Privacy Policy

Last updated: October 28, 2026

1. Information We Collect

We collect information you provide directly to us, including phone numbers for authentication, email addresses you submit for drop alerts, payment information (processed securely via Stripe), and profile data. A drop-alert signup may also include an optional name, the site the form was on, optional tags, and an optional band.

2. How We Use Information

We use the information we collect to facilitate fan backing, queue sell-backs, send the drop alerts you asked for, maintain platform security, and provide customer support.

3. Data Sharing

We do not sell your personal data. Information is shared with trusted third parties only to provide our services. Stripe processes payments. Resend delivers email. For each message, Resend receives the address, the message, and the unsubscribe headers for that send.

4. Email Storage and Unsubscribe

Drop-alert signups are stored in our notes database, one row per email address, with the address in lowercase. That database is the Postgres store for the notes list at post.bandcoins.com. Each row keeps the address, any optional name, source, tags, and band, the status (pending, confirmed, or unsubscribed), the time you signed up, the IP address and browser string sent with the form, and the tokens that make the confirm and unsubscribe links work. Signing up again with the same address updates that row.

We send one confirmation note before we treat the address as subscribed. Until you confirm, the row stays pending. We do not sell this list.

Every note includes a one-click unsubscribe link. That link opens post.bandcoins.com/newsletter/unsubscribe with a token for your address. The same link is in the message List-Unsubscribe header, so your mail app can unsubscribe in one click. Using it marks the address unsubscribed, and we send no further notes to it. We keep the row so we know you left and so that link still works. You can join again from BandCoins. To ask us to delete the stored address, write to support@bandcoins.com.

5. Cookies and site analytics

Public pages may load Google Analytics 4. It records a page view on each public page, plus a few product actions: newsletter signup, sign-in started, sign-in completed, band page view, and checkout started. The admin page does not load this script. Every analytics hit, including hits Google sends on its own, uses a page path as the title and a page address with email, phone, and name query values removed. The referrer sent with those hits is the referring path only. Those events do not include email addresses, names, or phone numbers. Google Analytics may store a cookie such as _ga to tell browsers apart. You can block or delete cookies in your browser settings. A build configured with a blank measurement id does not load the analytics script.