Privacy Policy

Data we collect

• Producer accounts (Google sign-in): email address, name, and profile picture. The email is the identity the session hangs on; there is no password anywhere.
• Buyers: the email address entered on the Dodo checkout page (stored trimmed and lower-cased, so one buyer is one row), the name as typed, and the purchase record — beat, licence, amount, and payment id. Buyers never create an account.
• Automatic: per-play counts that feed the dashboard charts, and the operational logs of uploads, checkouts, and deliveries.

Cookies

One session cookie, access_token: httpOnly (JavaScript cannot read it on purpose), SameSite=Lax, Secure in production, and a 7-day expiry shared with the token inside it. Signing out clears it. There are no third-party tracking or advertising cookies.

Who else touches your data

• Google — producer and operator sign-in (OAuth2).
• Dodo Payments — checkout and payouts, acting as merchant of record (so tax and VAT are handled on their side).
• Resend — the buyer download email and the seller receipt.
• Amazon S3 — audio and artwork live in a fully private bucket. Every read and write goes through a short-lived presigned URL; there is no public link to a master, ever.
• Google Gemini — listens to the 30-second preview once per upload to suggest tempo, key, tags, and titles. Suggestions only ever fill empty form fields, and publishing never waits on them.

We do not sell personal data, and we do not share it with anyone outside the list above.

Retention

Sessions end after 7 days. Download links are permanent — a licence is permanent, so re-opening the emailed link mints fresh short-lived file URLs for as long as the sale exists. Completed sale records are kept as the payout and financial ledger. AI suggestions are kept per asset version so a re-upload starts clean.

Deletion and access

To export or delete your data, write to hello@beats.dirtybucket.store. Deletion removes the profile, listings, and session; completed sale records are kept where payment and tax law requires it.

Children's data

DirtyBucket is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has provided data, contact the address above and we will remove it.

Changes

If this policy changes materially, the “last updated” date above moves and producers are notified by email. The buying rules live in the Terms of Service.