In case of doubt, the German version of this privacy policy prevails.

Privacy Policy

Last updated: 15 November 2026 · applies to the bandAgent app (iOS/iPadOS), the bandAgent MCP server and the website bandagent.app.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

bandAgent is run by a private individual. No data protection officer has been appointed, as there is no legal obligation to do so (fewer than 20 people are engaged in processing personal data, Section 38 of the German Federal Data Protection Act, BDSG).

2. Summary

• No tracking, no ads. Neither the app nor the website contains analytics, advertising or crash-reporting services. There is no profiling and no sale of data.
• Your device is the main store. Songs, setlists and sheet music are stored locally on your device; the server only distributes them among the members of your band.
• Servers in the EU. The database is hosted by Supabase in the Ireland (EU) region, the MCP server on Microsoft Azure in the North Europe (Ireland) region.
• Microphone on the device only. The tuner and tempo detection analyse sound directly on the device. Nothing is recorded, stored or transmitted.
• Sign in with Apple only. Apple gives us an identifier and an email address, which you can hide via Apple if you like.
• No cookies on this website.

3. This website

The website bandagent.app is served via Azure Static Web Apps by Microsoft (Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). When you visit it, the hosting service processes the technical data needed to deliver the page: IP address, date and time, requested address, amount of data transferred, referrer and browser identifier (user agent). We do not analyse this data or combine it with other data.

The legal basis is our legitimate interest in delivering the website securely and reliably (Art. 6(1)(f) GDPR). We do not receive or store access logs for the website and do not analyse any. Microsoft processes this data as our processor only to deliver the pages and protect the service, and deletes it according to its own defaults. The pages are distributed through Microsoft’s global delivery network (the management resource is in the Azure region Central US), so a request may be served by servers outside the EU (see Transfers to third countries).

The website sets no cookies, uses no local storage, contains no JavaScript and loads nothing from third-party servers (no external fonts, no embedded services). That is why there is no cookie banner.

4. The app: data per feature

The overview below lists which data each feature uses, where it is stored and why. “Server” means our backend at Supabase in the EU region Ireland. A band’s content is visible only to that band’s active members; this is enforced in the database itself (row level security).

5. What stays on your device

• Microphone (tuner, tempo detection): sound is analysed in memory only while the feature is open. Nothing is recorded, stored or sent. At most, measured tempo values are kept as a suggestion on the song. Access only with your permission in iOS.
• Camera and photos: only when you pick or take a band logo. Only the selected, cropped image is uploaded. Access only with your permission in iOS.
• Text recognition during import: PDFs are read on the device with Apple’s Vision framework. You review the recognised fields before saving.
• Spoken announcements: generated on the device with the iOS speech synthesiser.
• Click, MIDI, foot pedals: run entirely locally.
• Exports (setlist PDF, GEMA list, MobileSheets package): created on the device. Whether and with whom you share them is up to you.
• Local database: an SQLite database and downloaded files in the app’s storage keep your bands available offline. They are removed when you delete the app.

6. AI assistant (MCP connector)

Optionally, you can connect an AI assistant such as Claude (Anthropic) or ChatGPT (OpenAI) to your bandAgent account via the bandAgent MCP server at https://mcp.bandagent.app/mcp. This only happens if you set up the connector in your own AI account and agree on our consent page.

• Through the interface the assistant receives data from the bands you are a member of, within your permissions: songs, sections, lyrics, setlists, events and the change log. It can only read and change what you can in the app. There are no delete tools.
• What you write to the assistant and what it retrieves from bandAgent is processed by the respective provider under its own terms and privacy policy, as part of your contract with that provider. The provider is responsible for this itself; it is not our processor.
• The MCP server runs on Microsoft Azure in the North Europe (Ireland) region. It stores no content permanently but passes your access token on to our database, where the same permissions apply as in the app. To make undo possible, we store every change in the change log (see above).
• The legal basis is Art. 6(1)(b) GDPR (providing the feature you requested). You can revoke access at any time by removing the connector in your AI account; see Support.

Please only give the assistant data you are allowed to share with its provider – especially data about other band members.

7. Legal bases

• Art. 6(1)(b) GDPR (contract): account, band features, sync, sheet music, events, live session, AI connector.
• Art. 6(1)(f) GDPR (legitimate interests): technical logs, security and abuse prevention, delivering the website.
• Art. 6(1)(a) GDPR and Section 25(1) TDDDG (consent): notifications; access to microphone, camera, photos and local network, each via the iOS permission prompt. Without consent the app keeps working, only that feature does not. You can withdraw consent at any time in iOS Settings with effect for the future.

8. Recipients and processors

We only share data with service providers we need to run the service. Data processing agreements under Art. 28 GDPR are in place with them.

• Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513 – database, authentication, file storage and realtime channel. Hosting region: EU (Ireland, on Amazon Web Services, region eu-west-1).
• Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland – Microsoft Azure: MCP server, music recognition (beta) and container registry in the North Europe region (Ireland); website hosting via Azure Static Web Apps.
• Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland – Sign in with Apple and Apple Push Notification service (delivering notifications), TestFlight and the App Store. Apple partly acts as an independent controller here.
• 650 Industries, Inc. (Expo), 624 University Ave FL1, Palo Alto, CA 94301, USA – Expo push service: forwards notifications including the device token to Apple.

Other members of your band see the band’s content, your display name, your role, your instrument and your replies to events. We do not share data with any other third parties unless required by law.

9. Transfers to third countries

The app’s data is stored in the EU. Some service providers are based outside the EU (Supabase, Expo) or belong to groups headquartered in the USA (Microsoft, Apple). Where data may be transferred to a third country, the following applies per provider:

• Supabase (Singapore): data is stored in the EU (Ireland). Access from third countries, for example for operations and support, is covered by the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR), which are part of Supabase’s data processing agreement.
• Microsoft (group headquartered in the USA): Microsoft Corporation is certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR); in addition, Microsoft’s data processing agreement includes the standard contractual clauses. This also covers the global delivery of the website.
• Expo (USA): 650 Industries, Inc. is certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR).
• Apple: for Sign in with Apple and the push service, Apple also processes data as an independent controller under its own privacy policy, including any transfers to the USA.

10. Retention

• Account and profile: until your account is deleted.
• Band content (songs, setlists, sheet music, events): as long as the band exists. Content belongs to the band and remains available to the other members when you leave. Deleted entries are removed immediately; a deletion marker (identifier and time only) remains so that the deletion reaches every device.
• Private notes: until you delete them or your account is deleted.
• Push tokens: until you sign out on the device, Apple reports the token as invalid, or your account is deleted.
• AI assistant change log: 90 days; older entries are deleted automatically every day. After that, those changes can no longer be undone.
• Technical logs: at Supabase, 7 days at most. We have not set up any log storage for the MCP server and music recognition on Microsoft Azure; their output is not stored permanently. For the website, see section 3.
• Data on your device: until you delete the app or sign out.

Statutory retention obligations remain unaffected.

11. Leaving a band, deleting your account

Leave a band: in the app under Bands → band → Band settings → “Leave band”. You will then no longer see the band’s content and others will no longer see you as a member.

Delete your account: in the app under Account → “Delete account”. This immediately deletes your account and your name, your band and group memberships, private notes, your drawings, texts and own edits in the sheet music, your responses to events, your push tokens and all of your account’s data on the device. Bands in which you are the only active member are deleted with all their content. What belongs to the other members of your bands (songs, setlists, sheet music, events, notes for everyone, change log) remains, but without any reference to you. If you are the last admin of a band with other members, make another member an admin first.

You can also email us from your account’s email address at support@bandagent.app. We will then delete your account within 30 days and confirm the deletion.

You can also stop using Sign in with Apple for bandAgent in iOS: Settings → your name → Sign in with Apple → bandAgent.

12. Your rights

You have the right to

• access your stored data (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing based on legitimate interests (Art. 21 GDPR),
• withdraw consent with effect for the future (Art. 7(3) GDPR).

To exercise them, email support@bandagent.app. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority responsible for your place of residence or for us. The authority responsible for us is:

13. Other

• No automated decisions: there is no automated decision-making, including profiling, under Art. 22 GDPR.
• Obligation to provide data: you cannot use the app without an account; everything else (display name, instrument, band logo etc.) is optional.
• Minimum age: the app is intended for people aged 16 and over.
• Security: all connections are encrypted with TLS. Access rights are enforced per band in the database.
• Changes: we update this policy when the app or the law changes. The version published here applies.