Privacy Policy

This Privacy Policy explains what personal data DrumTab collects, what it is used for, who it is shared with and how you can exercise your rights, in accordance with Brazil's General Data Protection Law (LGPD, Law No. 13,709/2018). It complements our Terms of Use.

1. Data we collect

• Account data: email, username, display name and password. The password is stored only in encrypted (hashed) form and can never be read by us.
• Sign in with Google: if you sign in with Google, we receive your (verified) email address and your name from it. We have no access to your Google password or to any other data in your Google account.
• Profile and content: your bio, the tabs you create (including drafts and private ones), the tags you use, the tabs you like and the people you follow.
• Verification data: whether your email has been confirmed, and temporary codes for email confirmation and password reset.
• Technical data: IP address, browser, operating system and pages visited, logged by our hosting infrastructure to run and protect the site and to produce aggregate usage statistics.

2. How we use it

• To create and maintain your account and let you sign in (performance of our contract with you).
• To publish and display your tabs and profile according to the visibility you choose.
• To send service emails, such as sign-up confirmation and password reset. We do not send marketing emails.
• To measure site usage in aggregate, fix errors and prevent abuse and fraud (legitimate interest).
• To comply with legal obligations and respond to authorities when required by law.

We do not sell your personal data.

3. Who we share it with

We share data only with the providers needed to run the site:

• Vercel: site hosting and usage statistics (Vercel Web Analytics, which uses no cookies and produces only aggregate data).
• Database provider: storage of your account data and your tabs.
• Resend: delivery of service emails.
• Google: authentication, only if you choose to sign in with Google.

Some of these providers may process data outside Brazil. In those cases, the transfer is made with the safeguards required by the LGPD. We may also share data when required by law or court order.

4. Cookies and local storage

DrumTab does not use advertising or tracking cookies. We only use:

• a session cookie, which keeps you signed in;
• a cookie with the language you chose;
• your browser's local storage, to keep preferences such as the editor's keyboard shortcuts.

5. How long we keep it

We keep your data for as long as your account exists. Verification codes expire shortly. When you delete your account, we erase your personal data and your content, except for backups kept for a limited time, forks other users have already made of your public tabs, and data the law requires us to keep.

6. Your rights

Under the LGPD, you may at any time request:

• confirmation that we process your data, and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or erasure of data that is unnecessary or processed unlawfully;
• portability of your data;
• deletion of your account and your data;
• information about who we share your data with.

To exercise these rights, write to contact@drumtab.club from your account's email address. You may also file a complaint with Brazil's National Data Protection Authority (ANPD).

7. Security

We use encrypted connections (HTTPS), store passwords only as hashes and restrict access to data. No system is completely secure; if an incident could put you at risk, we will notify you as required by law.

8. Children

DrumTab is not intended for children under 13, and we do not knowingly collect their data. If you know of an account belonging to someone under 13, let us know so we can remove it.

9. Changes to this policy

We may update this policy. The last-updated date appears at the top of this page and, if the change is significant, we will let you know on the site or by email.

10. Contact

Questions about privacy or your data: contact@drumtab.club.