Privacy policy.

For the Backsleeve website, publishing workspace and iPhone/iPad app.

Effective and last updated: 4 October 2026

You can listen to public music without an account. Signing in lets you sync saved releases, favourite tracks and followed artists. This policy explains what stays on your device, what reaches our services and how to exercise your rights.

Who is responsible

PX7 Digital / Jørgen Larsen
Privacy contact: jorgen@larsen.zone

We are responsible for the operation of Backsleeve and its account, listener and service data. An artist or label decides what it publishes in its workspace. Contact us if published lyrics, credits, images or other material contain your personal information and you want it corrected or removed.

Data and purposes

Public browsing and listening

We deliver catalogue pages, artwork and audio over the internet. Requests provide network information such as IP address, requested address, browser or app information and timing. We process this to deliver content, issue temporary audio access, troubleshoot failures and prevent abuse. Public listening does not require your name or email.

Accounts and synced libraries

Sign-in uses the shared PX7 account service. Backsleeve receives your account identifier, email and display name and links them to a Backsleeve user and session. We store saved releases, favourite tracks, followed artists and the revision information needed to sync changes between devices. Account information is required for these signed-in features; you can use public listening without providing it.

Your iOS sign-in is stored in the device Keychain. Passwords entered for sign-in or confirmation are sent to the account service for verification; the native app does not save those passwords. Legacy web accounts may have a protected password hash rather than a plain-text password.

Data on your device

The iOS app stores guest and account libraries separately. Recent listening, playback queue and position stay on the device and are not sent through library sync. Recent listening is limited to 100 entries. Guest favourites are imported into an account only when you choose to import them. Your operating system's backup settings may include app files; this is separate from Backsleeve sync.

Optional notifications

With your permission, release alerts notify you about new music from followed artists. App versions that support server push can register an Apple push token, a random installation identifier and the chosen notification preference while you are signed in and server notifications are available. These are linked to your Backsleeve account for delivery, not advertising or tracking. The installation secret and ordering of your choices stay securely in device Keychain; the service stores a hash of the secret. The app requests its Apple push token again on launch and does not save that token on the device.

Earlier app versions, guests and unavailable server push use local release checks, subject to iOS refresh scheduling. Turning alerts off clears pending and delivered app alerts and retires a server registration where present. Logout also retires session-linked server delivery. Offline changes are preserved on the device and retried when online; the app distinguishes pending changes from server confirmation. Apple may already have accepted a notification before an opt-out reaches our server. Notification delivery is not guaranteed.

Server delivery attempts expire after 24 hours. Retired registrations and completed delivery records are selected for daily cleanup after 30 days in bounded batches; deletion of the Backsleeve account removes account-bound registrations and delivery records. A release-level publication receipt prevents repeated alerts when old music is republished and lasts while the release exists.

Publishing and communication

Workspace content includes artist biographies, releases, tracks, artwork, audio, lyrics, contributor names, credits and links. Published material is visible to visitors and may be indexed by search engines or shared outside Backsleeve. Workspace membership, invitations and import history support collaboration. We also process email addresses and message content for invitations, support, feedback and requested early-access updates.

Artists and labels may add third-party streaming or social links. Following those links takes you to services with their own privacy policies.

Website storage and measurement

Essential web cookies keep you signed in and support account authorization. The native app uses secure device storage for its session. Blocking essential cookies can prevent web sign-in.

Backsleeve does not load optional browser analytics or store campaign identifiers. Current web pages remove campaign session storage left by earlier versions. There is no optional analytics storage to consent to. Public streaming-link measurement stores aggregate daily counts for each link, without visitor identifiers or IP addresses in those counts. The native app has no third-party analytics or advertising SDK. Third-party streaming services opened from Backsleeve have their own storage and privacy choices.

Diagnostics and security

We process request metadata, service errors, session identifiers and abuse-protection counters to protect accounts and diagnose faults. Abuse counters can include IP addresses or account identifiers. We do not describe public listening as anonymous to the network service. Backsleeve does not use listener data for advertising profiles or sell listener libraries.

Legal bases

Providing the requested service (GDPR Article 6(1)(b)): account access, saved-item and follow sync, publishing and workspace collaboration.
Legitimate interests (Article 6(1)(f)): reliable delivery of public content, security, fraud and abuse prevention, troubleshooting, handling support and basic service measurement. Our interests are operating and improving the service safely. You can object to processing based on legitimate interests.
Consent (Article 6(1)(a)), where applicable: optional release alerts and requested promotional or early-access communications. You can withdraw consent without affecting earlier processing.
Legal obligations (Article 6(1)(c)), when applicable: responding to lawful requests or retaining records required by law.

Backsleeve does not make decisions with legal or similarly significant effects on you solely through automated profiling. Security limits may automatically reject abusive requests.

Retention and deletion

We retain account and synced-library records while needed to provide the account and resolve outstanding requests. Removing a saved item or follow leaves a removal record so an offline device does not restore it during sync. Those records have no separate automatic deletion period; they are removed with confirmed Backsleeve account erasure.

Backsleeve sessions expire after seven days. Expired sessions are removed by daily cleanup in bounded batches, so expiry and physical removal are not the same instant. Short-lived mobile authorization requests expire after ten minutes and exchange codes after one minute; expired authorization records are cleaned when new requests start.

Temporary security counters expire with their configured rate-limit window. Database fallback security windows older than seven days are selected for daily cleanup in bounded batches. Deletion-recovery receipts contain hashed former session tokens and request identifiers, remain usable for seven days and are then selected for cleanup.

Import history and completed, revoked or expired invitations are selected for daily cleanup after 30 days without activity, in batches of up to 5,000 records per category. Removing invitation history does not remove an accepted workspace membership. Expired mobile authorization records are also selected for daily cleanup. The early-access waitlist is retired; its old contact records are removed rather than retained for marketing.

Our application-written error messages contain a random request identifier, a general route category, timing and error type, rather than passwords, email addresses, query strings or raw exception messages. Automatic full-request invocation logs are disabled. Cloudflare Workers logs have a maximum seven-day retention period under the provider's current service settings. Our scheduled backup logs rotate after 30 days.

Scheduled database and media recovery snapshots cover 30 days. After a new backup is verified, expired snapshots and expired media copies no longer referenced by retained snapshots are removed. Media still needed by a retained snapshot is preserved for recovery. Cleanup requires the backup runner to be available; a failed or missed run delays removal. Copies in backups can outlast live deletion. Restoring an old backup must not be treated as permission to recreate erased accounts; contact us about an erasure request affecting recovery copies.

Resend documents a 30-day retention period for email delivery and API log data on its standard plans. This is separate from mailing-list contacts and messages retained in a support mailbox. We retain support correspondence while needed to handle the request and any applicable legal requirement. Contact us about a specific erasure request, including provider records and backups.

Deleting your Backsleeve account

Signed-in listeners can request deletion in the app's Profile. Confirmation removes the Backsleeve user, sessions and synced library and associated app-owned records. Your guest library and other accounts' local files are preserved. Workspace owners must resolve ownership before deletion; a transfer preserves the workspace and its published catalogue. Contact the privacy address if ownership or a protected account prevents self-service deletion.

Deleting a Backsleeve account does not delete the shared PX7 identity used by other apps, another workspace's catalogue, or copies already published elsewhere. Shared PX7 account deletion is available through PX7 Accounts and coordinates linked Backsleeve account erasure after workspace ownership is resolved. Contact us about published content, provider email records or recovery copies.

Signing out preserves the account library on the device. If a deletion response is lost or cannot be confirmed, the app preserves local data and offers separately confirmed local sign-out or local-library removal. A local-only action does not confirm server deletion. Uninstalling or using device backup controls is separate from a server account-erasure request.

Your choices and rights

You can listen without signing in, edit saved items and follows, disable alerts and choose whether to import guest favourites. To request access, correction, erasure, restriction or portability of your personal data, or to object to legitimate-interest processing or withdraw consent, email jorgen@larsen.zone. These rights depend on the circumstances and applicable law. We may need to verify your identity before disclosing or removing account data; please do not send a password by email.

You can complain to the Danish supervisory authority, Datatilsynet, including if you disagree with how we handle a request. You do not need to contact us before exercising that right.

We update this policy when service behaviour or processing changes. The date at the top identifies the current version; material changes will be communicated through the service where appropriate.