What data we collect
- Artists / Creators: email address, password (hashed), profile information (name, bio, genre, location), uploaded images, and any content you add (releases, tour dates, social links). Account type (Artist or Creator) is stored to customize your experience.
- Fans: email address, first name, city, state, country, and phone number (if provided) — collected through artist-embedded forms on fan pages. This data belongs to the artist, not to bckstg.
- Spotify pre-save tokens: When a fan opts into a Spotify pre-save, we store an encrypted OAuth refresh token scoped to
user-library-modify. This token is used only to save the release to the fan's library on release date and for no other purpose. - Analytics: page view counts by country, referrer URLs, streaming platform click events (platform and release ID only — no personally identifiable information), and fan city request aggregates.
How we use your data
- To provide and operate the bckstg service.
- To send transactional emails (password resets, subscription receipts).
- To show artists their fan analytics.
- We do not use your data for advertising or sell it to third parties — ever.
No selling of data
bckstg does not sell, rent, or trade personal data of artists or fans to any third party. Fan data collected through your fan page belongs to you (the artist) and is never used by bckstg for its own purposes beyond operating the service.
Data storage and security
All data is stored in the European Union via Supabase. We use row-level security, encrypted connections (TLS), and hashed passwords. We perform regular backups.
Third-party services
- Supabase — database and authentication. Data stored in the EU.
- Stripe — payment processing. We never see or store full card numbers. Subject to Stripe's Privacy Policy.
- Spotify — optional pre-save flow. Refresh tokens are stored encrypted and scoped to library modification only. Subject to Spotify's Privacy Policy.
- Laylo — optional integration. If an artist connects Laylo, fans who opt in have their email and phone (if provided) sent to Laylo to subscribe them to the artist's drop list. Subject to Laylo's Privacy Policy. bckstg never stores your Laylo API key in a readable form — it is used server-side only.
- Vercel — hosting and CDN.
Your rights and data export
You have the right to access and delete your data at any time. Pro and Lifetime users can export data in CSV or JSON format from the dashboard. To request full data deletion, email us at contact@bckstg.co and we will complete the request within 30 days.
Cookies
We use only essential session cookies for authentication. We do not use tracking cookies or advertising cookies.
Children's privacy
bckstg is not directed at children under 13. We do not knowingly collect data from children.
Changes to this policy
We will notify you by email at least 14 days before any material changes to this policy take effect.