Legal

Privacy Policy

Last updated: June 7, 2026

Short version: We collect what's needed to run PatchMap and to understand which features people actually use, so we can make it better. We don't sell your data, share it with advertisers, or use it to build ad profiles.

1. Who we are

PatchMap is a product of IndieSoft, an independent software studio, which is the data controller for PatchMap and the patchmap.app website. You can reach us at hello@indiesoft.app.

When we refer to "we", "us", or "PatchMap" in this policy, we mean the data controller responsible for your personal data.

2. What data we collect

The data we collect falls into these categories:

Account data — your email address, used for authentication. No password is ever stored.
App data — the content you create in PatchMap, such as stage plots, patch lists, input lists, signal-flow documents, venues, shows, equipment inventories, and related settings.
Collaboration data — information needed to share a plot or session with your crew, including share links, room/session join tokens, role assignments, and the names or labels you give to collaborators (for example, musicians or crew members you invite).
Usage analytics — pseudonymous records of how PatchMap is used: which features are opened, actions taken, and similar product-engagement events, tied to your account identifier. We use this to understand what's working and to prioritise improvements. (See Section 4.)
Push notification data — if you opt in to notifications, we store the push subscription details your browser provides so we can deliver alerts. This is optional and off by default. (See Section 5.)
Technical data — basic information needed to keep your account secure, such as authentication tokens stored locally on your device.

We do not collect your name (beyond labels you choose to enter), phone number, precise location, contacts, payment card details, or device sensor data.

3. Legal basis for processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data on the following legal bases under the General Data Protection Regulation (GDPR):

Performance of a contract (Article 6(1)(b)) — processing necessary to provide the PatchMap service you have requested, including account creation, data storage, and collaboration features.
Legitimate interests (Article 6(1)(f)) — processing necessary for our legitimate interests in maintaining, securing, and improving PatchMap, including the product-usage analytics described in Section 4, where these interests are not overridden by your rights.
Legal obligation (Article 6(1)(c)) — processing required to comply with applicable law.
Consent (Article 6(1)(a)) — where we rely on consent, such as opt-in push notifications, you may withdraw it at any time using in-app controls or by contacting us.

4. Usage analytics

To improve PatchMap, we record pseudonymous product-usage events — for example, when a feature is opened or a particular action is taken. These events are associated with your account identifier rather than your name, and are used in aggregate to understand how the product is used and what to build next.

We do not use this data to build advertising profiles, track you across other websites, sell it to third parties, or train AI models on your content. Analytics events are processed using our own infrastructure (see Section 8) and are not shared with external advertising or data-broker platforms.

5. Push notifications

PatchMap offers optional web push notifications (for example, to alert crew members to changes or flagged channels during a show). Notifications are off by default. If you opt in, your browser generates a push subscription, which we store so we can deliver messages to your device. You can turn notifications off at any time through your browser settings or in-app controls, which revokes the subscription.

6. How we use your data

We use your data only to:

Create and manage your account
Store and sync your plots, patch lists, and related content across devices
Enable sharing and real-time collaboration with people you invite
Deliver notifications you have opted in to
Understand product usage and improve PatchMap (see Section 4)
Respond to support requests
Comply with legal obligations

7. Data retention

We retain your personal data for as long as your account is active or as needed to provide the service. If you delete your account, we will delete your personal data within 30 days, except where retention is required by law or is technically necessary for data integrity. Content you delete within PatchMap is removed from our servers within 30 days, subject to the same exceptions. Aggregated, non-identifying usage statistics may be retained indefinitely.

8. How we store your data

App, account, collaboration, and analytics data are stored using Supabase, a cloud database provider. All data is encrypted in transit (TLS 1.2 or higher) and encrypted at rest. We use row-level security controls so you can only access data you are authorised to see.

9. International data transfers

IndieSoft is based in the United States. If you access PatchMap from the EEA, UK, or Switzerland, your personal data will be transferred to and processed in the United States, which may not provide the same level of data protection as your home country.

Where such transfers occur, we rely on appropriate safeguards including Standard Contractual Clauses (SCCs) as approved by the European Commission, or equivalent mechanisms recognised under applicable law. You may request a copy of the applicable safeguards by contacting us at hello@indiesoft.app.

10. Third-party services

As of the date of this policy, we use the following service providers to operate PatchMap:

Supabase — database, authentication, and file storage. Supabase Privacy Policy →
Vercel — application hosting and delivery. Vercel Privacy Policy →

We do not use advertising SDKs, commercial tracking platforms, or social-media trackers for marketing or advertising purposes.

11. Data sharing and collaboration

PatchMap is built for crews. When you share a plot or invite someone to a session, the people you share with can see the content you contribute to that shared space, along with any labels or assignments within it. You control what you share and with whom, and you can revoke access by removing share links or collaborators.

Outside of these features you choose to use, we do not sell, rent, or share your personal data with any third party for marketing or advertising purposes, and we have no commercial relationship with data brokers. We may disclose data if required by law or valid legal process; where legally permitted, we will notify you first.

12. Your rights

Under the GDPR and applicable data protection law, you have the following rights:

Right of access — request a copy of the personal data we hold about you.
Right to rectification — correct inaccurate or incomplete data, in-app or by contacting us.
Right to erasure — request deletion of your personal data; we will action this within 30 days.
Right to restriction — ask us to restrict processing in certain circumstances.
Right to data portability — request your data in a structured, machine-readable format where applicable.
Right to object — object to processing based on legitimate interests, including usage analytics, at any time.
Right to withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing.
Right not to be subject to automated decision-making — we do not use automated decision-making or profiling that produces legal or similarly significant effects.

To exercise any of these rights, contact us at hello@indiesoft.app. We will respond within 30 days and may need to verify your identity first.

13. Right to lodge a complaint

If you are in the EEA and believe we have not handled your personal data lawfully, you may lodge a complaint with your local data protection supervisory authority (a list is available at edpb.europa.eu). In the UK, you may contact the Information Commissioner's Office (ICO). We encourage you to contact us first so we can help directly.

14. Children

PatchMap is a professional tool not directed at children under 13 (or under 16 where required by local law). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

15. Changes to this policy

If we make material changes, we will update the "Last updated" date above and, where required by law, notify you directly. Continued use of PatchMap after changes are posted constitutes acknowledgement of the updated policy.

Questions about this policy? Contact us at hello@indiesoft.app.