Privacy

Last updated 25 October 2026.

off-studio holds the working records of a music career: the people you know, the gigs you played, what you released and what you were paid. That is personal information about you, and often about other people you have written down. This page says what happens to it.

Who is responsible

off-studio is run from Switzerland. For questions about anything on this page, to ask who is responsible for it, or for a postal address, write to hello@off-studio.io. Every such request is answered.

Under the GDPR, off-studio is responsible for account details and for off-studio's own operation of the service. For Community registrations, subscriptions and event history, the artist is the controller and off-studio is the processor: off-studio holds those details on the artist's instructions.

What is stored

Your account

• Your email address, name and username.
• Your password, stored only as a PBKDF2 hash with a per-account salt. We cannot read it and cannot recover it, only replace it.
• If you turn on two-step sign-in: a shared secret for your authenticator app, and your recovery codes, stored hashed.
• Sessions: a hash of your session token, the IP address and browser you signed in from, and when. Sessions expire after 30 days.
• If you sign in with Google: the id Google uses for you, so a changed Google address does not lock you out. Not your Google password, which Google never shares.
• Failed sign-in attempts against an IP address, to slow down guessing.

Your workspace

Everything you enter: contacts and their details, organizations, gigs, releases, tracks and splits, money in and out, reminders, tasks on the Board and notes. Each artist's workspace is a separate database file.

Images and PDF files you add to a page are kept inside that same file, so its daily copies and your export carry them. A page moved to the Trash keeps its files there for 30 days, and deleting the page for good deletes them. A file removed from a page is kept for a day, so Undo can put it back, and is then deleted. Everybody who can open the workspace can open the files on its pages.

Files you add to Documents, such as invoices, contracts and statements, are kept as files of their own beside your workspace's database, on the same server, under names the server makes; the name a file came with is never used as the name it is stored under. A document that holds money (an invoice, a statement, a receipt, or one marked so) can be opened only by the people the money is shared with, and by a person who logs money if they added it. Any other document can be opened by everybody who can open the workspace. When a file is added, only PDF files, PNG, JPEG and WebP images, Word and Excel files are kept. A PDF found to carry a script, and an Office file found to carry macros, is refused. A PDF that cannot be read through, such as an encrypted one, is kept but only downloaded, never opened in the app; files are not scanned for viruses. The nightly copies carry these files. Your export carries what each document is called and what it is linked to, and Documents saves the files themselves as one .zip. A document in the Trash is deleted for good after 30 days, and deleting a gig, a contact or a page never deletes a document linked to it. When a workspace is deleted, nobody can open its files any more; they are kept for fourteen days, as the copy of its database is, and then deleted, and the nightly copies stop carrying them that night.

Some of this is personal data about other people: a booker's name and phone number, for instance. You are responsible for having a reason to keep it, and for what you write in a notes field.

People who register for an event, or sign up to stay in touch

An organiser may ask you to request a place rather than register automatically. The workspace then records the application, the team's decision and its email status. Where offered, gender is optional and self-reported, including a choice not to say; off-studio does not infer gender or decide admission from it. The organiser may email you a receipt and admission updates. These messages are separate from subscribing to future-event marketing.

Artwork the organiser publishes on an event page is public. It is separate from private Documents; uploaded public artwork has its image metadata removed before it is stored. An approval may link to an external ticket provider. off-studio does not issue the ticket or verify payment from that link alone. The ticket link in an approval email goes through off-studio first, so off-studio can count how many times it was clicked for each event and day. To count each internet connection only once an hour, off-studio keeps a scrambled version of its address in memory for that hour and never saves it. Apart from that and the web server's normal visit log, nothing is kept about who clicked.

Community, the page where an artist runs events, collects details from people who have no account here. A registration holds a first name, a last name and an email address; a year of birth where the artist asks for one, which is used to apply an age limit and is never a full date; and the answers to any short questions that artist added. It also records which event it was for, when it arrived, and whether the person ticked the box asking to hear about future events. An artist can also turn on a Stay in touch page, where somebody leaves a first name, a last name and an email address with no event, and ticks what they want to hear about: future events, new releases, or both. What each person chose, and when, is recorded.

For those details the artist is the controller and off-studio is the processor. They are collected for the artist, kept in that artist's workspace, and used for that event: to know who is coming, to apply the age limit where the artist set one, and to send the confirmation. They are used to tell somebody about a later event only while that person is subscribed to future events, and about a new release only while they chose new releases, which today means the artist writing from their own address rather than anything off-studio sends. A person is subscribed once they tick the box on one of the artist's forms or on the Stay in touch page, or press "Yes, tell me about [artist]'s next events" on the page an approval email links to. They stay subscribed until they stop it. Each box arrives unticked, the answer and the moment it was given are recorded, and registering is not the same as ticking it: whoever leaves it alone, and has not ticked it on another of that artist's forms, hears about this event and about nothing after it.

Automatic registrations receive one confirmation where enabled, the same again when a later registration for the same event ticks the box and so subscribes that address to future events, and a managing link when the person asks for it again. Review-mode requests may receive a receipt and approval, decline or waitlist updates from the organiser. These service messages do not subscribe someone to marketing. A Stay in touch sign-up gets one confirmation of its own the first time, the same again when a later sign-up with that address adds to what it hears about, so that nobody is subscribed to something without being told, and a new link when that person asks for one. There is no announcement, no newsletter and no campaign in Community: an artist who wants to write to the people who registered exports them and writes from their own address. off-studio does not write to a registrant for its own reasons, does not add them to anything, and does not sell them. The confirmation goes out through Resend, which is in the table above.

Registration details and answers are deleted once both the event and the registration are more than 12 months old. The same limit applies whether or not you subscribe to updates. For registrations added by the artist or their team, the 12-month limit runs from the event date; adding them later does not restart it. off-studio does the deleting rather than leaving it to an artist to remember: the server looks every day for registrations past these limits, and removes them with every answer in them. The answers to an event's questions are kept only as part of their registration: they stay while it stays, and they go when it goes.

Where a person is asking to hear about future events or new releases, only their name, their email address and the record of what they agreed to (the words of the box, which form, and when) stay after that, with the longer history below if they chose it, until they change what they chose or ask for them to go. Cancelling a registration takes that registration and keeps what the person chose to hear about; somebody who chose nothing and cancels their last registration leaves nothing behind. Every confirmation carries a link that needs no account and no password: the page it opens has one button that cancels that registration at once, boxes that change what the person hears about and a button that stops all of it, each leaving the registration alone, a button that stops the longer history where the person chose it, and a last one that removes everything that artist holds about the address, and none of them is pressed for anybody. A Stay in touch confirmation's link opens the same page without a registration to cancel. A person whose confirmation never arrived can ask for a new link on any of the artist's event pages, or on their Stay in touch page while the artist keeps it on.

Where it is offered, you can separately choose a longer history while you are subscribed to future events. The longer history holds only which past events you were confirmed for, their dates and countries, linked to your name and email address in the artist's audience. The artist uses this history to recognise returning people and to choose whom to invite to later events. The longer history does not keep your answers, year of birth, gender, application notes or the label of the link that brought you to the event.

Each entry in the longer history is deleted 4 years after that event, or sooner if the artist no longer needs the entry. Registering for another event does not extend that deadline. Being confirmed for an event does not show that you went to it or bought a ticket.

You can subscribe to future events without choosing the longer history. Unsubscribing from future events, or withdrawing the history choice, deletes the longer history. Your ordinary registrations keep their normal deletion dates. Cancelling a registration removes that registration and its longer history. Subscribing only to new releases does not keep a longer history.

The longer history relies on your separate consent. The link used to manage your registration or subscriptions also lets you withdraw the history choice. You can instead ask the artist, or write to hello@off-studio.io. Withdrawing the history choice does not cancel a registration or stop updates you still want. Asking to remove everything deletes the longer history too.

The artist is responsible for this history. off-studio stores the history for that artist and does not combine the history across artists or use the history for off-studio's marketing.

An artist may also put links to a WhatsApp group, an Instagram, a Telegram or another page on these pages. They are links and nothing more: joining happens on that service, under its own terms, and off-studio does not see who joins, keeps no list of members and sends nothing through them.

An artist can switch that confirmation off for an event. Where they have, a person who registers gets no confirmation, unless they ticked the box asking to hear about future events: then they get one, so they always have the link to change what they hear about. Anybody can also ask the event's page for the link, which then arrives as that one message. The other way out is to write: to the artist, or to hello@off-studio.io. A request that reaches off-studio is acted on and the artist is told, and that is true whichever way it arrives.

Since 19 October 2026, each time a person says yes or no to hearing from an artist, off-studio keeps a record of it: the exact words of the box, the form it was on, and when. The record does not include their IP address. A box ticked on a public form only shows that it was ticked with that email address; off-studio does not check who ticked it. The record is deleted when the person is deleted.

Anybody who lost their link, whether they registered for an event or not, can ask for a new one on any of the artist's event pages or on their Stay in touch page. Every email address gets the same answer, so the page does not show who is on an artist's list.

If the artist shared a labelled link to an event, such as one for Instagram or a QR code on a flyer, the registration also keeps that label. It is one word from a fixed list. Nothing else about the visit is kept with the registration.

An artist can save a list in their Audience, for example "at least two past events in Spain". A list stores only its filters, never the people on it: each time it is opened, off-studio works out again who matches, from the registrations and sign-ups it still keeps, and the longer history where a person chose it. The country is where the event took place, never where a person lives. When the artist downloads a list, the file only has the people who agreed to hear from the artist at that moment. Being on a list gives nobody anything, and off-studio sends nothing to a list.

Community emails (confirmations, new links and updates about requests) show the artist's name, for example "Nadia via off-studio". A reply to one of them goes to the artist: to an email address the artist has confirmed, or, until they do, to the email address the workspace owner signs in with, once it is confirmed. If neither is confirmed, replies come to off-studio at hello@off-studio.io.

What the software records about use

• An activity log of who changed what in a shared workspace, so your collaborators can see it. A line names the records it is about, by the names they had when the line was written, until one of them is deleted. From then on it says who did what to which kind of record, such as "Mara deleted a contact", without the name. A page in the Trash, and its subpages and the tables and comments on them, keep their names in the log until the page is deleted for good, by a person or after 30 days.
• If you use the agent: the number of tokens each request used and what it cost, so the monthly allowance can be counted. The last two dozen messages between you and the agent are kept so that a follow-up question makes sense; the agent reads back only the ones from the past thirty minutes, an export you take holds all of yours, older ones are overwritten as you keep typing, and all of them are deleted when you leave a workspace or close your account. Each request also tells the agent which page you are on and, when a contact, organization or gig is open, its name, so it can tell what "her" or "this one" means; that part is not kept. To answer a question, the agent reads your workspace as you may see it; what it reads is not kept, and an answer is kept without its amounts.
• If you dictate to the agent: the transcribing is done by your browser's own speech service, which belongs to the browser's maker, not to off-studio. Off-studio receives only the text you then send.
• If you allow notifications: the push endpoint your browser gave us and the keys needed to encrypt a message to it.
• Web server request logs, which include IP addresses.
• For a short time, about an hour, the IP address that sent a public form (registering for an event, signing up to stay in touch or asking for a link), to slow down abuse.

What off-studio counts about how it is used. To see which parts of off-studio are used and where they fail, the server counts what it already does for you: a sign-up and where it came from, and whether it was an artist, a manager or an agency; a record added, changed or deleted on a page; a message to the agent and whether it was answered, and if not, why; a save that was refused, and why; a fault; and an answer that took two seconds or more. Each count keeps the day, the page, what was done in words from fixed lists (a contact added, or a save refused at the free plan's limit), a key that stands for your account and your workspace without naming either, and whether the device is a phone, a tablet or a computer; never what you wrote, an amount, an address or your IP address. Faults and slow answers carry no key. Which pages you move between, which forms you open, and which you close without saving, are counted only for somebody who ticks a box for it in the same place in Settings, shown only while that part is switched on. No analytics service receives it, and it sets no cookie and loads no outside script. The basis is our legitimate interest in running and improving the service, and, for the pages you move between and the forms you open and close, your consent, which unticking the box withdraws. In Settings, under your account, you can stop it, which also deletes what was counted about you, or download it. This counting is on, and we said so by email before it started.

There is no analytics service, no advertising and no tracking pixel. off-studio sets one cookie, the one that keeps you signed in; it cannot be read by scripts, is not sent to other sites, and carries nothing but a random token.

Who else sees it

These are the only third parties any of your data reaches, and what reaches each of them:

If you choose Create a Google Doc on an invoice, you connect a Google account, review that destination and then choose Create copy. Only that copy's invoice details and payment instructions go to Google Drive. The copy does not update your invoice here. We keep encrypted connection credentials so you can make later copies; Disconnect in Settings removes our local access and leaves your Google files in place. It does not revoke other apps' Google access.

Once a day the server downloads the published reference exchange rates, from the European Central Bank and a few other central banks through Frankfurter, and sends nothing about you or anybody else.

Once a month the server also downloads the venue list. Today it holds festivals from Wikidata; clubs and venues from OpenStreetMap are not in it yet. It sends nothing about you or anybody else, and typing a name in an organization's form reads that list on our server without sending anything.

Addresses found with "Look up the address", and any clubs and venues in the venue list, are © OpenStreetMap contributors, and that data is available under the Open Database License. A copy of the list as off-studio holds it is sent free, under the same licence, to anybody who asks at hello@off-studio.io. The festivals come from Wikidata, whose data is in the public domain.

Links in the app that point somewhere else, a collecting society, a venue, a release page, are ordinary links. Following one takes you to that site under its own terms, and we do not tell it where you came from beyond what any link does.

Nobody buys this data, because it is not for sale. It is not shared for advertising and never will be.

off-studio does not use it to train AI models, and Anthropic's commercial terms do not allow Anthropic to train its models on what off-studio sends it.

Where it lives

The server and every database are in Frankfurt, Germany. Backups are taken daily onto the same machine and the newest fourteen of each are kept; older ones are deleted. A copy of the whole disk is also taken every night and kept for fourteen days in the European Union.

Since 11 October 2026 each daily backup is also copied to a Google Cloud storage bucket in the Netherlands, encrypted on the server with off-studio's own key before it leaves. The server can add a copy there but cannot read or delete one, and each copy is deleted after fourteen days.

The services in the table above process data outside the EU. Where that happens it is on the basis of the European Commission's standard contractual clauses or an equivalent transfer mechanism offered by that provider.

How long it is kept

• Your account and your workspace: until you close the account. Settings has a Close my account control that does it, and tells you first whether you are leaving a workspace or deleting one. The live copy goes at once, and each backup is deleted after fourteen days.
• Sessions: 30 days, or until you sign out.
• Agent conversation memory: the last two dozen messages, kept in the workspace until newer ones replace them, until you leave the workspace, are removed from it or close your account, or until the workspace is deleted. The agent reads back only those from the last 30 minutes, and an export you take holds all of yours.
• Registration details and answers: until both the event and the registration are more than 12 months old. For registrations added by the artist or their team, the 12-month limit runs from the event date; adding them later does not restart it. A separately chosen longer history of the events a person was confirmed for: up to 4 years after each event, only while they are subscribed to future events and keep that choice. Names, email addresses and the record of subscription choices are kept separately while needed for the updates the person asked for. A person can ask for their details to be removed.
• Counts of how off-studio is used: 90 days, after which only totals without any key remain. Stopping the count in Settings, or closing your account, deletes yours at once.
• Backups: 14 days, after which a deleted record is gone from those too.
• Records we have to keep for tax or accounting, such as an invoice: as long as Swiss law requires.

What you can do

You can, at any time and without asking anybody:

• Take everything with you. If the workspace is yours, Settings has a backup that includes everyone’s My drive and Shared drive. Only the owner can download the backup. The export writes it as a JSON file you keep: everything in it, with the activity log and your own recent conversation with the agent. The files you add to Documents save as one .zip. That is your right to data portability, and it does not need a request.
• Correct anything. Every record in the app is editable.
• Delete any record, or all of them. Contacts, gigs, releases, ledger entries and reminders delete from the screen they live on, and Settings will close the whole account.
• See who else can open your workspace, and remove them. If your workspace is on an agency's roster, the people who run that agency can open it through the agency rather than through your list, so they are not shown there and only the agency can detach the workspace. Write to us and we will tell you exactly who has access.

Beyond that you have the right to ask what we hold about you, to have it corrected or erased, to restrict or object to how it is used, and to complain to a supervisory authority. In Switzerland that is the FDPIC; in the EU it is the authority where you live. Write to hello@off-studio.io and we will answer within 30 days.

Children

off-studio is a tool for professional work and is not intended for anyone under 16. We do not knowingly hold data about children.

An event's registration page is the artist's, not off-studio's. Where it asks for a year of birth, the year is there so the artist can apply the age limit for their event, and deciding who may register is theirs. A year is not proof of age and off-studio verifies nobody's: the registration page says so beside the field.

Security

What is actually done, rather than a list of adjectives: passwords are hashed with PBKDF2 and per-account salts; session and capture tokens are stored only as hashes; two-step sign-in is available and a password alone never completes a sign-in when it is on; every connection to off-studio is HTTPS with HSTS; everything stored, on the server and in its backups, is encrypted by Google Cloud; notification contents are encrypted to your device; and each artist's workspace is a separate file, which the app opens only for the people on its team and, for a workspace on an agency's roster, the people who run that agency.

The people who run off-studio can technically open what is stored on the server and in its backups. They do so only to fix a fault, to check that an update or a backup lost nothing and that a backup can be restored, to answer a request for help, or when the law requires it.

No system is beyond compromise. If one happens and it affects you, we will tell you and the relevant authority within 72 hours of finding out.

Changes

If this page changes in a way that affects you, we will say so by email before it takes effect. The date at the top is when it last changed.

Back to off-studio