Privacy Notice

How Mikey handles your information.

Version: 2026-10-22.1 · Effective: 22 October 2026

This notice explains how the operator of the app, a private individual in Israel (“the Operator”), handles personal information in the Mikey for Bands private alpha (the “Service”). Mikey is a personal hobby project run by that one person. The Operator offers it free, to a small number of invited bands, as a personal favor. There is no payment, no advertising, and no sale of data. This notice is written for invited members and for the people who can be identified in a band’s material. It is meant to meet the notice duties in the Protection of Privacy Law, 5741-1981, as amended by Amendment 13 (in force since 14 August 2025), together with the Privacy Protection (Data Security) Regulations, 5777-2017.

Privacy requests, including access, correction, deletion, and withdrawal of the analytics choice, go to hello@mikeyforbands.com.

This notice is not consent

When you check “I acknowledge that I have read the Privacy Notice”, you confirm that you received this notice. That check is not consent to use your information. It is not consent to product-improvement analytics, marketing, or model training.

The Operator does not:

• send marketing email;
• use recordings, notes, or other band content for anything other than providing the Service to that band;
• train an AI or other model on your content;
• transcribe, translate, or otherwise analyze recordings with AI;
• use voices to identify people automatically; or
• sell personal information or share it with advertisers.

A future use would be described in an updated notice, with a separate opt-in where the law requires consent.

Product-improvement analytics

Product-improvement analytics is a different purpose from operating the rehearsal service for your band. It is not advertising measurement and it is not training a model.

You do not have to agree. The first-login form has a separate checkbox, “I agree that Mikey may use my usage information to improve the Service.” It is unchecked unless you check it. Leaving it unchecked does not block the Service. Silence, and the required Privacy acknowledgement, are not this consent.

Giving this information is voluntary. If you do not agree, you can still use the Service. If you agree, the Operator stores that choice and the time you made it. The Operator also stores one row each time you open a recording and press play. Pausing, seeking, or playing again on that same player without leaving it does not add another row. The columns in that row are id, band_id, recording_id, person_id, and played_at. The Operator does not store the audio, the playback position, your IP address, your browser’s user-agent, or a cookie for this choice.

Each time the required policy version changes, the form asks again and the box starts unchecked. The latest answer replaces the earlier one when it is saved, so leaving it unchecked is a no even if you had said yes. You may also ask to withdraw by emailing hello@mikeyforbands.com. If you cannot email from the Google address on your account, the Operator may try to verify you another way. A saved no is what the software uses. A later no does not delete a play already stored. Withdrawal does not close your account.

Who is responsible

The Operator is the owner of the Service’s databases for the Protection of Privacy Law. Members decide what a band puts into the Service. The Operator decides how the Service stores and secures that material. The member who uploads a recording is responsible for having permission from the people who can be heard or identified in it.

Information the Service holds

Account and sign-in. Google’s account identifier, your verified email, your name, and, if Google sends one, a profile-photo address. Your choice to show that photo or your initials. The sign-in tokens Google issues, stored on the server. A session token that keeps you signed in. The session lasts until you sign out, or seven days after it was last refreshed. It refreshes when it is more than one day old. The application uses that essential sign-in cookie only. The public website does not set cookies.

IP address and device data. The Operator does not store your IP address or your browser’s user-agent string in the application database, and the Operator does not store them with your acceptance record or your analytics choice. In production, sign-in rate limiting holds the client IP briefly in memory and never stores it. Product-improvement analytics, if you opt in, does not use that IP address.

Membership and band material. The bands you belong to, your authorization role, and the musical profile you choose to enter, such as instruments. Invitation email addresses a band administrator enters. Repertoire, rehearsal notes, attendance, and similar text the band enters. Recordings a member uploads, including the file name, duration, technical file data, segments, and a waveform generated so the band can see the shape of the recording while playing the audio. The audio stays in the band’s private store. The Operator does not send it to an AI service. An edit history of song and note changes, and an audit history of membership changes. While the account exists, those histories include the actor’s name and, for an invitation, the invited email address. After the account is deleted, the account record is renamed Former member and its email is replaced. Song notes and shared history that member wrote stay with the band, as recordings do, and the member’s name can still appear there. On the membership history, an entry tied to that account shows Former member. An entry that came only from an invitation shows Unknown member. The email on an invitation-only entry is cleared.

A voice or performance in a recording is personal information about a person who can be identified from it. The Operator holds that recording as band content so the band can rehearse. The Operator does not use it as a biometric identifier and does not use it to identify people automatically.

Acceptance record. When you accept the current Terms and acknowledge this notice, the Operator stores your account’s person id, the document type (Terms or Privacy Notice), the document version, and the time. The Operator does not store an IP address or device details on that record. If the version changes, the Operator asks again and keeps the older row.

Analytics choice. The Operator stores whether you checked the optional analytics box, and when. No row, or a no, means the Operator does not use your information for product-improvement analytics.

An agent you connect. If you approve an MCP client, that client can read and change repertoire, rehearsal notes, recording metadata, and segments for bands where you are an active member. A band administrator’s client can also manage invitation links. The client does not receive the recording file, and the Service does not send email for this. You can refuse the connection. A client you approve processes the data it receives under that client’s own provider’s terms, not under this notice. The promise that the Operator does not train a model covers Mikey only. Access tokens for that client expire after one hour. Refresh tokens expire after 30 days, or sooner if they are revoked. Deleting the account revokes that access immediately: the tokens, the consent, and the grants are deleted then, rather than left until they expire.

Email you send the Operator. If you write to hello@mikeyforbands.com, the Operator keeps that correspondence in the mailbox so the Operator can answer and show what the Operator did.

Problem reports. If you use Report a problem while signed in, the Operator stores the message you write, the screen path with identifiers removed, the app version, and the time, together with your account, so the Operator can review the problem. The Operator does not store your browser’s user-agent or IP address with that report, and the Operator does not attach band names, recording names, or tokens. Only a platform administrator can read the stored report. The same page can open an email to support@mikeyforbands.com. Mail you send there is kept like mail you send to hello@mikeyforbands.com.

Why the Operator uses it, and whether you must provide it

The Operator uses account, membership, and band information to create and secure your account, to show a band the material its members put in the Service, to store and play that band’s recordings, to administer membership, to keep the acceptance and audit record the Terms require, and to answer a request you send the Operator. The law does not require you to give the Operator this information. Signing in with Google, and accepting the current Terms, is necessary if you want to use the Service. If you do not, the Operator does not show band data. You choose what band material to add. Once it is shared, other active members of that band can see and edit it.

Product-improvement analytics is separate, voluntary, and described above. Refusing it has no consequence for access.

Who receives it

• Active members of the same band can see and edit that band’s shared material, including recordings a former member uploaded. A person who is not an active member of that band cannot.
• Band administrators of that band also manage its membership.
• Platform administrators can create bands and appoint or remove band administrators. That role alone does not open a band’s recordings or notes. A platform administrator can read problem reports. A platform administrator can also see, for each band, counts of rehearsals held, recaps with a note, recordings uploaded that have not been deleted, current members and open invitations, members with a linked Google account, terms acceptances, and members active in the last 7 and 28 days. That active count includes an opted-in play from the same period. The same page shows how many opted-in play rows are stored for recordings that have not been deleted, and how many of those recordings were played. That page does not show the member, the recording, or the time. Band members and band administrators cannot open that page.
• Google processes the sign-in. The Operator does not send recordings or band notes to Google.
• Cloudflare hosts the application, the database, and the private recording store. If you opt in, the same host stores the analytics choice and the play rows described above. Technical access through that hosting provider is used only for security, maintenance, legal duties, and support requests.
• An MCP client you personally approve receives the access described above, not the audio file.
• The Operator may share information with a professional adviser, a person making a lawful rights claim, or an authority, when that is reasonably necessary to answer the claim or to meet a legal duty.
• An entity the Operator sets up later may receive the databases if the Operator transfers the Service. The Operator aims to give notice before the Operator does.

Outside Israel

The Service runs on Cloudflare. This configuration does not pin the database or the recording store to Israel. Cloudflare may store and process personal information in the United States and in other countries where Cloudflare operates. Google processes sign-in on Google’s systems, which may also be outside Israel.

The transfer is made so those providers can host the Service and sign members in, and, if you opt in, so the host can store the analytics choice and the play rows described above. It is subject to the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001. The Operator does not transfer information abroad for marketing or model training, because the Operator does not do those things. The providers’ data-protection terms are not published in the app. Those regulations call for the providers’ terms to be in place for a transfer abroad. The Operator does not send band recordings to any other overseas service.

Security

Band material is available only to signed-in active members of that band. Recordings are kept in a private store. Provider secrets stay on the server. Connections use encryption. Production sign-in rate limiting holds the client IP briefly in memory and never stores it.

No store is perfectly secure. Operational logs the Operator writes contain a failure class and technical ids such as a band, recording, or processing run. They do not contain audio, transcripts, or session tokens. The Operator does not copy those logs into the product database and does not use them as analytics. Cloudflare may keep its own platform logs, including connection data, for a period set by Cloudflare rather than by a retention setting in this Service.

How long the Operator keeps information

• Sessions. Until you sign out, or seven days after the session was last refreshed. Signing out deletes that session.
• Rate-limit IP. Held briefly in memory during production sign-in rate limiting, then discarded. Never stored.
• Account, Google link, profile, and the analytics choice. For as long as the account exists. After the account is deleted, the sign-in and the sessions are removed. The account record is renamed Former member and its email is replaced. Policy acceptance records and the analytics choice already stored stay linked to that record, as described below.
• Recording plays. If you opted in, each play row is kept until 24 months after played_at. The next time anyone who opted in starts a playback, rows older than 24 months are deleted, including rows for a deleted account. If no opted-in member plays again, an older row can remain. Deleting the account does not delete these rows by itself.
• Band content, including recordings. Until a member of the band deletes it, or until the Operator closes the alpha and deletes the environment. Nothing in the software deletes band content on a timer. The Operator does not promise that it will still be there. Keep your own copies. Deleting your account does not delete recordings you uploaded. They stay with the band.
• A recording the band deletes. Deleting a recording removes the audio objects from the private store and marks the database row deleted. The row, and a history entry with the recording’s name and file name, remain so the band’s history stays coherent.
• Membership and edit history. Kept with the band data. Removing a member, or deleting that member’s account, does not erase it. Song notes and shared history that member wrote stay with the band, as recordings do, and the member’s name can still appear there. On the membership history, an entry tied to that account shows Former member. An entry that came only from an invitation shows Unknown member. The email on an invitation-only entry is cleared.
• Policy acceptance records and analytics choices. After the account is deleted, these records stay linked to that account record. The record is renamed Former member and its email is replaced. The Service does not delete these records automatically. Recording plays are not part of this keep. They follow the 24-month cleanup above, including after the account is deleted.
• MCP tokens. Access tokens: one hour. Refresh tokens: 30 days, or sooner if revoked. Deleting the account revokes MCP access immediately: the tokens, the consent, and the grants are deleted then, rather than left until they expire.
• Problem reports. Until the account is deleted. Deleting the account deletes the report with it. The Operator does not keep the report after that.
• Email you send the Operator, including mail to support@mikeyforbands.com. The Operator may keep it while the Operator needs it to answer, to show what the Operator did, or to meet a legal duty. The software does not delete that mailbox on a timer.

Access, correction, and deletion

Email hello@mikeyforbands.com from the Google address on your account. You may ask to access the personal information the Operator holds about you, to correct it where it is not correct, complete, clear, or up to date, or to delete your account. Say which request you are making. The Operator may ask you to confirm that you control the account. The Operator aims to reply. This notice sets no number of days.

A platform administrator can delete a member’s account from Administration. The button is Delete account. A member can also ask by emailing hello@mikeyforbands.com. The Operator may delete the account after the Operator is satisfied the request is for that account. A platform administrator account cannot be deleted this way. Deleting the account removes the sign-in and the sessions. The account record is renamed Former member and its email is replaced. Deleting the account deletes problem reports with it. MCP access is revoked immediately: the tokens, the consent, and the grants are deleted. Pending invitations to that email are removed. Policy acceptance records and analytics choices stay linked to that Former member record. The Service does not delete these records automatically. Play rows already stored stay until the 24-month cleanup described above, including after the account is deleted. Song notes and shared history that member wrote stay with the band, as recordings do. The member’s name can still appear in that band content. The Operator keeps a keyed hash of the email, and not the email itself, with no automatic deletion, so a repeat request can be recognized.

Recordings you uploaded are not deleted with your account. They stay with the band as band content. Other members keep using them under the licence in the Terms, until the band deletes that recording or the Service ends. The uploader byline becomes Former member. Only a name typed into a recording title or file name remains. An accurate recording is not incorrect merely because you closed your account or no longer want it kept.

If you believe a recording of you should not be in the Service, email hello@mikeyforbands.com and say why. Anyone may write, including a person who is not a member and is heard in a recording. The Operator may look at a credible complaint, as the Terms describe. The Operator may restrict access while the Operator does. The Operator does not promise to delete content, or to tell you the outcome.

You can change your display name, and whether your Google photo is shown, from your account in the app, without emailing the Operator.

You may complain to the Privacy Protection Authority (הרשות להגנת הפרטיות).

Children

The alpha is not for anyone under 18. The Operator does not knowingly invite a child. The Operator may restrict a recording that includes a minor on a credible request. If you believe the Operator has a child’s information, email hello@mikeyforbands.com.

Changes

Changes appear on this page with a new version and effective date. If the required version changes, the software asks you to acknowledge the new notice before band data is available again. That acknowledgement still only confirms that you read the notice. The optional analytics box is asked again at the same time, and it starts unchecked.

Contact

The Operator
hello@mikeyforbands.com