Your data.
Clear choices.

Who runs Stems Together?

Stems Together is an independently operated community beta run by Thomas Elderhorst. For privacy questions or data requests, email stemstogether.info@gmail.com.

What we collect and why

We store your account username, password hash, optional email and verification status; your profile name, creator type, genres, private self-reported age, biography and profile image; uploaded audio and its track information; saved tracks, timestamped track feedback, conversations, collaboration notes, blocks and reports. This information lets us provide your account, audio library, discovery and collaboration features, enforce contact rules, and respond to abuse. Passwords, recovery keys and session tokens are stored as hashes.

City map and weekly challenges

If you choose a city, we store its public city-centre coordinates and an offset for your map pin. We never request GPS, an address or a live location. Map visibility starts off; you can change it in Profile. Hidden, blocked and suspended members are excluded from map pins and nearby counts. The globe library and fallback outlines load from Stems Together. Detailed geographic tiles and map fonts originate from OpenFreeMap / OpenStreetMap and are delivered through an authenticated Stems Together proxy. We build upstream requests with a fixed service identifier rather than forwarding your browser’s cookies, authorization, profile or private content. The provider receives hosting-service requests for public geographic tiles and fonts, subject to its infrastructure and logging policies. Country-outline fallback data comes from Natural Earth; city search runs on our own GeoNames index. Search covers major cities and administrative centres.

Finish It stores challenge joins, entries, optional notes and votes. Entries remain private to the entrant before voting (authorized moderation can review them), then are shared with eligible signed-in members during voting and results. Linking a Private track creates a separate challenge copy without exposing the original private upload. Entries and votes are removed when the account is deleted; deleting the original upload does not remove a separate challenge entry. Contact us to withdraw an entry. Security history records selected challenge and map-preference actions without track content.

Who can see your content?

Your public profile and Community tracks can be seen by signed-in members across age groups, subject to blocks. Private tracks are served only to their owner. Conversations and shared notes are available to their participants. Other members do not receive your age. The site operator and authorized hosting systems can process stored data to run the service and investigate incidents. Messages are not end-to-end encrypted.

Timestamped track feedback

We store the author, track, audio timestamp, text and creation time of feedback notes. Notes follow the track’s current visibility and mutual blocks: Community feedback is readable by signed-in members who can access that track; Private track notes remain owner-only. Posting to someone else’s track follows the existing age-group and communication settings. Authors can delete their notes; track owners and authorized moderators can remove notes on accessible tracks. Track deletion removes its notes, and account deletion removes notes authored by that account. Report records may remain for incident handling.

Profile pictures and audio

The browser prepares profile pictures as JPEGs. The server decodes and re-encodes them without copying original EXIF/GPS or comments. SVG uploads are rejected. Audio has file-type and size checks, which are not a full malware scan. Shared previews can be copied by listeners; no platform can make that impossible.

Optional community and notifications

We store follows, in-app activity notifications, optional channel memberships, channel posts and emoji reactions, and age-correction requests. Community channels are opt-in and visible to joined members. Announcements allow owner posts and member emoji reactions. Private tracks cannot be shared into these channels. Blocks and moderation apply. You can leave a channel, unfollow a creator and delete your own community posts. Leaving a channel does not delete its earlier posts. Notifications keep the latest 300 events per recipient; age requests stay for support review until account deletion or an approved data-removal request. Account deletion removes these social records linked to your account. No email or push notifications are enabled.

Cookies and browser storage

A Secure, HttpOnly, SameSite cookie keeps you signed in for up to 30 days. Sign-out invalidates that session on the server. Browser storage remembers your light/dark choice. The app has no advertising trackers. Our separate Shopify landing page may use Shopify cookies and has its own privacy information.

Security records

We record account identifiers, event type, outcome and time for selected account, upload and moderation events. We do not put passwords, tokens, audio, message bodies or raw IP addresses in this security history. Temporary authentication limits use hashed network addresses and usernames.

Retention and deletion

Account data, profiles, audio and conversations stay until deleted or until you ask us to remove the account. Account deletion removes uploaded audio and associated conversations and revokes its sessions. Security-history account references are anonymized when the account is deleted. Security events expire after 30 days, rate-limit records after 24 hours, and authentication attempts after one day. Cleanup runs during service activity rather than on an exact timer.

Reports can remain while an abuse issue is unresolved. Contact us to request a review of whether retention is still needed. Hosting-provider logs and any backups have their own retention and deletion processes; deleting live records does not guarantee immediate removal from every provider backup.

Providers

Sites hosting and Cloudflare database/object storage provide the app infrastructure. Shopify hosts the separate landing page. When email delivery is connected, Google’s Gmail API sends account welcome, email confirmation and password-reset messages from stemstogether.info@gmail.com. These messages include your account username, recipient address and the necessary account link. Google processes delivery and stores sent mail in the support mailbox. We record delivery attempts and provider acceptance; acceptance does not guarantee inbox delivery. Providers may process information outside your country. We do not sell your music, and the app does not send it to AI services for analysis or training.

Your choices

You can edit your profile, choose track visibility, delete tracks, block producers and report content. To delete your account, open Profile → Privacy & data → Delete my beta profile and uploads. Email us to request access, correction, export or deletion. We verify account ownership before sharing or changing private information. Contact us if you have an objection or concern about how we process your data.

Young creators

The beta is for people aged 13 or older. Age is self-reported and not independently verified. Private contact is restricted by age group, blocks and privacy settings.

Security concerns

Email our contact address with “Security report” in the subject. Include the minimum details needed to reproduce a problem. Do not send passwords, recovery keys or other users’ private files. See security.txt.

This notice describes the current beta. The complete privacy arrangements, provider terms and legal requirements still need professional review before a wider public or paid launch.