Privacy policy
Pilot draft under review, not yet in force. Last updated 27 October 2026.
In plain words
- Taktum is a setlist and chord chart app for bands, run by TaktumSoft, a Danish sole proprietorship owned by Mike Møller Madsen.
- We collect what we need to run your account and your band’s library: your email, your display name, how you sign in, and the songs and setlists your band adds.
- We don’t sell your data, we don’t show ads, and we don’t use tracking cookies. We use error monitoring and performance measurement so the app keeps working.
- No AI runs inside Taktum. If you connect your own AI assistant (like Claude), that assistant’s provider sees what you let it read. We don’t send your data to AI providers ourselves.
- Your data is stored in the EU (Ireland). Some of our service providers are US companies, so we rely on EU-approved safeguards for transfers.
- You can see, export, correct and delete your data. Write to us at hello@taktum.app. If you’re unhappy with how we handle it, you can complain to Datatilsynet, the Danish Data Protection Agency.
1. Who we are
The data controller is:
- TaktumSoft (sole proprietorship / enkeltmandsvirksomhed), owned by Mike Møller Madsen
- Address: to be confirmed
- CVR: to be confirmed
- Email for privacy questions: hello@taktum.app
“Taktum”, “we” and “us” in this policy mean TaktumSoft. “You” means anyone who uses taktum.app, its REST API or its MCP server, or who is invited to a band on Taktum.
We’re a very small company and we don’t have (and aren’t required to have) a data protection officer. Mike Møller Madsen handles privacy questions himself.
2. What Taktum is, briefly
Taktum (https://taktum.app) is a web app where a band keeps its song library (chord charts stored as ChordPro text), builds setlists and plays from a full-screen gig view. Access is by invite only during a pilot with a few bands, and the pilot is free. There’s no payment or billing in Taktum today.
3. What we collect and why
3.1 Your account
| What | Where it comes from | Why | Legal basis (GDPR art. 6) |
|---|---|---|---|
| Email address | You, or the band owner or admin who invited you | To create your account, sign you in, send sign-in and invite emails, and identify you to your band | Contract (6(1)(b)). For the invite itself, before you have an account: our and the inviting band’s legitimate interest (6(1)(f)) in letting a band invite its members |
| Display name (1 to 80 characters) | You | So your band sees who you are and who changed what | Contract |
| Password | You, if you set one | Sign-in. We never see or store it in readable form: our authentication provider stores only a one-way hash | Contract |
| Google sign-in data | Google, only if you choose “Continue with Google” | To sign you in. Our authentication provider stores the basic identity Google returns (such as your Google account ID, email, name and profile picture link). Taktum uses the email to match you to your invite | Contract |
| Two-step sign-in (optional) | You, if you turn it on | An authenticator-app secret held by our authentication provider, and your 8 recovery codes, which we store only as one-way hashes | Contract, and our legitimate interest in account security |
| Sign-in and session records | Created when you sign in | Keeping you signed in, protecting accounts (for example limiting wrong recovery-code attempts), and investigating abuse. Our authentication provider logs sign-in events, which include IP address and browser details | Contract; legitimate interest in security (6(1)(f)) |
3.2 Your band’s content
| What | Why | Legal basis |
|---|---|---|
| Bands (name, web address), memberships and roles (Owner, Admin, Member, Viewer), pending invites (email and role) | To run the band, its permissions and its invites | Contract |
| Songs: title, artist, key, tempo, meter, length, tags, notes, the chord chart (lyrics and chords as ChordPro) | That’s the product | Contract |
| Setlists: name, gig date and time, venue, set slot length, entries, notes, transition notes | That’s the product | Contract |
| Song history: earlier versions, who made each change and through which channel (web, API, or the name of the connected assistant, for example “Claude”) | So the band can see and undo changes | Contract; legitimate interest in a reliable shared library |
| Trash: deleted songs, setlists and bands, kept for 30 days | So mistakes can be undone | Contract |
Please don’t put sensitive personal information in songs, notes or setlists (for example health details, or other people’s phone numbers). Free-text fields are visible to everyone in the band.
Who in the band sees what. Everyone in a band can see the band’s songs, setlists and history, and the names of the people in it.
3.3 Your personal settings
- Display preferences per song (your own capo and transpose), text size and lyrics-only mode, the last band you opened. Stored with your account so they follow you between devices.
- Stage or Daylight theme choice, kept only on the device (see section 7).
Legal basis: contract.
3.4 API tokens and connected assistants
- API tokens. If you create a personal API token, we store only a one-way hash of it, its name, the bands it covers and whether it can read or write. You see the token once.
- Connected assistants (MCP). If you connect an assistant, we store a grant: which assistant (its client name and ID as registered with our authentication provider), which bands, and read-only or read-and-write. Changes it makes appear in song history under its name.
Legal basis: contract.
3.5 Technical data, errors and performance
- Error and performance monitoring (Sentry). When something breaks, the app sends an error report to Sentry: what went wrong, the page or server function, browser and device type, and the app version. For performance, about 10% of production page loads and requests are traced. We don’t use Sentry’s session replay. Sentry stores this in its EU (Germany) region. The app doesn’t switch on Sentry’s option to send personal data by default.
- Performance measurement (Vercel Speed Insights). Measures how fast pages load (Core Web Vitals) per page route and device type. It doesn’t use cookies.
- Server logs (Vercel and Supabase). Our hosting and database providers keep short-lived technical logs of requests, which include IP addresses, URLs and timestamps. We use them only to run, secure and debug the service.
Legal basis: our legitimate interest (6(1)(f)) in keeping Taktum working, fast and secure. You can object (see section 9).
What we don’t do: no product analytics today, no advertising, no ad pixels, no profiling, no selling or renting of data, no automated decisions with legal or similar effects.
3.6 Emails we send
Only service emails: invites, sign-in links, password reset, email-change confirmation. They’re sent from hello@taktum.app through our email provider (section 6). No newsletters or marketing emails today.
4. AI assistants and MCP: who sees what
Taktum has no AI of its own. Chart Cleanup is a fixed set of rules, not an AI model, and Taktum doesn’t send your data to any AI provider.
You can choose to connect your own AI assistant (for example Claude) to Taktum through our MCP server at https://taktum.app/api/mcp. When you do:
- You start it, from the assistant. You sign in to Taktum and choose which bands it can reach and whether it can only read or also write. It can never do more than a Member, and it can’t touch invites, bands, profiles or tokens.
- The assistant’s provider receives what the assistant reads: for example song titles, charts with lyrics, setlists and the names of the bands you shared. What the provider does with that is governed by your agreement with that provider and its privacy policy, not by this policy. Taktum doesn’t control it.
- You’re responsible for what you share. Only connect bands whose content you’re allowed to share with that provider, and remember the content belongs to the whole band.
- You can revoke access at once on the Connections page.
The same applies to anything you send through the REST API with your own token: once it leaves Taktum, it’s under your control.
5. Inviting people to your band (a note for band owners and admins)
When you invite someone, you give us their email address, and we send them an invite email. Please only invite people who expect it and are part of your band (or a dep, sound tech or stand-in who needs access).
For account and band data, Taktum is the controller: we decide how the service works and we handle privacy requests. You don’t need a data processing agreement with us for normal band use.
6. Who we share data with (sub-processors)
We share data only with the providers we need to run Taktum, under data processing agreements, and only for that purpose:
| Provider | What for | Where data is stored | Transfer safeguard |
|---|---|---|---|
| Supabase (Supabase Inc., US) | Database, authentication, sign-in emails trigger, scheduled clean-up jobs | EU: Ireland | EU data region; Supabase DPA with Standard Contractual Clauses |
| Vercel (Vercel Inc., US) | Hosting the website and app; server functions run in Dublin; performance measurement (Speed Insights) | Functions: Ireland. Edge network and logs: global, including the US | Vercel DPA, EU-US Data Privacy Framework and/or SCCs |
| Resend (Resend Inc., US) | Sending service emails from hello@taktum.app | EU region for our sending domain | Resend DPA, SCCs or DPF |
| Sentry (Functional Software Inc., US) | Error and performance monitoring | EU data region (Germany) | Sentry DPA, SCCs |
| Google (Google Ireland Ltd. / Google LLC) | Only if you choose “Continue with Google”: Google confirms who you are | Google’s infrastructure | Google’s terms; you have your own relationship with Google |
| Cloudflare | DNS for taktum.app (email authentication records) | n/a if DNS only | to be confirmed |
We don’t share data with anyone else, except:
- with other members of your band, as described in section 3.2;
- with an assistant or app you connect yourself (section 4);
- when the law requires it (for example a court order), or to protect Taktum and its users against fraud or abuse;
- with a buyer if Taktum is ever sold, and then only under this policy or with notice to you.
We’ll update this list before adding a new provider that handles personal data.
7. Cookies and similar storage
Taktum uses only what’s strictly necessary for the app to work. No tracking or advertising cookies, and no cookie banner, because none are needed. (Danish cookie rules, cookiebekendtgørelsen, require consent only for non-essential storage.)
| Name or type | Purpose | How long |
|---|---|---|
| Authentication cookies (Supabase session, set by our server) | Keep you signed in; hold the security code for the Google sign-in flow | Until you sign out or the session expires |
| Short-lived sign-in helper cookies (httpOnly): return path, invite “join” context, Google attempt | Bring you back to the right page after an email link or Google sign-in | Minutes |
| localStorage: Stage or Daylight theme (taktum.gig-stage) | Remember your gig view theme on this device | Until you clear it |
| localStorage and service worker cache: the offline copy (taktum.offline-copy, taktum-offline-copy), and display changes waiting to sync | Let the gig view open your setlists without a connection | Until you sign out (signing out deletes it) |
8. Where your data is stored and international transfers
Our database and server functions run in the EU (Ireland). Error monitoring is stored in the EU (Germany). Our email provider sends from its EU region.
Some providers (Vercel, Supabase, Resend, Sentry) are US companies, and Vercel’s global edge network and logs may process data outside the EU. Where personal data is transferred out of the EU/EEA, we rely on the EU-US Data Privacy Framework for certified companies and/or the EU Standard Contractual Clauses. You can ask us for a copy of the safeguards.
9. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you, and get a copy.
- Correct it. You can change your display name and email yourself under Settings.
- Delete it (“right to be forgotten”). There’s no self-serve account deletion in the app today. Until there is, write to us and we’ll delete your account within one month.
- Data portability. Any band member, including Viewers, can export the band’s whole library as a zip (one ChordPro file per song plus setlists.json) from the song list, or through the API. Tags and notes aren’t in the export yet. For your own account data, ask us.
- Object to processing based on legitimate interest (for example error monitoring).
- Restrict processing while a complaint is being looked at.
- Withdraw consent where we rely on consent (we don’t today).
Write to hello@taktum.app. We’ll answer within one month (extendable by two months for complex requests, and we’ll tell you if so). We may ask you to confirm your identity, usually by replying from your account’s email address.
Complaints. You can complain to the Danish Data Protection Agency: Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark, www.datatilsynet.dk, dt@datatilsynet.dk. We’d appreciate the chance to fix things first, but you don’t have to ask us first. If you live in another EU country, you can also complain to your local authority.
10. How long we keep data
| Data | How long |
|---|---|
| Deleted songs, setlists and bands (Trash) | 30 days, then removed for good by a daily automated job |
| Your account | While you have it. Inactive accounts: to be confirmed |
| Band content | While the band exists. A deleted band can be restored for 30 days, then it’s removed. |
| Song history | As long as the song exists |
| Pending invites | to be confirmed |
| Database backups | Deleted data can remain in backups until they expire: to be confirmed |
| Server and auth logs | to be confirmed |
| Error reports (Sentry) | to be confirmed |
| Emails sent (Resend logs) | to be confirmed |
| Accounting records, once Taktum charges | 5 years, as Danish bookkeeping law requires (bogføringsloven) |
11. How we protect your data
What’s actually in place today:
- All traffic is encrypted (HTTPS, with HSTS). Data is encrypted at rest by our database provider.
- Every database table is protected by row-level security: you can only reach the bands you’re a member of, in the role you have. Your browser never talks to the database directly; everything goes through our server.
- Passwords are stored only as hashes by our authentication provider. API tokens and two-step recovery codes are stored only as SHA-256 hashes.
- Optional two-step sign-in with an authenticator app, with recovery codes and attempt limits.
- Sign-up only by invite. Email changes have to be confirmed from both the old and the new address.
- Assistants and API tokens are limited to the bands and access level you choose, never more than a Member, and you can revoke them at once.
- Protection against cross-site request forgery and clickjacking on every page.
- Deletes go to a 30-day Trash first, and edits keep a version history.
If a personal data breach puts your rights at risk, we’ll notify Datatilsynet within 72 hours and tell you without undue delay if the risk is high.
12. Children
You must be at least to be confirmed years old to use Taktum, or have a parent’s or guardian’s permission.
13. Changes to this policy
If we change this policy in a way that matters, we’ll tell you in the app or by email before the change takes effect (notice period: to be confirmed). The date at the top always shows the current version.
14. Contact
TaktumSoft, to be confirmed, CVR to be confirmed
Email: hello@taktum.app