Privacy Policy

Last updated September 9, 2026

1. Who we are

RiffPile ("we," "us," or "the Service") is a multi-tenant band archive operated by Dev Hero, based in Rhode Island, USA. We provide private workspaces for bands to store songs, recordings, show materials, and related content.

Contact: hello@riffpile.com.

2. Scope

This Privacy Policy explains what information we collect, how we use it, and the choices available to you when you use RiffPile. It applies to the Service at riffpile.com and related apps or sites we operate. It does not cover third-party websites or services that we do not control.

3. What we collect

Depending on how you use the Service, we may collect:

Account data — name, email address, and authentication details processed by our sign-in provider (Clerk), plus profile details you choose to set in the Service.
Band & workspace data — band name, membership, roles, invites, access-code usage, and settings for each workspace.
Band content — songs, notes, audio recordings, images (such as show flyers and album art), setlists, practices, shows, availability, and other materials you or your bandmates upload.
Billing data — subscription status, plan, and customer or subscription identifiers via Stripe. Payment card details are handled by Stripe; we do not store full card numbers.
Usage & technical data — basic logs such as browser or device type, timestamps, and error reports needed to run, secure, and debug the Service. Our hosting provider processes your IP address to deliver and protect the Service, but we do not store it against your account or your request for access: the abuse limits on our public forms use a one-way hashed form of it that is deleted within a day.
Cookies & similar technologies — session and authentication cookies (including those set by Clerk) and other cookies or local storage needed for sign-in, security, and core product features, plus optional analytics cookies that are set only if you accept them (see "Analytics & cookies" below). We do not use advertising trackers as part of the core Service.

4. How we use information

We use this information to:

Provide, maintain, and improve the Service
Authenticate users and enforce band membership and plan limits
Store and deliver your Content within private workspaces
Process subscriptions, trials, and complimentary access
Prevent abuse, secure the Service, and respond to support requests
Comply with legal obligations where applicable

We do not sell your personal information or band content. We do not use your recordings or other Content to train public AI models.

5. Private workspaces

Band workspaces are private by default. Content is available to authenticated members of that band (and to us as needed to operate and support the Service). We do not make your archive publicly searchable or publicly listed as part of normal operation.

6. Who we share with

We use trusted service providers ("processors") to operate RiffPile. They process data only to provide services to us, under appropriate contractual terms. These include, at a high level:

Clerk — authentication and account identity
Stripe — subscription billing and payment processing
Cloudflare (including R2) — file storage and related delivery
Resend — sending transactional email (invites, notifications)
Mapbox — rendering show-location maps and geocoding addresses; your browser loads map tiles directly from Mapbox when you view a map
Google — analytics, only if you accept analytics cookies (see "Analytics & cookies" below)
HeyCatch — product analytics: which features get used and where people get stuck, only if you accept analytics cookies (see "Analytics & cookies" below)
Meta — measuring our advertising, only while we are running Meta campaigns and only if you accept analytics cookies (see "Analytics & cookies" below)
Database and application hosting providers (for example Neon and Vercel) — storing app data and running the Service

We may also disclose information if required by law, legal process, or government request, or when we believe disclosure is necessary to protect the security of the Service, our users, or Dev Hero.

If we were involved in a merger, acquisition, or asset sale, information may be transferred as part of that transaction, subject to continued confidentiality commitments where applicable.

7. Analytics & cookies

We use Google Analytics 4 to understand how the Service is used in aggregate — for example which pages are visited, general browser and device type, and approximate region derived from IP address. We use this to improve the product, and we do not use it to identify individual band members.

We also use HeyCatch for product analytics — which pages and features get used, and where people get stuck. Unlike the aggregate picture above, this is tied to your account once you are signed in: we send HeyCatch your user ID, email address and name so we can tell whether a feature is working for real bands, and we record when an account is created and when a subscription starts. It loads only if you accept analytics cookies, and declining leaves it switched off entirely.

While we are advertising RiffPile on Facebook or Instagram, we also load the Meta Pixel. It reports whether a visit came from one of our ads and whether it led to a request for access, which is how we tell a campaign that reaches bands from one that only spends money. This is advertising measurement rather than product analytics, and Meta may also use the data for its own purposes as set out in Meta's privacy policy. It loads only if you accept analytics cookies, and it is not present at all when no Meta campaigns are running.

Analytics cookies are optional. When you first visit, a banner asks for your choice; analytics cookies are set only if you accept. You can change your mind at any time using the "Cookies" link in the site footer. Google acts as our processor for this data — see Google's privacy policy and the Google Analytics opt-out browser add-on.

Cookies and local storage we use:

Clerk session cookies — keep you signed in (strictly necessary)
rp_invite — short-lived pass through the invite-only sign-up gate (strictly necessary, expires in 1 hour)
rp_gate_attempts — rate-limits sign-up gate attempts to prevent abuse (strictly necessary)
rp_consent — remembers your cookie choice for 12 months (strictly necessary)
rp_attr — records how you first reached us (a campaign link, or the site that linked to you) so that if you request access we know which channels bring bands in. First-party only, never shared, set for 30 days and only when you arrive from a tagged link or another site.
_ga and _ga_* — Google Analytics cookies used to distinguish visitors (optional, set only with your consent)
_fbp and _fbc — Meta Pixel cookies used to attribute a visit to one of our ads (optional, set only with your consent and only while Meta campaigns are running). Declining, or withdrawing later via the "Cookies" link, deletes them.
ph_* — HeyCatch cookies and local storage entries used to recognise your browser and group your activity into a visit (optional, set only with your consent). Declining, or withdrawing later via the "Cookies" link, deletes them.
Local storage — remembers product preferences on your device, such as which feature tours you have already seen (strictly necessary)

8. International users

We are based in the United States. If you access the Service from outside the U.S., you understand that we process information in the United States and in other locations where our providers operate, as needed to provide the Service.

Depending on your location, you may have rights to access, correct, delete, or restrict certain personal information, or to object to certain processing. To make a request, email hello@riffpile.com. We will respond within a reasonable period. We may need to verify your identity and may retain information where we have a lawful reason to do so (for example billing records or security logs).

9. Retention & deletion

We keep account and band data while your workspace is active and as needed to provide the Service. Our internal audit log of changes made in the app is kept for 12 months and then deleted automatically. The counters behind the abuse limits on our public forms are deleted after one day.

If you ask for access and we decline, we keep your email address and the decision so we can recognise a repeat request, and we automatically delete the rest — your name, your message, and how you found us — after 90 days. Deleting an account also deletes any access request associated with its email addresses.

To delete an account or band workspace, email hello@riffpile.com. We will remove associated data within a reasonable period, except where we must retain records for legal, security, or billing reasons, or where copies may remain briefly in backups until those systems rotate.

Band admins control membership; removing a member does not by itself delete Content other members uploaded to the workspace.

10. Security

Access to band content is limited to authenticated members of that band. Uploads are stored in private object storage and typically served through time-limited links. We use industry-standard measures appropriate to a small SaaS product, but no method of transmission or storage is 100% secure. Please use strong account credentials and protect invite links.

11. Children

RiffPile is intended for adults and working bands. We do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact us and we will take appropriate steps to delete it.

12. Changes

We may update this policy from time to time. The "Last updated" date at the top will change when we do. Where changes are material, we may provide additional notice. Continued use of the Service after an update means you accept the revised policy.

13. Contact

Privacy questions, data requests, or deletion requests: hello@riffpile.com.

Operator: Dev Hero, Rhode Island, USA.