Privacy policy

Who runs AutoStacc

AutoStacc is run by an individual based in Utah County, Utah, United States, who decides how the information below is used. Questions about your data: Email [email protected].

The short version

• AutoStacc keeps what it needs to run your account, sell you things and deliver your files. Nothing is sold to anyone.
• Card details never reach AutoStacc: payments happen on Stripe's own page, and a card a creator saves for paid storage is kept by Stripe.
• There are no advertising or tracking cookies. Visits are counted as anonymous daily totals.
• The store's picks for you come from history kept in your own browser; AutoStacc uses it for that one answer and keeps none of it.
• You can download everything held about you or delete your account at any time.

Your account

When you create an account: your name, your email address, and your password, which is stored only as a one-way hash (nobody, including AutoStacc, can read it back). Whether you've confirmed your email, and when the account was made. If you add a phone number in Settings, AutoStacc keeps it to reach you about your account only: it isn't checked, shown to anyone, shared, or used for sign-in or texts, and it's gone when you clear it or delete the account.

When you sign in: a session, so you stay signed in until 30 days after you last use the site (or until you close your browser, if you untick "Keep me logged in"). Each session records the IP address and browser it started from; you can see them, and sign any of them out, under Settings › Security.

Admin accounts only, where AutoStacc has made it available: if you switch on two-step sign-in, the secret key your authenticator app uses and ten one-time backup codes are stored with your account, encrypted, along with whether it's on. Both are deleted when you switch it off or delete the account; your data download says only whether it's on, never the key or the codes. While you type the code after your password, a cookie (gs.two_factor) holds that sign-in for up to 10 minutes.

If you follow projects, turn on Auto-Stacc, vote in polls, save products to your wishlist, organize Your Stacc with collections, tags and saved searches, or choose which emails you get, those choices are stored with your account. Collections, tags and saved searches are yours alone: nobody else, including the artists, sees them.

Orders and purchases

For every order: the email it was placed with, what was in it, the prices charged, any promo code, its status (paid, refunded and so on) and when. Stripe's reference numbers for the payment are kept so refunds and disputes can be matched to the order.

What you own is recorded separately, so your library knows which files you can download.

If you sell in the Studio: your products, what each sale earned you after AutoStacc's fee and refunds (never who bought), and, once you set up payouts, the reference of your Stripe payout account, the country of its bank account and whether it is ready (Stripe, not AutoStacc, collects and keeps your ID, tax and bank details; see Stripe's privacy policy). Each payout is recorded with its amount and Stripe's transfer reference. If payouts are still sent by hand, the payment details you type in (for example a PayPal address) are kept with the payout record, visible only to you and AutoStacc.

If you make a creator space in the Studio: its name and address, the profile and pages you design there and the images and fonts you upload for them (published pages are public), and who is on its team with which role. If someone invites you to a team, AutoStacc keeps your email address with the invitation until you accept it, it is withdrawn, or it expires after 7 days. Team members see each other's names; the owner and admins also see members' email addresses. Pieces you share to the community library are public to everyone using the Studio, with your creator name; AutoStacc records which creators install them. If you report a piece, AutoStacc keeps your report and who sent it, and doesn't show it to the creator. The last 20 published versions of each page are kept, with when they were published and whether by you, a member of your creator space or a schedule you set, so you can restore one; a file a published page or a kept version still uses stays until nothing does. Releases and events you add to a project in the Studio (with their tags, and for an event its date, time, place and ticket link) are public once published, under the project's name, shown on the project's pages and the events calendar, and listed for search engines when AutoStacc trusts your creator space; AutoStacc keeps which member of your creator space added each and when each was last changed. One you delete leaves the site at once and is kept privately as a record. News posts added before news moved to the community aren't shown for now and are kept privately until they become your community's posts. "Add to calendar" on an event is a file and a Google Calendar link made the same for everyone, so using it tells AutoStacc nothing; the calendar's Following filter uses the projects you already follow. For each of your products the Studio keeps a history of changes (what changed, such as the price or putting it on sale, when, and which member of your creator space did it), visible to your creator space and AutoStacc. Files you upload to sell are checked automatically by AutoStacc's own systems (that each is what its name says, undamaged and safe; for audio, its tempo and key are estimated and a waveform drawn), and a checksum of each is kept so it can be delivered byte for byte. Nothing you upload is sent to anyone else for this. Files you remove are deleted from storage a day later.

Storage: what your creator space stores is measured once a day (how much in all, split into paid files, Pac files, uploads in progress, preview clips and site files; a file several products or versions use counts once). If you take paid storage, AutoStacc keeps the limit you chose, each day's measurement, the most you chose to spend a month, a monthly statement worked out from those days (what was stored above your free storage, the rate, the amount, how much came from your earnings), whether and when it was paid with Stripe's reference for the payment, each try at charging a saved card (when, and whether it went through or why the bank said no, never the card itself), and a history of every change (who in your creator space or at AutoStacc made it, when). Only your creator space's owner and AutoStacc see the statements and history; your team sees the storage figures. They are kept as billing records, like orders.

If you review a product you own: your stars, what you wrote, and when. It's shown publicly as "Verified buyer", without your name or email, and only while you still own the product (after a refund it's no longer shown). AutoStacc can hide a review that breaks the rules. Your reviews are in your data download and are deleted with your account.

If you buy without an account, the order is tied to your email and a private key kept in a cookie on your device, so you can open your purchases from the receipt link for 30 days.

Payments

Payments are taken by Stripe on its own checkout page. Your card number, expiry and security code go to Stripe, never to AutoStacc. For creators' products, Stripe also asks for the address it needs to work out sales tax. Stripe tells AutoStacc whether the payment succeeded, failed or was refunded.

Paid storage: if you own a creator space and save a card for its storage statements, you enter the card on Stripe's page and Stripe keeps it. To set you up as a Stripe customer, AutoStacc gives Stripe your email address and your creator space's name. AutoStacc keeps only Stripe's customer reference, the card's brand and its last 4 digits (so the Studio can show which card is saved), and who saved or removed it and when. Each month, whatever your cleared earnings don't cover is charged to that card automatically; Stripe tells AutoStacc whether the charge went through. You can replace or remove the card in the Studio at any time; removing it deletes it from your Stripe customer, and AutoStacc keeps the record that it was removed.

Downloads

Each download link is made for you when you ask for it and stops working after a few minutes. AutoStacc records that a link was made and used (which file, for which purchase, and whether it was allowed), without your IP address.

The store's picks for you

To choose "Recommended for you" and similar rows, your browser sends a summary of its own store history (above) with that one request. AutoStacc uses it to rank the products and keeps none of it: it isn't stored, logged or linked to your account. When you're signed in, the ranking also uses your wishlist and what you already own (so it never offers you something you have). Turn personal picks off on the store or the home page and nothing is sent; everyone then sees the same rows.

"Bestselling" and "bought recently" come from completed purchases counted together, never from who bought what.

Visit counts

To know what people look at, the site counts events per day: a page kind or a product or release id and a number. No cookie, IP address, account, browser or device is attached to a count, so a count can't be traced back to anyone.

If your browser sends Global Privacy Control or Do Not Track, nothing is counted at all.

Cookies and storage on your device

Only what the site needs to work:

• gs.session_token (named __Secure-gs.session_token on autostacc.com, which marks it as sent only over a secure connection): keeps you signed in (only after you sign in).
• gs.dont_remember: only if you untick "Keep me logged in", so you're signed out when you close the browser.
• gs_guest: lets a guest open their own orders (only after a guest checkout; 30 days).
• In your browser's storage, never sent anywhere: your cart, light or dark theme, whether the sidebar is open, whether sounds are on, a note that this browser was signed in (not who), a community username you picked while creating an account (until your account joins the community with it), and, until you close the tab, the email and promo code you typed at checkout.
• The store's history, also only in your browser: which products you open, preview, add to your cart, save or mark "not interested", which filters you use and what you search for (in the store, on Discover and on New & upcoming), which picks you were shown, plus the genres and kinds you choose, for at most 90 days. The home page also reads it, without sending it, to suggest projects whose genres match. Forget it or turn it off on the store or the home page.

No advertising, analytics or cross-site tracking cookies are used.

Emails

AutoStacc sends the emails an account and a purchase need: confirming your email, resetting your password, receipts and download links. A record of each (what kind, to whom, when) is kept so a receipt can be resent. A creator space's owner with paid storage also gets its billing emails: each monthly statement, each time a card charge fails (with a link to update the card or pay), when the bank asks you to confirm a payment yourself, and when a statement is overdue.

Anything else (news about releases from projects you follow, AutoStacc news) is only sent if you switch it on under Settings › Emails, and you can switch it off there at any time.

Project mailing lists: if you sign up on a project's page, AutoStacc emails you a link to confirm. Only once you click it is your address added to that project's list at Brevo, which sends the newsletter; every newsletter has an unsubscribe link. AutoStacc doesn't keep the sign-up itself.

When AutoStacc helps you

To solve a problem you report, AutoStacc's staff can view the store as your account sees it. Every time that happens it is recorded in an audit log, it can't make real purchases or change your password, and it ends on its own.

Who else is involved

• Stripe: payments, and the cards creators save for paid storage.
• Brevo: sending emails, and keeping the project mailing lists you confirmed and, if you switch on AutoStacc news, the AutoStacc news list.
• Cloudflare: hosts the site, the database and the files.
• Google Fonts: the site's fonts load from Google, which sees your IP address when they do.
• Music players (YouTube, Spotify, Deezer and others) on release pages and creators' pages are loaded from those services and follow their own privacy policies.

Nothing about you is sold or shared for advertising.

Protection against abuse

To slow down password guessing and other abuse, the site counts requests per IP address for each kind of request (only the count and the time of the latest one), and newsletter sign-ups also per email address, stored only as a scrambled code (a hash). These counters aren't linked to your account or used for anything else, and are deleted within a day of the latest request.

How long things are kept

• Your account and its choices (including your wishlist, collections, tags and saved searches): until you delete it.
• The store's history in your browser: at most 90 days, or until you forget it.
• Sessions: until you sign out, sign them out, or 30 days pass without you using the site.
• Download links: a few minutes. The record that a link was made and used is kept with the order's history; when an account is deleted, it no longer names the account.
• Guest access to an order: 30 days, from the receipt link or the cookie.
• Records of emails sent: kept so receipts can be resent; when an account is deleted, the address in them is removed.
• The audit log of what AutoStacc's staff did (including viewing the store as your account): kept and never changed.
• Orders: kept as sales records even after an account is deleted (tax, refunds and disputes need them), but no longer linked to you.
• Reviews: until you delete them or your account.
• Storage measurements, statements and their history (creators with paid storage): kept as billing records, like orders.
• A saved card: at Stripe until you remove it. AutoStacc keeps the Stripe customer reference, and the card's brand and last 4 digits until you remove or replace it.
• Visit counts: kept as anonymous totals.
• Project mailing lists: at Brevo until you unsubscribe.
• Abuse counters: only the latest count for each IP address and kind of request, deleted within a day of it.

The community

If you take part in the community, AutoStacc keeps: the username you choose (you can change it in Settings; your posts show the current one) and when you confirmed you're 16 or older; what you post (takes and replies, as you wrote them, with earlier versions of edited posts); your boosts and Helpful votes; and the time of your posts, which is used to pace posting and stop spam. Everything you post is public under your username, or under a project's name when you're on its team and choose "Post as" (AutoStacc still records that you wrote it), never your email. If you report a post, AutoStacc keeps your report (the reason and your note) and who sent it; the space's team sees the report but not who made it. If you appeal a decision, the team sees your appeal and your username. What a space's team does (hiding, removing, banning, with the reason) is kept in that space's log, which names the team member and the person by username. Reports and appeals are kept for 12 months, then deleted; deleting your account removes your appeals and your name from your reports.

Your posts stay until you delete them. A post you delete, or one a space's team removes, is kept privately for 12 months and then its text is deleted. If you use the community's keeping-up features, AutoStacc also keeps the takes you follow (including ones you follow automatically by posting), the spaces you joined, the takes you saved (visible only to you), whether you've seen a space's welcome message, the notifications you were sent (replies, mentions, best answers; read ones are deleted after 90 days), whether you switched mention alerts off, and how you chose to see strong swear words in posts (softened, as written, or folded away). Tags you add to a take, a space, a creator space or a project are public with it, and the tags you type are checked against AutoStacc's word lists on AutoStacc's own servers; nothing you type is sent anywhere else for this. A post a space's rules hold for its team (a link to a site the space hasn't allowed, a word or rule the team set) is stored hidden, with the reason, until the team approves or rejects it. If AutoStacc lets your account start a different number of communities than everyone else, it keeps that number and a short note on why until it's removed or your account is deleted. If you block someone, AutoStacc keeps who you blocked (they aren't notified) until you unblock them. If AutoStacc removes a post of yours for a legal reason or suspends you from the community, it keeps the reason and, for a suspension, until when; a legally removed post is kept privately as the law requires. Deleting your account keeps your posts as "deleted user" and erases your name, votes and edit history. Your community data is in your data download.

If you send a copyright notice

AutoStacc keeps what your notice says, whether you send it by email or with the notice form: your name, email address and postal address, whether you own the work or act for the owner, the work you say is infringed, where it is on AutoStacc, your statements and typed signature, with what AutoStacc decided. To limit how many notices one place or one email address can send, the sender's network address and the notice's email address are kept as counters for about a day. The person whose upload you named isn't shown your details unless they send a counter-notice, which the law requires AutoStacc to pass between you. Strikes are kept for the 12 months they last, and the record of a notice as long as the law requires. If you send a counter-notice, AutoStacc keeps it (your name, email and postal address, statements and signature) and passes your name, address and email to the person who sent the notice, as the law requires.

Requests from police and courts

AutoStacc gives information about an account only in answer to valid legal process, such as a subpoena or court order, and only what it asks for. You're told about the request unless the law forbids it or someone is in danger. Where someone's life is at risk, AutoStacc may answer an emergency request sooner. Material that exploits children is reported to the authorities as US law requires.

Your choices

• See and download your data: Settings › Privacy and data.
• Correct your name or change your email: Settings › Profile. A new email is confirmed by a link sent to it, and the old address is told.
• Stop optional emails: Settings › Emails.
• Delete your account: Settings › Privacy and data. Your sign-ins, follows, wishlist, collections, tags, saved searches, votes and choices are erased, your library stops downloading, and your orders stay only as anonymous sales records.
• Anything else: Email [email protected].

Depending on where you live, data-protection law may give you further rights. Ask, and AutoStacc will help.

Changes to this policy

When this policy changes, the date at the top changes with it. If a change affects what is collected or who sees it, it will be announced on the site before it takes effect.