Privacy Policy

Last updated: June 20, 2026

Template — review before launch. This is a starting draft, not legal advice. Have it reviewed and tailored (especially the billing, user-content, and governing-law sections) before relying on it.

RiffRep is a local-first practice player. Your library of songs, loops, and setlists lives on your device in your browser's storage (IndexedDB). We collect as little as possible, and most features work with no account at all.

What we collect

  • On your device only. Your songs, loops, setlists, and practice settings stay in your browser unless you create an account and enable sync. We never upload or host your audio files.
  • Account. If you sign in, we store your email address to send magic-link sign-in emails and to identify your account. Authentication is handled by Supabase.
  • RiffRep Pro. If you subscribe, checkout and billing are handled by Lemon Squeezy (our Merchant of Record). We do not see or store your card details.

Service providers

We share the limited data above with the providers that run RiffRep: Supabase (authentication and synced metadata), Lemon Squeezy (subscription payments and tax), and Google / YouTube (the embedded video player). These providers process data on our behalf under their own terms.

YouTube

RiffRep uses YouTube API Services to embed and control the YouTube player. By using RiffRep you also agree to the YouTube Terms of Service. Google's handling of data is described in the Google Privacy Policy. RiffRep only controls playback (play, pause, speed, seek) in the embedded player; it never downloads or stores video or audio from YouTube.

Cookies and local storage

We use a strictly-necessary cookie to keep you signed in, and your browser's local storage (IndexedDB) to hold your library on-device. We do not use advertising cookies or third-party analytics, so RiffRep does not show a cookie-consent banner.

Your rights

You can view and edit your library at any time, and delete your account to remove your account data. Depending on where you live (for example the EU/UK under GDPR, or California under the CCPA), you may have rights to access, correct, export, or delete your personal data. Contact us to exercise them.

Children

RiffRep is not directed to children under 13, and we do not knowingly collect their data.

Changes

We may update this policy; we'll revise the “Last updated” date above when we do.

Questions? Contact [email protected].