Privacy Policy

This Privacy Policy explains how Fncy Studio, trading under the name StageRally ("we", "us"), processes personal data when you use our website (stagerally.app), web application (live.stagerally.app), and iOS/iPadOS app (also called Rally inside the app). We process your personal data in accordance with the EU General Data Protection Regulation (GDPR / AVG).

1. Who is the Data Controller?

The data controller responsible for processing your personal data is:

• Company name: Fncy Studio (trade name: StageRally)
• Address: Tribunusallee 3, 6852 RJ Huissen, The Netherlands
• Chamber of Commerce (KvK): 96672412
• VAT number: NL005224547B94
• Privacy contact email: support@stagerally.app

2. What Personal Data Do We Process?

• Account data: your display name, email address, hashed password (or your Apple authentication token if you use Sign in with Apple), language preference, and text-scale settings.
• Band data and user content: the bands you belong to, your role within each band (owner/band leader, admin, member, or crew), invitations sent and accepted, and all content stored by you and your band: songs, lyrics, chords, personal notes, setlists, gigs, crew messages, and whether a crew message was marked as seen.
• Technical data for live sync and security: device and browser type, session state, IP address, the iOS app push token (so crew messages can be delivered), timestamps of changes (audit metadata within your band), and technical error or security logs needed to synchronize setlists live across screens and prevent abuse.
• Payment and billing data: payments are processed via Stripe (on the website) or Apple (in the iOS app). We never see or store full credit card or bank card numbers. We only receive and store your subscription status, selected plan, customer/subscription ID, and invoice references for our accounting records.
• Analytics: PostHog records page views, clicks, technical errors, and load times (web vitals) in the web app and on the marketing site. On the marketing site we also record button clicks (including the visible button text), opened questions, scroll depth, and campaign parameters (UTM). On a missing page we keep the path, the query string, and the referring site. In the web app we do not store any visible text from buttons or screens, and we strip tokens from links before anything is sent. IP addresses are not stored. Without your consent this stays anonymous. With your consent we tie your usage to your account (your account ID, email address, and name) and make session recordings: a reconstruction of what you do on screen, with all text and input fields hidden. Nothing is recorded during a live set or on shared links. In the iOS app, PostHog records which screens you open, when the app starts and closes, and crashes and unexpected errors. Without your consent this stays anonymous, with a new ID every time the app starts. With your consent we tie it to your account. The iOS app makes no session recordings. When a subscription starts, changes, or ends, our server also sends PostHog the plan, status, and price for that band. That never includes a name, email address, or account ID.

3. Purposes and Legal Bases for Processing

4. Sub-processors and Service Providers

We never sell your personal data to third parties. To deliver StageRally, we use the following specialized sub-processors with whom we have entered into data processing agreements:

5. International Transfers Outside the EEA

Our primary database is hosted within the European Union. Some of our service providers (such as Stripe, Apple, Vercel, Resend, RevenueCat, and PostHog) are based in the United States or may process data outside the European Economic Area (EEA). Whenever personal data is transferred outside the EEA, we ensure appropriate safeguards in accordance with Chapter V of the GDPR, namely certification under the EU-US Data Privacy Framework (DPF) (European Commission adequacy decision) and/or the European Commission's Standard Contractual Clauses (SCCs).

6. Retention Periods per Category of Data

We do not retain your personal data longer than necessary for the purposes for which it is processed:

• Account data: retained for as long as you have an active StageRally account. When you delete your account in Account Settings, your profile and authentication data are deleted immediately.
• Band data (songs, setlists, lyrics, chords, notes, and gigs): retained for as long as your band is active (including when a band returns to the free Soundcheck plan after a paid subscription, so you don't lose your repertoire). Items you delete remain in the Bin for 30 days before being permanently erased. When you delete your account, bands where you are the only member are permanently deleted immediately.
• Crew communication messages: retained for a maximum of 90 days after sending (or deleted earlier if the band is deleted).
• Technical and security logs: live-sync position state is ephemeral during the session; server and security logs are retained for 30 to 90 days.
• Session recordings: 30 days, then deleted automatically.
• Invoice and accounting records: retained for 7 years after the end of the relevant fiscal year to comply with statutory Dutch tax retention obligations (Belastingdienst).

7. Your Rights and Right to Lodge a Complaint

Under the GDPR, you have the following rights regarding your personal data:

• Right of access: request an overview of the personal data we process about you.
• Right to rectification: update your name and band details directly in the app, or ask us to correct inaccurate data.
• Right to erasure ("right to be forgotten"): permanently delete your account and solo bands directly in Account → Delete account (both in the web app and the iOS app), or by emailing us.
• Right to data portability (export): receive the data you have stored with us in a structured, commonly used, machine-readable format.
• Right to object and restriction: object to processing based on legitimate interest or request restriction of processing. You can unsubscribe from trial tip emails with a single click at the bottom of any such email.
• Right to withdraw consent: where processing is based on consent (such as analytical cookies and session recordings), you can withdraw it at any time from Cookie settings in the site footer, from Settings in the web app, or from Settings → Privacy in the iOS app. Withdrawing is as easy as giving consent.

To exercise any of these rights, contact us at support@stagerally.app. We will respond within 30 days.

Right to lodge a complaint with a supervisory authority: You always have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or the data protection authority in the EU Member State where you reside or work.

8. Cookies and Local Storage

• Strictly necessary functional storage: In the StageRally web app and on our website, we use local browser storage (localStorage and IndexedDB) to keep you signed in, remember your language, screen rotation, and font size preferences, and cache your songs and setlists locally on your device so the app works offline on stage. No cookie consent is required for this strictly necessary functional storage.
• Analytics without consent (PostHog): Until you give consent, PostHog measures anonymously. Nothing is stored on your device: each visit gets a temporary ID that disappears when you close the page, and nothing is tied to your account.
• Analytical cookies with consent: If you choose "Accept all" in the cookie banner, PostHog sets a cookie on .stagerally.app (name starts with ph_, valid for up to 1 year). That lets us recognize your visit across the site and the web app, tie it to your account once you sign in, and make session recordings with all text and input hidden. If you choose "Essential only", none of this happens and we remove any ph_ cookies set earlier. We keep your choice in the functional cookie stagerally_consent (1 year), so you don't have to choose twice on the site and in the app. You can change your choice from Cookie settings in the footer or from Settings in the web app. The iOS app does not use cookies. There you choose on first launch whether we can tie your usage to your account, and you can change that from Settings → Privacy. We do not use advertising cookies anywhere. Fonts are served from our own servers, not from Google.

9. Minimum Age (Young Musicians in Bands)

We know that young musicians also play in bands and worship teams. You must be at least 16 years old to independently create a StageRally account. If you are under 16, you may only create an account with the consent of your parent or legal guardian. If we learn that personal data of a child under 16 has been collected without required parental consent, we will delete it promptly upon request.

10. How We Protect Your Data

We implement appropriate technical and organizational security measures to protect your data against loss or unauthorized access:

• All connections between your device and our servers are encrypted via TLS/HTTPS;
• Passwords are stored hashed and encrypted via Supabase Auth;
• Data is strictly isolated per band at the database level using Row-Level Security (RLS), ensuring only authorized members of a band can access that band's songs and setlists;
• Payments are handled entirely by certified payment processors (Stripe and Apple, PCI-DSS compliant).