Privacy Policy

Last updated October 22, 2026

1. Who we are

Demo Jail (demojail.com) is an independent service based in Tennessee, USA. For anything about your data, email hello@demojail.com.

2. What we collect

• Account details: email address, display name, password (stored only as a secure hash by our login provider), and your birthdate. Your birthdate is never shown to anyone; we use it to enforce the minimum age and age rules for sponsors (such as 21+).
• If you sign in with Google: your name, email address and Google account ID, shared by Google with your permission.
• What you do on the radio: songs played and for how long, ratings (including your first rating of a song), favs, booted songs, and sponsor messages played or clicked.
• What you post: songs, artwork, clips, voice recordings, mixtapes, chat messages, posts, shows, reports and feedback.
• Location: the area you choose for local radio, or, if you haven't chosen one, an approximate city based on your IP address. With each play we store only a rough area (rounded to about 7 miles). We never ask for your device's GPS location.
• Payments: if you buy a sponsorship, Stripe handles your card. We store only Stripe reference numbers and what was bought, never your card number.
• Technical data: standard server logs (such as IP address and browser type) kept by our hosting providers for security, error reports when something breaks (see Sentry below), and a short log of changes you make on the site (for example, creating, publishing or deleting a mixtape, song or show) so we can help when something goes wrong.
• Embedded players on other websites: when someone plays a Demo Jail player embedded on another site, we store a random ID kept in that browser (so a play counts once a day) and the address of the website it was played on. No account or name is involved.
• Searches: what you type into music search in the mixtape studio is sent to search providers (see section 6) to find songs and videos. Searches are not linked to your name when sent.
• Bands on public show listings: we make a page for acts listed on public venue and city calendars (name, home area, upcoming shows, and a YouTube or Deezer link to their music). To let a band know about its page, we look up the band's own public contact details (an email address or social media profile the band publishes for bookings and fans, found through a web search, its website or Bandcamp, or its YouTube channel) and note where we found them. These details are never shown on the site.
• Quick setup for bands: when a band pastes its own links (Bandcamp, Spotify, SoundCloud, YouTube, its website), we read those public pages to suggest a photo, bio, home town, a links announcement and its release list. Nothing is saved unless the band chooses it; a chosen photo is copied to our storage after an automated content check (see section 6).
• Backstage pass lists: a band can give people access to its backstage-only songs by display name or by email address. We keep that list (and the email addresses a band enters) only so those people can hear the songs; the band's members can see their own list, nobody else can.

You can listen without an account; we then create an anonymous guest session so the radio can avoid repeats and count plays. If you later sign up or log in from the same browser, that guest session's listening history moves to your account and the guest session is deleted.

3. How we use it

• To run the radio: pick songs, avoid repeats, play local music and your favs, remember booted songs.
• To rank songs and show stats: plays, ratings and favs feed rotation and the charts (see the FAQ). Band members' own activity on their songs is left out.
• To show bands totals and averages about their songs; never which person listened or rated.
• To play sponsor messages that fit your rough area, genre, time of day and age bracket, and to tell sponsors how many plays, listeners and clicks their message got (totals only).
• To keep the community safe: automatic checks of text and voice, reports, and enforcing the Terms.
• To send emails you need: login links, password resets, band invites, early-access invites and replies about your account or sponsorships. We don't send marketing emails without asking.
• To tell a band that it has a page: one message per band, by email or social media, with a way to unsubscribe and to have the page removed. If a band unsubscribes or asks, we don't contact it again.
• To fix bugs and keep the service secure.

4. Automated checks

• AI-music check: we may check uploaded songs (for example, the tags inside the file) for signs that they were AI-generated. If we ever send your audio to an outside detection service, we'll name it in section 6 first. See the AI policy.
• Moderation: chat messages, posts, mixtape text and profile pictures are checked by OpenAI's moderation service. Mixtape voice recordings and sponsor messages are transcribed and checked by OpenAI before others can hear them. A daily summary of feedback, reports and blocked messages for our team is also written with OpenAI.

These checks can block a message or hold a recording for review, but a person makes the final call on anything beyond that, and you can always email us. We don't use your content to train AI, and OpenAI's terms for our account don't allow it to train its models on what we send.

5. Who can see what

• Public: your display name, bands, published songs and artwork, public mixtapes, chat messages and posts you write, and shows bands list.
• Bands: totals, averages and trends for their songs. Never names, emails or individual ratings. A band also sees who is on its own backstage pass list.
• Sponsors: totals for their own campaign (plays, listeners, clicks). Never who heard or clicked.
• Our team: account and activity data when needed to run the service, review reports or help you.

6. Services that help us run Demo Jail

We don't sell or rent your personal data, and we don't share it for targeted advertising. We share it only with these providers, which process it for us under their own security and privacy commitments:

• Supabase: database, file storage and login (account details, activity, uploads).
• Vercel: website hosting and server logs; also tells us your approximate city from your IP address. Vercel Web Analytics counts page views (which pages, the referring site, country, device and browser type) without cookies and without identifying you.
• Cloudflare Turnstile: bot checks on sign-up, login and other forms; it looks at your browser and IP address to tell people from bots.
• Resend: sending emails (your email address and the message).
• Stripe: payments for sponsorships (your payment details go to Stripe directly).
• OpenAI: moderation and transcription (see section 4).
• Sentry: error reports; we send only your account ID, not your name, email, IP address or cookies.
• Google: "Continue with Google" sign-in, YouTube (below), and YouTube's data service to look up videos.
• Brave Search: finding YouTube videos for mixtape search and show listings, and bands' public websites and profiles (search words only).
• Deezer: looking up songs and artists, and its player (below).

We may also share information if the law requires it, to protect people from harm, to enforce our Terms, or if Demo Jail is transferred to a new owner (such as a company formed to run it), who would have to follow this policy.

7. YouTube videos

Some mixtapes and show lineups include YouTube videos, which play in YouTube's own player (using YouTube's privacy-enhanced mode). The player is loaded from Google when a video comes up, and Google may then collect information, such as your IP address and how you use the player, under the Google Privacy Policy. Watching YouTube content is subject to the YouTube Terms of Service. You can review or delete data Google holds about you at Google's security settings page.

On show pages and in mixtapes you can play music from Deezer in Deezer's own player. It loads from Deezer only when one of those plays, and Deezer may then collect information under the Deezer Privacy Policy.

8. Cookies and local storage

We use only cookies needed for the site to work: keeping you logged in, remembering your local-radio area, and early-access passes. Your theme choice is saved in your browser. We don't use advertising or analytics cookies, and we don't track you across other websites. Page-view counts (Vercel Web Analytics, section 6) work without cookies.

9. How long we keep it

• Account data, plays, ratings and content: for as long as your account is open, until you delete them or your account.
• Guest sessions: plays and favs from a guest session stay on our servers for counting and charts, but they aren't linked to a name or email, and once you clear your browser data they can't be linked back to you.
• Early-access invite links expire after 30 days.
• Band contact details we looked up: until the band claims its page (then the band manages its own details), its page is removed, or the band asks us to delete them. When a band claims its page, we offer the public profile links we found (never email addresses) back to the band once in Quick setup, then delete them when the band saves or skips setup, or after 30 days. If a band unsubscribes, we keep only its email address on a do-not-contact list so we never write again.
• When you delete your account, your account and personal data are deleted right away, except: payment records (kept for 7 years for tax and accounting, without your account), reports and feedback you sent (kept without your name), band posts (kept with the band without your name), and our providers' backups, which roll over within 30 days.
• Server logs and error reports: kept by our providers for a limited time, generally 90 days or less.
• The log of changes you make on the site: 90 days, or until you delete your account.
• Records of moderation decisions and bans: kept while they're needed to keep the community safe (for example, to stop a banned person from returning), then deleted.

10. Your choices and rights

• Change your display name and password on your account page; unrate, unfav or delete your content any time.
• Delete everything at Account > Delete my account.

Wherever you live, you can ask us to: confirm whether we process your personal data; give you a copy of it in a portable format; correct it; or delete it. Email hello@demojail.com from your account's email address (so we can confirm it's you), or have an authorized agent do so with your written permission. We'll answer within 45 days (sooner when we can), and if we need more time we'll tell you why. It's free, and we won't treat you differently for asking.

We don't sell personal data, use it for targeted advertising, or use it for automated decisions with legal or similarly significant effects, so there is nothing to opt out of; if that ever changes, we'll update this policy and offer an opt-out first. We don't collect sensitive data such as precise location, health or biometric data.

Appeals: if we turn down your request, you can appeal by replying with "Appeal" within 60 days. Someone who didn't make the first decision will review it and answer in writing within 60 days. If we still deny it, you can contact your state attorney general (in Tennessee, the Consumer Protection Division at tn.gov/attorneygeneral).

Depending on where you live (for example in some U.S. states, the EU or the UK), you may have further rights, and we'll honor them.

11. Children

Demo Jail is not meant for children under 13, and we don't knowingly collect personal information from them. Everyone who signs up must give a birthdate, and anyone under 13 can't create an account. If we learn that we have collected personal information from a child under 13, we delete the account and the information promptly. Parents or guardians who believe their child has given us information can email hello@demojail.com, and we'll delete it. Some sponsor messages are limited to listeners 18+ or 21+ based on the birthdate you give us.

Pursuant to federal law (47 U.S.C. § 230(d)), we notify you that parental control protections (such as computer hardware, software, or filtering services) are commercially available that may assist you in limiting access to material that is harmful to minors. Information identifying current providers of such protections is available from the FTC at consumer.ftc.gov/articles/parental-controls.

12. Security and where data is stored

We protect your data with encryption in transit, access controls in our database (each person can only reach their own private data), private storage for audio and recordings, and limited staff access. No service is perfectly secure. If a security breach exposes your personal information, we'll notify you (and authorities where required) without unreasonable delay, and in any case within the time the law requires (in Tennessee, within 45 days of discovering it), and tell you what happened and what you can do. Our providers store data in the United States, so if you use Demo Jail from elsewhere, your data is transferred to the U.S.

13. Changes

We'll update this policy as Demo Jail changes. If a change is significant, we'll tell signed-in users on the site or by email before it takes effect.

See also: Terms of Use · Privacy Policy · AI policy · FAQ