Privacy Policy

So Far So Good (https://sofarsogood.love) is operated by SMRS Media SLU, who is the controller of the personal data described in this policy. For anything related to your data, use the contact form. This policy covers the platform at https://sofarsogood.love.

We collect only what the platform needs to work:

• Account data — your email address, display name and identity label (for example Producer or Early Ears).
• Content you create — uploaded music and its metadata, feedback and comments, So Good reactions, and the contents of direct messages you send to other members.
• Support activity — the amounts you offer or receive, request and unlock history, the supporter name shown to the Creator and, for Creators, the PayPal account you connect to receive support.
• Download logs — when you download an Early Copy we record the download’s unique Download ID together with your IP address and browser user-agent string. This exists for one purpose: tracing leaked files back to the account that downloaded them.
• Safety records — reports you file or that are filed about you, moderation flags and blocks, and internal notes made by Hosts.

We run no analytics or advertising trackers, no third-party pixels, and we do not buy or enrich data about you from anyone. We never see or store your card details — payment information goes directly to PayPal (see section 7).

• running your account and the platform’s features;
• streaming previews and delivering Early Copy Downloads you have unlocked;
• confirming support payments (made directly to Creators via PayPal) so Early Copies unlock;
• protecting Creators’ unreleased music — Download IDs and download logs let us trace leaks;
• moderation, safety and abuse prevention;
• sending you service messages (we do not send marketing email).

Projects are Anonymous to other members, not to us. We necessarily know which account uploaded which project; that link is stored server-side and never shown publicly. Your identity is revealed to other members only when you choose to reveal it — typically when you accept support and share an Early Copy.

Where EU data-protection law (GDPR) applies to you, we rely on:

• Contract — running your account, delivering previews and Early Copies, processing payments;
• Legitimate interests — download logging for anti-leak tracing, moderation and platform security;
• Legal obligation — keeping payment and tax records;
• Consent — optional choices such as revealing your identity as a Creator.

Support payments are made directly from the Supporter to the Creator’s PayPal account and are processed entirely by PayPal, which acts as an independent controller of your payment data. Your card or bank details never reach our servers. PayPal notifies us when a payment completes, and from that notification we store the payment confirmation — transaction reference, amount and status — to unlock the Early Copy and keep support records accurate. For Creators who enable a Creator Contribution, we also process the support amount and their chosen contribution share to apply the contribution at checkout. See PayPal’s privacy statement for how PayPal handles personal data.

We never sell personal data. We share it only with:

• Supabase — our hosting, database, authentication and file-storage provider; uploaded music lives in private storage accessible only through short-lived signed links;
• PayPal — processes support payments between Supporters and Creators and sends us payment confirmations;
• authorities or rights holders where the law requires it — for example a valid court order, or the tracing of a leaked Early Copy in connection with a legal claim.

Our processors may store or process data outside your country, including outside the European Economic Area. Where they do, the transfer is protected by recognised safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision, under Supabase’s and PayPal’s standard data processing terms.

• Account data and content — for as long as your account exists; deleted when your account is closed, except where retention is legally required.
• Download logs (IP address, user agent, Download ID) — up to 24 months, so a leaked Early Copy can still be traced.
• Payment records — for the statutory retention periods that apply to financial records.
• Messages and safety records — until deleted by the participants or no longer needed for moderation and safety.

You can ask us to access, correct, delete or export your personal data, to restrict or object to certain processing, and to withdraw any consent you have given. Send your request through the contact form using your account email address and we will respond within one month. Account deletion is currently handled this way rather than through a self-serve button.

If you are in the EU/EEA you also have the right to complain to your local data-protection supervisory authority.

The platform uses only essential authentication cookies that keep you signed in — no analytics or advertising cookies. Details are in the Cookie Policy.

Uploaded music is stored in private buckets that have no public URLs; previews and downloads are served through short-lived signed links (previews expire after one hour, download links after five minutes). Access to member data is restricted to Hosts, all traffic is encrypted in transit (HTTPS), and payment data is handled entirely by PayPal — it never touches our systems.

The platform is for adults. You must be at least 18 to create an account, and we do not knowingly collect data from anyone younger. If you believe a minor has registered, tell us through the contact form.

We will update this policy when our data practices change and note the date at the top; material changes are announced on the platform. Privacy questions and requests: the contact form.