Privacy Policy
Draft · not yet reviewed by counsel
Effective date: [date]
Who we are: Branches is run by Cinderblock LLC ("Branches", "we", "us"), 1113 Leland Ave, Nashville, TN 37216. Questions: help@inbranches.com.
The short version
- Branches lets you hear an artist's song before release and pass it on to friends. The path a song takes from person to person is shown as a tree.
- On the tree, everyone can see your first name, last initial, city and your stats (like "313th to listen" and how many people heard it through you). Your phone number and email are never shown there.
- When you tap Agree at sign-up, you join that artist's fan list. The artist's team gets your name, city and the phone number or email you signed up with, and can contact you. If you tap "Don't share my details" instead, they don't.
- We never sell your information. We don't share it with anyone else for their marketing.
- You can delete your account at any time.
1. What we collect
You give us:
- Your phone number or email. It's how you sign in (with a 6-digit code, no password).
- First name, last initial and city. You pick your city from a list, or type it in if it isn't there.
We record when you use Branches:
- Your place in each tree: whose link you came through, when you first played the song, your listener number, and who heard it through you.
- Listening: when you play the song and for how long. A play counts once you've listened for 30 seconds.
- Your choices: whether you agreed to join an artist's fan list, the exact wording you saw, the button you tapped and when. We keep this as a record of your consent.
- Rewards you unlock, and when.
- Texts and emails we send you, and replies such as STOP or HELP.
- Basic technical information needed to run the service securely, such as device and browser type and error logs.
Before you sign up: when you open a link we set a cookie with a random id, so your listening counts and you join the right branch if you sign up. We keep that anonymous listening record for [90] days.
Security signals: to stop bots, fake accounts and fake branches we use your IP address and basic device signals for rate limits, the bot check and fraud detection. We keep them only in scrambled (hashed) form, for [30] days, and never use them to locate you; your city comes from you. We don't collect your full last name, your contacts or your precise location. There are no profile photos.
2. How we use it
- To run Branches: sign you in, play the song, build the tree, count plays and unlock rewards.
- To send you texts and emails about the songs you're part of (see section 5).
- To keep it fair and safe: spot fake accounts, bots and fake branches, and hold rewards when a branch looks fake.
- To understand how songs spread and improve Branches, mostly as totals.
- To follow the law and enforce our Terms.
3. Who sees what
| Who | What they see |
|---|---|
| Anyone on the same tree | First name, last initial, city, and your stats for that song |
| The artist's team, if you tapped Agree | Your name, city, and the phone number or email you signed up with, plus your stats for their song and when you agreed |
| The artist's team, if you tapped "Don't share my details" | Only what everyone on the tree sees |
| Our service providers | Only what they need to run Branches for us |
| Nobody else | We don't sell your information or share it for anyone else's marketing |
The artist's fan list. When you tap Agree, you join that artist's fan list, and only that artist's. Joining another artist's tree asks you again. The artist's team agrees with us in writing to use your details only to contact you themselves, never to sell or pass them on, to honour your requests to stop, and to delete your details when you ask. Once they have your details, their own privacy policy also applies to how they use them.
Your phone number and texting consent go only to the artist whose fan list you joined. They are never sold and never shared with anyone else.
Service providers (they process data only to run Branches for us):
| Provider | What for |
|---|---|
| Supabase | Database and sign-in |
| Vercel | Hosting the app |
| Twilio | Sign-in codes, texts, and checking a number is a real mobile |
| Cloudflare Turnstile | Bot check before a code is sent |
| Resend | Emails |
| Cloudflare R2 | Storing the encrypted song |
| [Error tracking provider] | Finding and fixing bugs |
We may also share information when the law requires it, to protect people's safety or rights, or as part of a sale or merger of our business (the new owner must keep this policy's promises).
4. Your choices and rights
- See, correct or delete your information. Edit your name and city on your You tab. Delete your account from You → Edit → Delete account, or email us. When you delete your account, we remove your personal details. Your spot on each tree stays as an unnamed dot, so the people who heard it through you stay connected.
- Stop texts: reply STOP. Stop emails: use the unsubscribe link. You'll still get sign-in codes when you ask for one.
- Artist's fan list: to leave it, use the artist's own STOP or unsubscribe. Email us and we'll pass your request on and stop sharing your details with that artist.
- US state privacy rights. Depending on where you live (for example California), you may have the right to know what we hold about you, to get a copy, to correct or delete it, and to opt out of the sale of your information or its use for targeted advertising. We don't sell your information or use it for targeted advertising. Email help@inbranches.com to make a request. We won't treat you differently for using these rights.
5. Texts and emails
- Sign-in codes come by text or email whenever you ask for one.
- If you signed up with your phone number, Branches texts you about the song you joined (whether or not you shared your details with the artist): when a friend hears it through you, a daily roundup on days your branch grows, when you unlock a reward, the day before the campaign ends, and on release day. Message frequency varies. Nothing is sent between 9pm and 9am your time. Message and data rates may apply.
- New drops: Branches also texts or emails you when new songs come out on Branches, with the same quiet hours. Reply STOP or use the You tab's switch to stop them.
- Reply STOP to stop texts or HELP for help, or email help@inbranches.com.
- Emails work the same way, with an unsubscribe link in each one.
- The artist's team texts or emails you from their own accounts, under their own rules, if you joined their fan list.
6. How long we keep it
- Your account details: until you delete your account.
- Your consent records: for [4 years] after your last consent, even after deletion, to show what you agreed to.
- Play and tree records: as long as the tree exists. After deletion they no longer identify you.
- Security logs: [30 days].
7. Keeping it safe
Your data is stored with access controls so other users can only see what's on the tree. Phone numbers, emails and consent records are readable only by you, by Branches, and, if you joined their fan list, by the artist's team. The song is streamed encrypted and is never offered as a download. No system is perfectly secure. If we learn of a breach affecting you, we'll tell you as the law requires.
8. Age
Branches is for people 13 and older. If you're under [18], ask a parent or guardian first. We don't knowingly collect information from children under 13. If we learn we have, we delete it.
9. Outside the US
Branches is built for listeners in the United States, and your information is stored in the US. If you use it from elsewhere, local laws (such as GDPR) may give you more rights. Email us to use them.
10. Changes
If we change this policy in a way that matters, we'll tell you in the app or by email before the change takes effect. The effective date at the top always shows the current version.