Privacy policy
Last updated: October 18, 2026
This policy explains what personal data RecMusicians Pro Agenda processes, why, with whom it is shared and what rights you have. It is based on Law 81 of March 26, 2019 on Personal Data Protection of the Republic of Panama (Ley 81 de 2019) and its regulations, Executive Decree 285 of May 28, 2021 (Decreto Ejecutivo 285 de 2021).
1. Data controller
Richard Javier, Republic of Panama. Email: recmusicianspro@gmail.com. See also the Legal notice.
2. Processors and third parties
We use these providers to run the app:
- Supabase, Inc. (processor): hosts the database (Postgres), account authentication (Supabase Auth), real-time sync (Realtime) and file storage (Storage). Supabase privacy policy.
- Cloudflare, Inc. (processor): hosts and delivers the website (Cloudflare Pages) and protects it from attacks. To do so, it processes technical connection data such as IP address, browser and time of visit. Cloudflare privacy policy.
- Google (Google AdSense): shows ads in the app. Google and its partners may use cookies and identifiers to show ads, personalize them based on your visits to this and other websites, measure them and prevent fraud. For that data, Google acts under its own policies. Advertising cookies are only activated if you accept them in the consent notice. You can see how Google uses cookies in advertising and turn off personalized ads in Google's ad settings.
- Google Chrome (Android app only): the Android app opens this same website full screen through Chrome or another compatible browser installed on your phone (Trusted Web Activity). The app itself does not collect additional data; your browser's own policies apply.
- Services you choose to use: if you tap “WhatsApp,” “Call” or “Share,” the app opens WhatsApp, your phone dialer or your device's share menu. What you send from there is governed by those services' policies.
We do not sell or rent your personal data. We will only hand it over to authorities when required by law or a valid court order.
3. What data we process
a) Your account data (on the server)
- Name and email address.
- Password: managed by Supabase Auth and stored as a cryptographic hash. Nobody, not even us, can read it.
- Technical account data: creation date, last sign-in and email verification.
b) Group data (on the server)
- Group name and its unique invitation code.
- Members: name, role and, if the host adds them, mobile number and photo.
- Events (rehearsals, performances, recordings), places, travel (departure, origin, destination and times), group messages, daily notes and ideas.
c) Files: photos, PDFs, audio and voice notes
- Photos and PDFs (in the cloud): profile and member photos (compressed, 300 KB maximum) and sheet music and charts in PDF (5 MB maximum) are stored in private Supabase Storage spaces, protected by access rules and with no public links. They can be seen by the members of the group where they are shared; a PDF the host sends privately can only be seen by its recipient.
- Audio and voice notes (on your device only): guide audio and voice recordings or voice notes are not uploaded to the server. They are stored only in your device's browser storage (IndexedDB). If you clear your browser data or change phones, they are lost.
d) Data on your device
Your signed-in session, your preferences (language, reminders), a temporary copy for fast loading and the app cache. See the Cookie and storage policy.
e) Technical and advertising data
The IP address and browser data that Cloudflare and Supabase process to deliver and protect the service, and the data Google AdSense processes if you accept advertising cookies.
If you add other people's information (name, mobile number, photo or voice), you must have their permission.
4. What we use it for
- Creating and protecting your account and signing you in.
- Displaying, saving and syncing in real time your schedule and your groups' schedules.
- Letting group members see shared information and letting the host edit it.
- Sending you reminders of your events, if you turn them on.
- Showing ads (personalized only with your consent) to keep the app free.
- Preventing abuse and fraud, and complying with legal obligations.
5. Legal basis
We process your data based on your consent. You give it when you create your account and accept this policy, when you join a group, when you add information and when you accept advertising cookies in the notice. Microphone and notification permissions are requested by your browser. You can withdraw your consent at any time: change your ad preferences, remove the browser permissions or delete your account. Withdrawing it does not affect processing carried out before.
6. Who sees your data
- Group members: everything shared in a group (events, places, travel, messages, notes, ideas, member details and shared files) can be seen by all members of that group.
- Host: can create, edit and delete shared content and the member details of their group, and can let other members edit.
- Your personal schedule and your account: only you can see them.
- Files: photos and PDFs shared in a group can be seen by its members; a PDF sent privately, only by its recipient. Audio and voice notes are only on your device (see 3.c).
- Providers: Supabase and Cloudflare access the data only to provide the service.
7. Where data is stored and international transfers
Server data is hosted by Supabase in the us-east-2 (Ohio, United States) region. Cloudflare delivers the website from its global network. Supabase, Cloudflare and Google are companies based in the United States, so your data is transferred and processed outside Panama. These providers apply contractual and technical safeguards. By accepting this policy you consent to these transfers, in accordance with Law 81 of 2019 and Executive Decree 285 of 2021.
8. How long we keep data
- We keep your data while your account is active.
- If you delete your account, we delete your data from the server within 30 days. Residual copies may remain for a short time in our provider's (Supabase's) internal systems, according to its own policies. We do not keep our own backup copies of your data.
- If you delete your account, we delete your name, your email and your profile data. Messages and contributions you made to a group may remain in that group so its history is not broken, but they no longer show your name: they appear as “Deleted user.” If you want them deleted too, write to us at recmusicianspro@gmail.com.
- Data on your device is deleted when you sign out, clear the site data or uninstall the app.
- We may keep data longer only if a law requires it.
9. Security
- All traffic is encrypted with HTTPS.
- The database uses row-level security (RLS): only a group's members can read its data, and only the host and the people the host authorizes can edit it.
- Passwords are stored as hashes in Supabase Auth.
- We limit access to data to what is necessary to operate the service.
No system is 100% secure. Protect your account with a unique password and your phone with a screen lock. If a security breach affects your data, we will notify you and the authority as required by law.
10. Your rights (ARCO and portability)
Law 81 of 2019 grants you these rights:
- Access: to know what data of yours we process.
- Rectification: to correct inaccurate or incomplete data.
- Cancellation: to ask us to delete your data.
- Objection: to object to certain processing on legitimate grounds, for example personalized ads.
- Portability: to receive your data in a structured, commonly used format.
How to exercise them:
- In the app: correct your name and photo in My account. To download a copy of your data as a JSON file (portability), use Menu → Export a copy (JSON). To delete everything, use My account → Delete account: your account, your server data and the photos and PDFs you uploaded to Supabase Storage are actually deleted. Your contributions to groups remain as “Deleted user” (see §8).
- By email: write to recmusicianspro@gmail.com from your account email and say which right you want to exercise. We may ask you to confirm your identity. We will respond within the time limits set by law.
If a group host added information about you (for example, your mobile number or photo), you can ask the host to correct or delete it, or write to us directly.
11. Minors
The app is not directed at children under 13, and they must not create an account. If you are between 13 and the age of majority, you may only use it with the authorization and supervision of your mother, father or guardian. If we learn that we hold data of a child under 13 without that authorization, we will delete it. To let us know, write to recmusicianspro@gmail.com.
12. Changes to this policy
If we change this policy, we will update the date above. If the change is significant, we will announce it in the app and ask for your consent again when the law requires it.
13. Contact and supervisory authority
Write to us at recmusicianspro@gmail.com. If you believe your rights were not respected, you can file a complaint with Panama's National Authority for Transparency and Access to Information (ANTAI), through its Personal Data Protection Directorate: www.antai.gob.pa.
This is an English translation provided for convenience. The Spanish version is the original; if the two versions differ, the Spanish version prevails to the extent permitted by law.