Privacy Policy
Last updated:
Prodboard is a project-management, backup and file-sharing service for music producers. This policy explains exactly what we collect, why, where it lives and what you can do about it. It is written to be read, not to be survived.
The short version: we store what the product needs to work: your account, your projects and the files you upload. We do not sell your data, we do not use it to train AI models, and we never see your card details.
Who we are
Prodboard is operated by MG Studio, a business registered in Israel, which is the data controller for the information described here. For anything in this policy, including data requests, write to support@prodboard.io.
What we collect
Account
Your email address, display name and (if you sign in with Google) your profile picture. Passwords are handled by our authentication provider and are never visible to us; if you sign in with Google we never receive a password at all. The choices you make in Settings are kept with your account too, such as your language, time zone, the day your week starts, the DAWs you work in and your notification and email preferences.
Your content
Everything you put into the product: project titles, notes, tasks, tempo and key, financial figures you record, contacts you add, and the files you upload (audio, stems, DAW project files, cover art and voice notes). This is your material. We store it so the product can show it back to you and so you can share it.
Your public page
Your public page is off unless you switch it on, in the Public page tab of Settings. While it is on, what you choose to show on it is public at app.prodboard.io/u/ followed by the address you pick, and search engines may list it. Public pages, below, says exactly what it shows, and what happens to the messages and reports people send from it.
Backups from the desktop app
If you install the desktop app and point it at your project folders, it backs up each project folder, with version history, so you can restore it later: the DAW project file and the other files kept in the folder with it, such as samples and renders. Samples a project plays from outside its folder are uploaded only if you turn that on.
With each version it stores facts it reads from the project file, such as tempo, key, time signature, number of tracks, DAW version, the plugins the project uses, how many samples it uses and what changed since the last save. It also stores where the folder is on your computer, and the computer's name and operating system. Separately, it reads the plugin list each of your DAWs keeps and uploads it whenever it changes (each plugin's name, maker and format, and which DAW found it and when), so another of your computers can tell whether a project will open there.
Besides the folders you choose, it watches your Desktop and the folder you last picked a preview from, because DAWs often export there. When a new audio file appears in any of them while your DAW is running, the app takes it for a render and uploads the loudest 30 seconds or so of it (or the whole file, if it is not a WAV) as the preview of the project you are working on. You can switch this off with Preview from exports in the desktop app's settings. A preview you capture yourself with the capture shortcut is uploaded the same way. If you ask the app to find a project you saved somewhere else, it looks for it in a few likely folders, such as your Music, Documents and Desktop folders, and asks you before adding it.
Session tracking
When the desktop app is running it records when a DAW session starts and ends, which DAW it was, which project, how many saves you made, and the name of the machine. To notice a session it looks at which programs are running and reads the title of your DAW's window; on a Mac that needs the Accessibility permission. It splits each session into active and idle time by how long it has been since you last used the keyboard or mouse. It reads only that time, never what you type. This is what produces your studio-time statistics.
Share analytics
When someone opens a link you shared, we record the event (viewed, played, completed, downloaded, commented), the country, the device type, the referring page and how long they listened, so you can see whether a client actually heard the track.
We do not keep visitors' IP addresses. Before an event is written, the address is replaced by a short hash made from it and the day's date, purely so repeat visits on the same day can be counted. That makes it pseudonymised rather than anonymous: with the date, an IPv4 address could be worked out again by trying every possible one. The address itself is used for about a minute as a rate-limit counter (ten minutes when the page reports an error) and then discarded.
People you share with
Depending on how you set up a share link, the people who open it can leave their name, comments (including ones pinned to a moment in a track), voice notes (recordings of their voice), an approval or a request for changes with a message, and, on a stems share, files sent back to you with a note. If you send a link to someone by email, their address is stored with it. All of this is kept with your share, and deleted when the share is deleted (after 30 days in the Trash) or when you close your account.
Diagnostics
Ordinary server logs: request paths, status codes, timing and error traces. They exist to fix faults and to stop abuse.
Crash and error reports. When the desktop app crashes or hits a serious error, it sends us a report: the error, where in its code it happened, the app version, and your operating system and its version, plus a note if you send one yourself. Before a report leaves your computer, the app takes out the user-name part of file paths, email addresses, anything that looks like a key or a token, and the names of DAW project files, audio files and ZIP files (their extension stays). Folder names and the names of other files can remain in a report. Our server applies the same rules again when it arrives. These reports are on by default; switch them off with Send crash reports in the desktop app's settings. When a page of the web app hits an error, your browser sends a similar report: the error, which page it happened on (never the full address), the app build, your browser and operating system, and the page's language, direction, theme and window size. Those can come from any page, including a share link or a public page opened by someone without an account, and there is no switch for them. A report is linked to your account if you were signed in, and kept for 90 days. If you close your account, its reports stay, with the link to you, the page details and any note removed.
What we do not do
- We do not sell or rent your data to anyone, for any purpose.
- We do not use your audio, projects or files to train AI models.
- We do not run advertising or third-party ad trackers.
- We never receive your card number. Payments are handled entirely by our payment provider (see below).
- No person here listens to your audio, with one exception: if someone reports a work on your public page or a file in a share link to us, we play that work or file to review the report. Apart from that, nobody at Prodboard plays your tracks, and no employee opens your projects. Our servers do read the audio automatically, because several features cannot work otherwise: drawing the waveform you see on a file, packing a backup into a ZIP, and streaming a share to whoever you sent the link to. That processing is machine-only, happens because you asked for the feature, and nothing is kept from it beyond what you can see in the app.
Why we are allowed to hold it
Under the GDPR our legal bases are: performance of a contract for everything the product needs in order to function (your account, your content, your backups); legitimate interests for security, abuse prevention and basic diagnostics; legal obligation for billing and tax records; and consent for anything optional, which you can withdraw at any time.
Who processes it for us
We keep the list deliberately short, and each provider below processes data for us under its data processing terms.
| Provider | What for | Where |
|---|---|---|
| Supabase | Database and sign-in | Ireland (EU) |
| Cloudflare R2 | File storage | Western Europe |
| Cloudflare Workers | Holds the master key that protects your account's encryption key, opens sealed files to play them back to you, and builds the ZIP when someone downloads a whole share | Global network |
| Cloudflare Turnstile | Checks that a person, not a bot, is using the sign-in, sign-up and password-reset forms, or a public page's contact and report forms. To decide, it sees your IP address, your browser's user agent and TLS fingerprint (how it sets up a secure connection) and which site the form is on; it does not read what you type into the form. Cloudflare also uses these signals, as their controller, to improve its bot detection (see its Turnstile privacy addendum). | Global network |
| Backblaze B2 | Second copy of files and of the database backups, for disaster recovery | Central Europe (EU) |
| GitHub (Microsoft) | Runs the nightly database backup and the copy to Backblaze, and keeps an encrypted copy of the database for 30 days | United States |
| Vercel | Hosting | EU / global edge |
| Upstash | Rate limiting | Ireland (EU) |
| Resend | Email, including the updates you opted into | Ireland (EU) |
| Lemon Squeezy | Payments and invoicing | United States |
| Sign in with Google, and the profile photo that comes with it: until you upload a photo of your own, the browser of anyone who sees it (on your public page, a share link or in the app) loads it from Google (see Public pages); AI cover art, on paid plans | Global | |
| Anthropic | The written insights, the daily studio plan and the weekly review, on paid plans (the plan and review also once as a preview during a trial) | United States |
| OpenAI | AI cover art, only when we use it instead of Google | United States |
Your files and database records are stored in the European Union; the one exception is the encrypted database copy GitHub keeps for 30 days. Some of the work happens outside the EU: payments (Lemon Squeezy), sign-in with Google, AI cover art (Google, or OpenAI if we switch covers to it), the written insights, the daily plan and the weekly review (Anthropic), the backup jobs (GitHub), and the parts of Cloudflare and Vercel that run on their global networks, near whoever is connecting. These transfers rely on the European Commission's Standard Contractual Clauses.
Where AI is used, and what it is given
Three features in Prodboard call an AI provider. All three are on paid plans (a trial also gets one AI-written daily plan and weekly review, as a preview, on its third day), and none of them touch your audio.
- AI cover art. A text prompt describing a picture, built from your track's genre, tempo and key (never its title), is sent to Google, or to OpenAI if we switch covers to it, to generate the image. It runs only when you choose to generate a cover.
- The written insights on your Insights page. What is sent is
statistics about how you work: hours, sessions, streaks, which hours of the week you
are productive, how long projects sit at each stage, how many versions you saved,
your top genres, median tempo and most-used keys, and, if you track money in
Prodboard, your income, expenses and per-project profit. Project
names are replaced with tokens (
p1,p2) before anything leaves us, and put back on your screen afterwards, so the provider never receives the name of a track. - The daily plan and weekly review. The same shape of information, for the day or week it covers (the weekly review without your money: it shows that figure itself), with project, share and task names replaced the same way, and the language you use Prodboard in (for the daily plan, your time zone too).
Your audio, your project files, your backups and your file names are never sent to an AI provider, for any feature. Cover art has three ways that call nobody: upload your own image, pick one from the library, or shuffle a generated pattern. The insights, the daily plan and the weekly review have a rules-based version underneath, which is what you see on a free plan or a trial (apart from that one preview) and whenever the AI is unavailable.
Payments
Lemon Squeezy is the merchant of record for every Prodboard subscription. They collect your payment details and billing address directly, handle sales tax and VAT, and issue your invoice. Prodboard receives only your email address, the plan you bought, the subscription status and the renewal date. We never see or store card numbers.
How long we keep it
- While your account is open: as long as you keep it there.
- After you delete something: a deleted project or share goes to the Trash, where you can restore it for 30 days; after that it is purged from storage, or sooner if you empty the Trash. Deleting a project leaves the share links you sent from it working, unless you choose to delete them too. Anything else you delete is removed from the product immediately and purged from storage within 30 days.
- After you delete your account: content and files deleted within 30 days. Billing records are kept for seven years, because tax law requires it.
- After a trial ends and you never subscribe: 90 days, then deleted.
- After a subscription lapses: 12 months, then deleted. You can download everything throughout, and we email you four times before the date.
- Server logs and crash reports: up to 90 days.
- Share analytics: for the life of the share link.
- Your public page: for as long as your account exists. A page you switch off, or whose plan has lapsed, is hidden and kept as it was, and it is deleted with your account. Its works play files from your shares, so after a lapse a work stops playing once its file is deleted on the schedule above. An old address forwards for 12 months, and our record of it is deleted once those 12 months are over. We keep at most your last five, and a record goes sooner if you take that address back or close your account.
- Messages sent from a public page: in the producer's inbox until the producer deletes them or closes the account.
- Reports about a public page: until 12 months after we have dealt with them, then deleted, or sooner if the account they are about is closed.
- IP addresses on public pages: only as rate-limit counters, for about an hour on the contact and report forms and about a minute for opening a page and playing its works.
- Backups: up to about 120 days. Everything above describes the live service, but we also take a nightly encrypted backup of the database, and keep a copy of your files with a second storage provider, so that a bad day at one company is not the end of your work. A file you delete is purged from live storage on the schedule above, and from the second copy about 30 days after that. Anything you delete can also still exist inside a database backup taken before you deleted it: we keep each of those for 90 days, and the second copy holds it for about 30 days more, until it expires on its own.
We do not read those backups, and we never restore one to bring back something somebody deleted. They exist for one purpose: putting the service back if it breaks. For the same reason a backup cannot be edited: being unable to rewrite history is the whole point of one. That is why deleted data leaves a backup by expiring rather than by being reached into.
Your rights
Wherever you live, you can ask us to show you what we hold, correct it, export it, delete it, or restrict what we do with it, and you can object to processing based on legitimate interests. In the EU and UK these are statutory rights; we apply them to everyone.
Two of these you can do yourself, in the Profile tab of Settings in the web app: download every file in your account as one ZIP, and close your account (section 15 of the Terms explains how closing works).
Email support@prodboard.io and we will reply within 30 days. We will not make you jump through hoops, and asking costs nothing. If you are in the EU and unhappy with the outcome, you may complain to your national data protection authority.
Security
Traffic is encrypted in transit. Files are served through short-lived signed URLs rather than public links, so a shared file cannot be found by guessing.
Project backups made by the desktop app are encrypted before they leave your computer. The desktop app seals each file with a key belonging to your account, and what arrives on our storage is the sealed version. Sealing started in September 2026: backups an up-to-date desktop app has saved since then are sealed. Versions saved before that date, or by a copy of the app that had not been updated, are stored unsealed and stay that way. Backing a project up again seals its current files; it does not go back and change older versions.
Other files are stored as they were uploaded, not sealed: files you upload in the browser (audio, stems, recordings, cover images, your photo and the files in a share), the files and voice notes people send back through a share, the preview clips the desktop app uploads, and the copies made when you share files from a backup, which have to play for whoever you send them to. A backup version you download as a ZIP is built as an unsealed copy; it is deleted from our storage within a day, and from the second copy within about 30 days. The names of your files, what you type into the app, the facts the app reads from your projects (such as tempo, key and plugins), plugin lists and waveforms are stored readable too, because the product shows them to you.
This is not end-to-end encryption, and we will not call it that. We hold your account's key, deliberately. You have to be able to get your work back after a lost laptop, a reinstall or a forgotten password, and for a backup product “we cannot help you” is not a feature. It also means our servers open a sealed file when the product needs one: drawing a waveform, building a download, playing it back to you, or copying it into a share you create. Nobody here listens to your music, apart from a reported work or file as described under What we do not do, but the honest statement is that the capability exists rather than that it does not.
Database access is controlled in the application: every action checks who you are and that what you asked for belongs to you. Row-level security is switched on in the database as a second line behind that, not as the first.
We are, however, a small operation and no service can promise perfection. If you find a security problem, please tell us at support@prodboard.io and we will treat it as urgent.
Share links
A Prodboard share link is unlisted, not secret. Anyone holding the URL can open it unless you set a password, restrict it to named recipients or give it an expiry date. Search engines are asked not to index share pages, but the honest way to think about a link you send is that it can be forwarded.
Public pages
A public page is a producer's page at app.prodboard.io/u/ followed by an address they choose: their work to listen to, where to find them, and a way to get in touch. Each page is off until its producer switches it on. If you came here from the contact or report form on a page, the first three parts below are about you.
Messages sent from a page
The contact form asks for your name, your email address and your message, and lets you add the service you are after, a budget, the number of songs, a deadline and a song or a link. When you press Send, all of it goes to the producer's inbox in Prodboard, and usually by email to the address on their account as well. Your email address goes with it, so a reply goes straight to you. We send you nothing ourselves and add you to no list.
The message is stored in our database as part of the producer's account, and in the app only the producer can see it. It stays there until they delete it or close their account; the copy in their email is theirs. If you want a message you sent deleted, write to support@prodboard.io.
Reports
Report this page, at the foot of every page, asks what is wrong (a copyright problem, someone being impersonated, the cover photo, abuse, spam or something else), which work it is about if any, and any details, and asks for your email address only if you want an answer. A report goes to Prodboard, not to the producer, and we review it. If we act on it, the producer is told what we did and why, never who reported it. We keep each report, with the address you gave, until 12 months after we have dealt with it, and then delete it; if the account it is about is closed before that, the report is deleted with it. For a formal copyright notice, see Copyright and takedown in the Terms.
How both forms are protected
Both forms are checked by Cloudflare Turnstile, which tells a person from a program. It runs in a frame served by Cloudflare, which reads your IP address and technical details of your browser and its connection; when you send, our server passes your IP address to Cloudflare once more to confirm the result. Cloudflare uses these details for the check and to improve it, and says it does not use them to identify, profile or target anyone.
We also limit how much can be sent: five messages and five reports an hour from one IP address, and at most 30 messages and 20 reports a day to one page. To count, we use your IP address as the name of a counter and for nothing else, and it expires after about an hour. It is never stored with your message or your report. Opening a page and playing its works are limited the same way, per minute, so there the address is kept for about a minute. Apart from that, and the ordinary server logs described under Diagnostics, we keep no record of who opens a page or listens to it. If the producer's photo is the one from their Google account, though, your browser loads it from Google, which then receives your IP address and your browser's details, and sees that the photo was shown on app.prodboard.io. We handle what you send, and your IP address, on the basis of legitimate interests: delivering what you chose to send, and keeping the forms free of abuse.
What your page shows
While your page is on, anyone with its address can open it. It always shows your display name, your photo (the one for clients, if you set one) or your initials, and the ways to contact you and to report the page; your email address is never on it. It shows your hours in the DAW unless you switch them off: the active time the desktop app measured, in whole hours, over a fixed four-week block that ended at least two full weeks ago. It shows the DAWs you work in only if you switch that on. The rest is what you add in the editor: a cover photo, a headline, your city, languages and availability, your bio, genres and who you sound like, the services you offer, a contact line, credits, links to your profiles elsewhere, and up to three works.
Nothing you add reaches the page until it is stored: what you type and the switches when you press Save, a photo or a work the moment you add it. The bio and city you may already have in Settings first show there when you save the page in the editor, and not before, even if you add a cover photo or a work first. The page never shows the names of your files or projects, your plugins or your devices.
A work plays the file exactly as it was uploaded. It is one of the audio files you have already shared from Prodboard, under a title you type; the file's own name is never shown. Tags saved inside the file, such as a title, an artist or a comment, travel with it, and anyone who looks can read them. The page offers no download, but anything a browser can play can be recorded. Unless you switch it off, a work shows its project's cover art. A work stays on the page if you switch its share link off, let it expire or give it a password. Deleting the share, or moving it to the Trash, takes the work off the page, and restoring it from the Trash brings the work back.
Your cover photo is cleaned of its hidden data. Our server makes a fresh copy from the picture alone, with no EXIF, no GPS location, no camera details and no other metadata, so it cannot give away where your studio is, and the photo as you uploaded it is never stored. Your profile photo is not cleaned this way on our server.
When someone shares your page's address in a chat or on social media, the preview image shows only what the page shows: your name, your headline, your hours if you show them, the first work's cover art and your photo.
Search engines
Search engines may list your page and show it in their results. Switch on Hide from search engines and the page asks them not to; that does not make it private, and anyone with the address can still open it. A page on a trial, or one with no bio and no works yet, always asks them not to list it, and a trial page's links ask them not to follow. What other services have already copied, such as a search result or a link preview in a chat, is theirs to remove and can take a while to go.
When a page goes away
Switch your page off, or let your plan lapse, and the page, its audio and its link preview answer "not found" at once. Nothing on it is deleted, and it comes back when you switch it on again or your plan is active again. A lapse has one later effect: the works play files from your shares, and once those files are deleted on the schedule under How long we keep it, those works no longer play. We can also suspend a page, take a work off it or remove its cover photo after a report (see Public pages in the Terms); a suspended page answers "not found" too, with nothing on it deleted. If you change your page's address, the old one forwards to the new one for 12 months and is held for you in that time, and then our record of it is deleted; we hold your five most recent ones.
If your account is closed, the page goes with it: its content, its works, its cover photo, its old addresses, the messages in your inbox and the reports made about it are deleted with the account. Its address is free again at once, and anyone can then take it.
Cookies and browser storage
Only what is necessary. Cookies first, then what is kept in your browser's own storage instead of a cookie; the law treats both the same way, so both are listed. A name ending in * stands for a group of names that start the same way.
| Cookie | What it does |
|---|---|
sb-* | Keeps you signed in. Set by our authentication provider. |
locale | Remembers the language you picked. |
currency | Remembers the currency you chose for figures and invoices. |
hide-amounts | Remembers whether you chose Hide amounts on this device. |
daw-prefs | A copy on this device of the DAWs you work in and your main one, which your account keeps, so the app stops asking. |
prodboard_onboarded | Remembers that you finished setup, so it does not start over. |
pb_trial_ack | Remembers that you dismissed the trial notice, so it stays dismissed. |
pb_storage_ack | The same, for the storage notice. |
pb_rail | Remembers that you kept the notifications panel open beside your work. |
sidebar-collapsed | Remembers whether you collapsed the sidebar. |
pb_unlock_* | Proves you entered a share link's password, so you are not asked again for six hours. One per link. |
| Stored in your browser | What it does |
|---|---|
theme, pb_theme | Remembers whether you chose light or dark. |
pb_lang | Remembers the language you picked on this website. |
projects-*, project-tasks-view, shares-view | Remembers how you left the app laid out: views, sizes, sort order and a reminder you dismissed. |
prodboard_ | Remembers how far you got through setup, so a reload does not send you back to the start. |
pb-setup-complete | Remembers that you finished setting up the desktop app. |
prodboard. | Remembers which weekly review you have already seen. |
prodboard. | Remembers whether you turned on Match session tempo for your recordings. |
session-note-templates | The quick notes you saved for your sessions. |
prodboard_ | The name you typed when commenting on a share link without an account, so you do not type it again. |
prodboard_ | Comments you started on a share link and have not sent yet, so a reload does not lose them. |
prodboard:, prodboard:, pb_tz_synced, pb.handoff.retried, pb.chunkReloaded, prodboard: | Kept only until you close the tab: which settings tab and insights section you had open, that your time zone was already saved, and three markers that stop a page from retrying or reloading in a loop (the last one holds the address of a page that reloaded once to load the bot check, and when). |
No advertising cookies, no analytics cookies, no third-party trackers: we run none, on this site or in the app. Everything above is either strictly necessary or a preference you set yourself, which is the category that does not require consent under the ePrivacy Directive and the GDPR. So there is no cookie banner to dismiss, and that is a deliberate choice rather than an oversight.
Children
Prodboard is not intended for anyone under 16. If you believe a child has created an account, write to us and we will remove it.
Changes
If we change this policy in a way that materially affects you, we will email you before it takes effect. The date at the top always reflects the current version.