Downbeat — Privacy Policy

Effective Date: February 18, 2026

Last Updated: March 22, 2026

1. Introduction

This Privacy Policy describes how Curtis Clogston ("Downbeat," "we," "us," or "our") collects, uses, stores, and protects your personal information when you use the Downbeat tour management application ("Service").

We are committed to protecting your privacy. We do not sell your personal information. We do not use your data for advertising. We collect and process data only as necessary to provide and improve the Service.

By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy.

2. Information We Collect

2a. Information You Provide Directly

When you create an account and use the Service, you may provide:

Account Information:

Name
Email address
Password (stored as a cryptographic hash; we never store or have access to your plaintext password)

Profile Information:

Phone number
Dietary restrictions and allergies
Emergency contact (name, phone number, relationship)
Shirt size
Tour status (Active, Occasional, Inactive)

Tour and Schedule Data:

Tour dates, venues, cities, and event schedules
Advancing information (venue contacts, production details, hospitality notes, parking, WiFi, lodging details)
Lodging information (hotel names, addresses, confirmation numbers, check-in/checkout times)
Flight information (flight numbers, passenger names, departure/arrival airports and times)
Drive event details (source/destination addresses, departure times)
Setlists and guest lists
Meal orders and menu attachments
Venue notes and debrief information
File attachments (stage plots, input lists, riders, menus, contracts)

Communications:

Emails you forward to the Service for processing (advance emails, flight confirmations, lodging confirmations, routing sheets)
Feedback and bug reports you submit
Urgent alerts and notifications you send through the Service

Payment and Subscription Information:

Subscription plan selection (e.g., Van, Bus, Multi-Bus) and billing interval (monthly or annual)
Subscription status, subscription identifiers, and Stripe customer identifiers stored in our database to manage your account
All payment processing is handled by Stripe, a PCI-compliant third-party payment processor. Payment method details (such as credit card numbers) are entered directly in Stripe's hosted checkout form and are never transmitted to, processed by, or stored on our servers.

Audio Recordings:

The Service may access your device microphone, with your permission, to record audio during venue debriefs. Audio recordings are sent to Anthropic's Claude API for transcription and are not stored after processing is complete. You may decline microphone permission and enter debrief notes manually instead.

2b. Device Sensors and Camera (Digi Gaff Feature)

When you use the Digi Gaff venue navigation feature, the Service may access device hardware with your permission:

Camera: Used for augmented reality (AR) navigation within venues. The camera feed is displayed on-screen in real time to overlay navigation guides (gaff tape arrows) onto your view of the physical space. Camera images are processed on-device only and are never transmitted to our servers, stored, or shared with third parties.
Motion sensors (accelerometer, gyroscope, compass): Used to track your movement and heading within a venue for step-by-step navigation. Sensor data is processed on-device in real time and is not transmitted to our servers or stored after your navigation session ends.
GPS / Location: Used to determine your approximate position when starting navigation (e.g., identifying which venue entrance you are near) and to anchor spatial data during venue mapping. Location data collected during mapping is stored as part of the venue map (latitude/longitude of key waypoints) to enable navigation for all users at that venue. Real-time GPS data used for position detection during navigation is processed on-device and is not stored.
Barometric pressure sensor: Optionally used during venue mapping to detect floor-level changes. Barometer readings are processed on-device and are not stored after the mapping session.

All sensor and camera permissions are requested only when you use the Digi Gaff feature. You may decline these permissions and still use all other features of the Service. Venue maps created from sensor data are shared with other team members who visit the same venue.

2c. Information Collected Automatically

When you use the Service, we automatically collect:

Authentication data: Login timestamps, session tokens, and device information necessary for account security
Push notification tokens: Device tokens required to deliver push notifications, stored only while you have notifications enabled
Analytics data: Basic page performance and usage metrics collected by Vercel Analytics and Vercel Speed Insights. This data is aggregated and anonymized — it does not include personal information, tour content, or individually identifiable browsing activity.

2d. Information from Third-Party Services

When you use certain features, we receive information from third-party services:

Google Maps Platform: Drive time estimates, venue location data, and place details (addresses, phone numbers, coordinates) based on addresses and locations you provide
AeroDataBox: Flight status information (departure/arrival times, delays, gate numbers, cancellations) based on flight numbers you enter
BandsInTown: Publicly available event listing data (dates, venues, times) for artists you connect through the Service

3. How We Use Your Information

We use your information for the following purposes:

(a) To provide the Service: Storing and displaying your tour schedules, advancing information, and logistics data. Sending notifications about schedule changes, flight updates, meal ordering deadlines, and other tour-related events. Processing forwarded emails and documents to extract and structure tour information. Calculating drive time estimates and tracking flight statuses.

(b) To maintain and secure the Service: Authenticating your identity. Detecting and preventing unauthorized access. Resolving technical issues and bugs.

(c) To improve the Service: Using anonymized, aggregated, and de-identified usage data (such as feature adoption patterns and general usage statistics) to improve functionality and user experience. This data does not identify you or any individual and does not include the content of your tour schedules, communications, or personal details.

(d) To communicate with you: Sending Service-related communications (account verification, password resets, security alerts). Sending notifications you have opted into (schedule changes, flight updates, meal reminders). Responding to your feedback and support requests.

4. Artificial Intelligence Processing

Certain features of the Service use artificial intelligence provided by Anthropic (Claude API) to process data you submit. Specifically:

What is processed by AI:

Emails you forward to the Service (advance emails, flight confirmations, lodging confirmations, routing sheets)
Text you paste into the Service for parsing (routing sheets, flight details)
Quick notes you enter for classification and extraction

How AI processing works:

Your submitted content is sent to Anthropic's Claude API for analysis and data extraction.
The AI identifies and extracts structured information (dates, times, venues, contacts, production details, flight information, lodging details) from unstructured text.
Extracted data is stored within the Service and associated with your tour dates.

Roadie AI Assistant:

The Service includes Roadie, a conversational AI assistant powered by Anthropic's Claude API. You may interact with Roadie via text messages and photo uploads (e.g., photos of rooming lists, parking signs, or venue information).
Text messages and photos you send to Roadie are transmitted to Anthropic's Claude API for processing. Photos are used solely to extract relevant information and are not retained by Anthropic beyond the duration of the API request.
Conversation history — including your messages, Roadie's responses, and actions taken on your behalf — is logged in our database for debugging, audit, and service improvement purposes.
Roadie only processes content you actively send. The assistant does not passively monitor your data or initiate processing without your interaction.

What Anthropic does with this data:

Anthropic's API terms state that data submitted through their API is not used to train their AI models.
Anthropic processes the data solely to generate a response and does not retain it beyond the duration of the API request.
For the most current information on Anthropic's data practices, see Anthropic's Privacy Policy at https://www.anthropic.com/privacy.

Your control:

AI processing only occurs when you actively submit content (forwarding an email, pasting text, entering quick notes). The Service does not passively monitor or process your data with AI.
You may choose not to use AI-powered features and instead enter all information manually.

5. How We Share Your Information

We do not sell, rent, or trade your personal information. We share your information only in the following circumstances:

5a. With Your Team Members

Tour information you create is shared with team members you invite to your artist roster, in accordance with the role-based access controls you configure:

Owners and Managers can view and edit all tour data for their artists.
Members can view tour data but have limited editing capabilities.
Tour status settings (Active, Occasional, Inactive) determine which dates and notifications each team member receives.

You control who has access to your tour data by managing your artist roster.

5b. With Third-Party Service Providers

We use the following third-party services to operate the Service. Each receives only the minimum data necessary for their function:

Provider	Purpose	Data Shared
Supabase	Database hosting, authentication	All User Data (encrypted at rest and in transit)
Vercel	Application hosting, analytics, speed insights	Application requests and responses, anonymized performance metrics
Google ARCore	Augmented reality (on-device)	Camera frames and sensor data processed locally on your device; no data sent to Google
Resend	Email delivery (notifications, alerts, inbound email processing)	Email addresses, notification content, forwarded email content
Anthropic (Claude API)	AI processing of emails and text	Content of forwarded emails, pasted text, and quick notes submitted for AI processing
Google Maps Platform	Drive time estimates, venue location lookup	Addresses and location names you provide
AeroDataBox	Flight status tracking	Flight numbers and dates
Stripe	Payment processing	Email address, subscription plan selection; payment method details are entered directly in Stripe's hosted form and never pass through our servers
Firebase Cloud Messaging (Google)	Push notification delivery (Android)	Device push tokens
BandsInTown	Event listing sync	Artist IDs (public data; no personal information sent)

5c. As Required by Law

We may disclose your information if required to do so by law, regulation, legal process, or governmental request, or if we believe in good faith that such disclosure is necessary to protect our rights, your safety, or the safety of others.

5d. In Connection with a Business Transfer

If Downbeat is acquired, merged, or sells substantially all of its assets, your information may be transferred as part of that transaction. We will notify you of any such transfer and any changes to this Privacy Policy.

6. Data Security

We implement reasonable technical and organizational measures to protect your personal information, including:

Encryption in transit: All data transmitted between your device and our servers is encrypted using HTTPS/TLS.
Encryption at rest: Your data is encrypted at rest in our database (provided by Supabase).
Authentication: User authentication is handled by Supabase Auth with secure password hashing, session management, and token refresh.
Row-Level Security: Database access is enforced through row-level security policies that restrict data access based on user identity and role.
Access control: Role-based permissions ensure that users can only access data appropriate to their role within an artist's roster.

No method of transmission or storage is completely secure. While we strive to protect your information, we cannot guarantee absolute security. If you become aware of a security vulnerability or suspect unauthorized access to your account, please contact us immediately at curtis.clogston@gmail.com.

7. Data Retention

Active accounts: We retain your data for as long as your account is active and as needed to provide the Service.
Deleted accounts: When you delete your account, we will delete your personal data within 30 days, except where retention is required by law or necessary for legitimate business purposes (such as resolving disputes or enforcing our Terms).
Forwarded emails: Email content processed by AI is not stored after extraction. Only the structured data extracted from emails is retained within the Service.
Notifications: Read notifications are automatically purged after 30 days. Date-linked notifications expire at the end of the associated show day.
Backups: Deleted data may persist in encrypted backups for up to 90 days before being permanently removed.

8. Your Rights and Choices

8a. Access and Portability

You have the right to access your personal data. Most of your data is visible directly within the Service (profile, tour dates, schedules, advancing information). You may request a copy of your data by contacting us at curtis.clogston@gmail.com.

8b. Correction

You can update your personal information at any time through the Service (profile settings, tour data editing).

8c. Deletion

You may delete your account at any time through the Service or by contacting us at curtis.clogston@gmail.com. Account deletion will remove your personal data in accordance with Section 7.

8d. Notifications

You can control push notification delivery through your device settings and through notification preferences within the Service. Disabling push notifications will not affect in-app notifications.

8e. AI Processing

You may choose not to use AI-powered features (email forwarding, text parsing, quick notes classification). All tour data can be entered manually.

9. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

Right to know: You may request the categories and specific pieces of personal information we have collected about you.
Right to delete: You may request deletion of your personal information, subject to certain exceptions.
Right to non-discrimination: We will not discriminate against you for exercising your privacy rights.
No sale of personal information: We do not sell your personal information as defined by the CCPA/CPRA.
No sharing for cross-context behavioral advertising: We do not share your personal information for cross-context behavioral advertising.

To exercise these rights, contact us at curtis.clogston@gmail.com. We will verify your identity before fulfilling your request.

10. Children's Privacy

The Service is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly. If you believe a child has provided us with personal information, please contact us at curtis.clogston@gmail.com.

11. International Users

The Service is hosted in the United States. If you are accessing the Service from outside the United States, your data will be transferred to and processed in the United States. By using the Service, you consent to this transfer and processing. We do not currently market the Service to users in the European Economic Area (EEA) or United Kingdom, but if you are located in these regions and use the Service, please be aware that your data will be processed in the United States.

12. Cookies and Local Storage

See our Cookie and Storage Policy (Section 13) for details on how we use cookies, local storage, and similar technologies.

13. Cookie and Storage Policy

What We Use

Authentication Cookies/Tokens:

We use cookies and/or local storage to maintain your authenticated session. These are essential for the Service to function — without them, you would need to log in on every page visit. These are first-party only (set by downbeat.pro) and are not used for tracking or advertising.

Service Worker and Offline Cache:

If you enable notifications or use the Service offline, a service worker may cache application files and tour data on your device. This cached data is stored locally on your device and is not transmitted to third parties. Cached data is used solely to provide offline access and deliver push notifications.

Push Notification Tokens:

When you enable push notifications, your browser generates a unique token that is stored on our servers to deliver notifications to your device. This token does not contain personal information and is deleted when you disable notifications or delete your account.

What We Do NOT Use

Third-party tracking cookies
Advertising cookies or pixels
Analytics cookies (Vercel Analytics operates without cookies and does not track individual users)
Social media tracking pixels
Cross-site tracking of any kind

Managing Storage

You can clear cookies and local storage through your browser settings. Note that clearing authentication cookies will require you to log in again. Disabling cookies entirely may prevent the Service from functioning correctly.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Service at least 14 days before the changes take effect. Your continued use of the Service after the effective date constitutes your acceptance of the updated Privacy Policy. The "Last Updated" date at the top of this policy indicates when it was last revised.

15. Contact Us

If you have questions about this Privacy Policy, want to exercise your privacy rights, or have concerns about how your data is handled, please contact us at:

Curtis Clogston

Email: curtis.clogston@gmail.com

Boerne, Texas

This Privacy Policy is effective as of the date stated above and applies to all users of the Downbeat Service.