Privacy and cookies

The person below is responsible for the data of TJP accounts. For anything about your data, write to the contact address.

• Owner: Joan Subirats Llaveria
• Tax ID (NIF): 47937839D
• Address: Avinguda Catalunya 4, 2n 2a, 43540 La Ràpita (Tarragona), Spain
• Email: hello@tjp.app

We handle what is needed for you to have your site and run it:

• Account: email, password (stored encrypted; we never see it) and plan.
• What you publish: texts, photos, audio, dates, links and each site’s settings. It is yours and you decide.
• Messages sent to you from your site: kept in your inbox until you delete them.
• Feedback you send us from Studio, with the page and browser you sent it from.
• Technical errors (what failed and where), to fix them.
• Use of Studio (which screens are used), only if you accept it in the cookie notice.
• The anti-bot check (Cloudflare Turnstile) on sign-up, password reset and new verification codes: when you start filling in the form, Cloudflare receives your IP address and browser data to run it.

Each musician is responsible for their site and the messages they receive on it. TJP hosts it and handles that data on their behalf.

We count visits without cookies: from your IP and browser we compute a code that changes every day and cannot tell who you are. The IP is not stored. We keep the page viewed, where you came from, your approximate country, your language and your type of browser and device.

If you write to the musician with their site’s form, we pass on your name, email and message (and the date of the gig, if you give one), by email and in their Studio inbox.

To tell people from automated programs, the contact form of a musician’s site and the password form of a protected page use Cloudflare Turnstile, an anti-bot service. It loads when you start filling in the form (a click, a tap or Tab into it), not before; Cloudflare then receives your IP address and browser data to run the check. It is the only third-party service that loads on those forms.

• Providing the service you ask for when you create an account (contract).
• Security, preventing abuse, fixing errors and counting visits for musicians (legitimate interest).
• Studio usage analytics with cookies (your consent, which you can withdraw at any time).
• Meeting legal obligations where there are any.

We do not sell data or use it for advertising. These providers handle it on our behalf:

• Vercel (USA): hosts Studio and the sites.
• Convex (USA): database and accounts.
• Cloudflare (USA, worldwide network): stores and serves photos and audio, and runs the anti-bot check (Turnstile) on forms.
• Resend (USA): sends the emails (codes, message notices).
• Sentry (servers in the EU): records technical errors.
• PostHog (servers in the EU): analytics for TJP’s own pages and for Studio; it uses cookies only if you accept them.
• Google (USA): Google Analytics on TJP’s own pages (page.tjp.app), only if you accept its cookies; without advertising features.
• Anthropic (USA): only if you ask for a suggested translation, it receives the text to translate.

Some providers are in the USA. Those transfers rely on the EU-US Data Privacy Framework or on the European Commission’s standard contractual clauses.

• Your account and your sites: as long as you have the account. When you delete it, we delete everything of yours.
• Inbox messages: until you delete them or delete the account.
• Visits and clicks, one by one (the page viewed, where you came from, your approximate country, language and type of device): 30 days.
• Daily totals of those visits and clicks, with nothing that identifies a visitor: 400 days.
• Backups: deleted automatically within 30 days at most.
• Technical errors and analytics: per Sentry’s, PostHog’s and Google Analytics’ periods, 14 months at most.

You can ask to access your data, correct it, delete it, take it with you, object to or restrict its use, and withdraw your consent. In Studio’s Settings you can download your data and delete your account; for anything else, write to hello@tjp.app. If you visited a musician’s site, write to them or to us and we will pass it on.

If you think we have not handled your data well, you can complain to the Spanish Data Protection Agency (aepd.es) or to the authority where you live.

Studio uses a cookie to keep you signed in and stores your theme and language in your browser: these are necessary and need no permission. PostHog analytics uses cookies only if you accept them; if you decline, we count usage anonymously, without cookies. You can change your choice at any time in Studio’s Settings. TJP’s own pages (page.tjp.app) ask whether you accept PostHog’s analytics cookie (ph_…_posthog, kept for one year), which tells us whether you come back and how you move through them. Until you accept, we count visits without cookies and keep only your answer in your browser, so we do not ask again. If you accept, Google Analytics also sets its cookies (_ga and _ga_…, kept for up to two years) on page.tjp.app only, never on the musicians’ sites; until you accept it is not even loaded. You can change it at any time from “Cookies” at the foot of every page; withdrawing deletes the cookies.

Musicians’ sites use no cookies and store nothing in your browser, except a necessary cookie when you open a password-protected page.

The anti-bot check on forms (Cloudflare Turnstile) is run by Cloudflare, not by us. Cloudflare states that the signals it collects (your IP address, browser data and the site it runs on) are strictly necessary to detect bots, and that it cannot directly identify individuals from them. We set no cookie for it and do not use its optional pre-clearance cookie. It loads only when you start filling in a form.

Apart from the anti-bot check, nothing from another service loads without your choice. Players, videos and maps from other services (Spotify, YouTube, SoundCloud, Bandcamp, Apple Music, Google Maps) do not load until you press to see them and agree to load them; only then may that service use its own cookies, under its own policy. Your choice lasts for that visit and is not stored. We serve video stills ourselves: nothing is sent to YouTube until you choose to watch one.

If we change anything important in this policy, we will email account holders before it applies.