Privacy Policy

What FixGix collects, why, who else touches it, and what you can ask us to do about it.

This is a draft. FixGix is pre-release and this policy has not been reviewed by a lawyer. Sections marked TO FILL are incomplete. It describes what the software actually does today, which is the part we can be accurate about.

Who is responsible

FixGix is run by Mater — Muziek & Media (Steven de Lange), the data controller for everything described here.

TO FILL: registered trading address, country of establishment, and Chamber of Commerce (KVK) number.

Reach us about anything on this page at stevenmater@gmail.com.

What we collect

Your account. An email address, and a password if you did not sign in with Google. Credentials are held by Supabase Auth and never reach our own database — we store a reference to your account, not your password.

Your profile. A username, a display name, the disciplines you perform, and an avatar if you upload one.

What you put into the app. Groups and their members, your role in each, Gigs with their dates, venues and statuses, who is assigned to each Gig and the fee agreed with them, tasks and who they belong to, and an activity record of changes made within a group.

Invitations. If someone invites an email address that has no FixGix account, we store that address until the invitation is accepted or withdrawn.

Notifications. What we have sent you and whether you have read it, plus a browser push subscription if you turn push notifications on.

Chat. The Messages you send in a Chat: what you wrote, when, what it replies to and whether you edited it, plus when you last read each Chat and whether you archived it. In a Gig's Chat the people on that Gig and its Group's Managers can read them, in a Group's Chat its members, each only for the time they were part of it. A direct message is read by its two people only; to someone you share no Group or Gig with, your first Message is a request they can accept or decline, and a decline is not shown to you. Messages are encrypted in transit and at rest, but not end-to-end, so they are not hidden from FixGix itself. Deleting a Message erases its text. A push notification about one carries a short preview, encrypted for your browser.

Blocks. Who you have blocked, and when. Only you can see it: the person you block is never told. While it stands they cannot find you, invite you or write to you, and a direct message between you can be read but not added to. Unblocking deletes the record, and so does either of you deleting your account.

We do not ask for a phone number or a home address, we run no advertising or analytics trackers, and we do not profile you or make automated decisions about you.

Why we hold it, and on what basis

• To run the service you signed up for — your account, your groups, your Gigs. Performance of a contract.
• To send you the emails and notifications the app produces, such as being added to a Gig. Performance of a contract, and you can turn email off in your settings.
• To keep the service secure — sign-in protection, abuse prevention, and server logs. Legitimate interest.

Who else processes it

FixGix is built on services that process data on our instructions. We use no others.

• Supabase — the database and the authentication system. This is where almost everything described above lives.
• Vercel — hosting. Serves the application and keeps short-lived request logs.
• Resend — delivers transactional email. Receives the recipient address and the message.
• Google Maps — venue search and the map picture on a Gig. Searching for a venue sends what you type to Google, and dropping a pin sends that point to them to look up its address; both happen only while someone is editing a Gig. The map image on a Gig loads from Google, which reveals your IP address and browser to them, as any externally hosted image does. The Navigate button sends nothing until you press it.
• Cloudflare Turnstile — bot protection on the sign-in, sign-up and password-reset forms. Turnstile is currently switched off in production and is not processing anything. When it is re-enabled, your use of it is subject to Cloudflare’s Turnstile Privacy Addendum, and we will say so here without this caveat.

TO FILL: confirm the hosting region of each service and name any transfer outside the EEA, with the safeguard relied on.

Cookies and browser storage

No advertising or analytics cookies. What we do set is needed for the app to work:

• Sign-in cookies, set by Supabase Auth, which keep you logged in.
• A language cookie, remembering whether you chose English or Dutch.
• A theme preference, stored in your browser, so the app opens in light or dark as you left it.
• A push subscription, only if you allow notifications. Issued by your browser, stored by us so we can send to it.

Email

We only send email the app produces: confirming your address, resetting a password, invitations, and notifications about your groups and Gigs. There is no marketing mail. Notification email can be switched off in your settings or through the unsubscribe link in any notification message — security and account email cannot, since it is how you get back into your account.

How long we keep it

Your data stays while your account exists. Deleting your account removes your profile and the data attached to it; records of your activity within a group may remain visible to that group as part of its own history.

Chat Messages are deleted with their Chat. A Gig's Chat is deleted with the Gig, and a direct message once both its people have deleted their account. If you delete your account, the Messages you sent stay in their Chat under the name you had, as part of its history.

TO FILL: concrete retention periods, including how long backups and server logs are kept, and the grace period between deletion request and erasure.

Your rights

Under the GDPR you can ask for a copy of your data, correct it, have it deleted, receive it in a portable format, restrict how we use it, or object to our processing. Email the address above and we will answer within one month.

You can also complain to your national data protection authority. In the Netherlands that is the Autoriteit Persoonsgegevens.

While FixGix is pre-release

The app is unfinished and says so on the front page. Until the first full release we may reset the database, which deletes the Gigs, groups and lineups you have entered. Your account itself is not the thing we reset, but do not let FixGix be the only place your schedule lives.

Changes

If this policy changes in a way that affects you, we will say so in the app rather than quietly editing this page. The date at the top always reflects the current version.