — “Ada and Marco added 2 songs and changed 1 setlist”. Never the text of a song or a note, a song’s title or a setlist’s name, in the notification, the e-mail or anywhere the service logs it.

How often. At most one notification every 10 minutes per band and per person, on every channel, summing up what happened since the last. Nobody is told about their own changes, and a member who joined after a change is not told about it.

Three channels:

• The phone, in the Play build, through Firebase Cloud Messaging. Once you are signed in the app registers the phone, and bandcue’s service stores one push token per device, linked to your account and to the session you signed in with. Google delivers the message, and so sees the token and that a message reached the phone. The token is deleted when you sign out, when the session is revoked, when the account is closed, and when Google says the token is dead. The F-Droid build has no push at all and gets e-mail instead. This is separate from the diagnostics switches above.
• The web app, through Web Push, only if you turn it on in a browser, after the browser’s own permission prompt. The message is encrypted and goes through the browser’s push service — Google for Chrome, Mozilla for Firefox, Apple for Safari, Microsoft for Edge — which delivers it with the tab closed. bandcue’s service stores the subscription’s endpoint and keys. They are deleted when you turn it off, when you sign out of that browser, and when the account is closed.
• E-mail, to the address of your account, only if you have not opened that band, in the app or the web app, since the changes, 10 minutes after the notification and under the same one-in-10-minutes rule. Every mail carries a one-click unsubscribe, and the same switch is in Settings.

The switches are in Settings, in the app and in the web app: one for e-mail, one for the phone in the Play build, and, in the web app, one for each browser. Your choices, and the language the messages are written in (English or Italian), are kept on your account.

What the service keeps for it. One row per change, holding its kind, a count, who did it and when — no content — deleted after 7 days. For each member of a band, when they last opened it and how far their notifications and mail have got. Nothing else.

Pictures and covers

A band’s logo, your own picture and a song’s cover are stored on the service as images. They are re-encoded on the way in, which drops any metadata such as the place a photo was taken. A logo is seen by the members of its band, and your picture by the members of the bands you are in; a cover belongs to its song. None of it is public.

Looking up covers. When a song has no cover, the service can ask MusicBrainz and the Cover Art Archive for one, sending the song’s artist and title and nothing else: from the service’s own address, with no account and no band attached. It is on until you turn it off, with the switch in your account settings. Answers are remembered across accounts by the artist and title, so a popular song is asked about once.

Backing tracks

A song in the cloud library can have a backing track beside it: for now a MIDI file (.mid, .midi, .kar) of up to 4 MiB, with room for 200 MB of tracks per account and per band. The service keeps the file as it was uploaded, the name it was given, its size, when it last changed and which account changed it, and, once it has been changed in the note editor, the file as it was before the first change, so that it can be put back.

• Who sees it is who sees the song. A track on one of your own songs is yours. A track on a band’s song is the band’s: every member can play it, download it and change it, as they can the sheet, and a member who leaves keeps whatever copy their phone already has, as for the sheets.
• Nothing is public, and nothing is fetched. A track is there because somebody with access to the song uploaded it. The service checks that it is a MIDI file and how big it is, and does not look further into it. Assistants connected to the library do not see tracks.
• The Android app sends it with the song. Since app version 2026.11.1, a MIDI track attached to a song that is in the cloud library goes up with the song’s sync, including a track attached before that version. Another phone gets it at its next sync. A recording is never uploaded.
• The operator never sees a track’s name or what is in it, only how many tracks an account or a band keeps and how much room they take, and can delete a track when someone who holds the rights to it asks (see the terms).
• It goes when you remove it: deleting the track, deleting its song, closing the account it is kept under, or deleting the band. It is included when you export the library.

The operator’s admin panel

bandcue’s operator has an admin panel for running the service. It shows account addresses, names, dates, counts and sizes, the names of bands and who is in them, and pictures, so that they can be moderated, together with a log of what the operator did in it. It never shows a song’s text, a note’s body or a setlist’s contents, nor a backing track’s name or file.

With it the operator can sign an account out everywhere, close an account, delete a band — for example when a rights-holder asks — delete a picture or a backing track, and block an account (next section). Each of these is written to the log.

Blocked accounts

An account can be blocked for abuse or for breaking the terms — using bandcue unlawfully, storing or sharing material you have no right to, or working around what the app is built not to do, as set out under “Acceptable use” in the terms. A blocked account cannot sign in, and every assistant it connected is disconnected.

So that a block survives closing the account and signing up again, the account’s addresses and its Google sign-in identifier are kept only as one-way hashes, together with the reason. Unblocking the account removes them.

Rate limits

Requests to the service are rate-limited per IP address, and an address that keeps going over the limit, or keeps asking for pages that do not exist, is blocked for a day at the network edge, by Cloudflare.

Legal basis (GDPR)

For readers in the EU/EEA and the UK: what the app does on your device involves no transmission to Gabriele Proietti Mattia and so no processing on that side to which a legal basis under Article 6 would attach.

Where you write in — a report, the messages screen — the processing is based on your request (Article 6(1)(b) and 6(1)(f)): you asked for an answer, and answering you requires keeping what you sent for as long as the question is open.

Keeping the IP address and the device fingerprint with a report, and banning those who send obscene reports, rests on a legitimate interest (Article 6(1)(f)): protecting the service and the people who run it.

Answering an assistant you connected is processing you asked for (Article 6(1)(b)): the service reads and writes your library for it because you allowed it to. The line logged for each call rests on a legitimate interest (Article 6(1)(f)): keeping the connector working and finding abuse. What the assistant’s provider does with what it read is that provider’s processing, under its own policy.

Retention

A listing — your chosen name — is kept until you take it down, which is one tap on the same screen that put it up.

Reports are kept while they are useful — an open one until it is answered, a closed one as the record of a decision. A screenshot is part of the report it came with and goes when it goes. The IP address and the device fingerprint are kept with the report as long as the report is kept. Ask and yours is deleted, including the address you sent it from.

Ban records stay until they expire (30 days for an IP address) or the owner lifts them.

A sign-in key, in the app or in the browser, stops working a year after you last use it, and is withdrawn the moment you press Sign out. Deleting the app removes the copy on your phone; signing out in the browser removes the one kept there.

An assistant’s connection lasts until you disconnect it, until it has gone unused for 90 days, or until the account is closed. Keys are deleted a day after they stop working, connections that ended in the service’s next daily pass, and an assistant that nobody has connected and that has not been seen for 30 days is forgotten.

Notification records — the changes behind them — are deleted after 7 days. A phone’s token or a browser’s subscription goes as described under “Band notifications”, and with the account.

Songs and pictures stay until you delete them or the account is closed. A band nobody has opened for a year is warned at eleven months and deleted at twelve, with its songs.

On your device, your songs and settings remain until you delete them or uninstall the app.

Your rights

Under the GDPR you may request access to, correction of, or deletion of your personal data. For anything you sent from the report or messages screen, write to apps@gpm.name and it is done by hand. For what is on your device, deleting it is a matter of clearing the app’s data or uninstalling it. You retain the right to lodge a complaint with a supervisory authority.

Children

bandcue is not directed at children under 13 and knowingly collects no data from them — or from anyone.

Changes

Material changes will be published on this page with a new date at the top, and significant ones will be noted in the app’s changelog.

Last updated: 2026-11-04