Privacy policy

last updated: august 8, 2026

Dubdig is a music-discovery tool: it looks at public Bandcamp collections to surface records you might want, based on collectors whose taste overlaps with yours. This page explains what data that involves, what we do with it, and how to get it removed. The short version: we collect the minimum needed to make recommendations work, we don't sell anything, and everything here is removable on request.

What we collect

  • Account details. If you sign in, your email address — and, with Google sign-in, your name — from the provider you chose. You can also use Dubdig anonymously without an account.
  • Usage. What you play, save, dismiss, and put in crates. This steers which recommendations we surface to you.
  • Public Bandcamp data. Dubdig reads publicly visible Bandcamp collection pages — the same information anyone can see in a browser — to build the recommendation graph those recommendations are drawn from. It never accesses private data or accounts.
  • Analytics. We use PostHog (US-hosted) to understand how the product is used: pageviews and feature events, labelled with an account number rather than anything that identifies you. Only we can connect that number back to a person — PostHog can't. No advertising trackers, no cross-site tracking. You can switch analytics off completely in settings — we then stop collecting it from you, in the browser and on our servers.
  • Cookies and local storage. A session cookie keeps you signed in. PostHog stores an identifier so return visits aren't counted as new ones. Nothing for advertising, nothing that follows you to other sites.

What we use it for

Making recommendations, running your account, and improving the product. Nothing else. We do not sell or rent personal data. We share it only with the service providers that run Dubdig, and only so they can do their job:

  • Hosting and database — Railway
  • Product analytics — PostHog
  • Transactional email (sign-in codes) — Resend
  • Payments — Stripe, if you subscribe
  • Sign-in — Google, if you choose it

This list is current as of the date above. We may add or change providers within these categories as Dubdig evolves; we'll keep the list current, and we won't put your data to a new use without saying so here.

If your Bandcamp collection was picked up

You might be in here without ever having used Dubdig. If your Bandcamp collection is public, we may have read it — the same page anyone can open in a browser — to work out which records tend to be collected by the same people. What we store is your public handle and what's in the collection. No email, no name, nothing you hadn't already published.

We do that on the basis of legitimate interest: recommendations only work if they can see how taste overlaps, there's no workable way to ask every collector whose page we read, and the data is already public. We keep that interest in balance by taking only what a visitor could see, never logging into anything or touching private data, and honouring removal from anyone who asks — no account, no questions.

If you'd rather be left out, use the removal page. We delete everything we hold about your profile immediately and add the handle to a do-not-crawl list so it isn't picked up again.

How long we keep it

  • Account data. While your account exists. Ask us to delete it and it goes, along with your analytics profile, within 30 days.
  • Crawled collection data. While it's still doing work in the recommendation graph — it gets refreshed and superseded as collections change. Removal deletes it on the spot.
  • The do-not-crawl list. Kept indefinitely, on purpose. It's a handle and nothing else, and it's the only thing stopping us from re-crawling someone who asked to be left out.

Data lives on servers in the United States.

Your rights

Wherever you are, you can ask us what we hold about you, have it corrected, have it deleted, or tell us to stop. If you're in the UK or EU those are your rights of access, rectification, erasure, restriction, portability and objection under the GDPR, and you can complain to your national data protection authority if we handle it badly. One email does it — we won't make you prove anything beyond that you control the address or handle in question.

Changes

If this policy changes in a way that matters, we'll note it here with a new date. Continued use after a change means the new version applies.

Contact

Dubdig is run from Québec, Canada. For questions, requests, or complaints about your personal information, contact the person responsible for its protection at [email protected]

terms of service →