Privacy Policy
Last updated: 6 October 2026
ControlTab is a free tool for bands to store, version and review guitar tabs. This policy says what personal data it handles, why, where it goes and how you can get it deleted. It covers the website (controltab.app) and the app (dashboard.controltab.app).
The short version: we store what you give us to run your band's library, we do not use cookies, analytics or advertising, and we do not sell or share your data for marketing.
1. Who is responsible
ControlTab is run by Sergi Martinez Rodriguez, an individual developer based in Spain, who is the data controller. For anything in this policy, write to sergimartinezrodriguez@gmail.com.
2. What we collect
- Account data: your name, your email address and your password. The password is stored only as a bcrypt hash, never in readable form.
- Band data: the bands you belong to and their names.
- Content you upload or write: tab files (Guitar Pro and MusicXML), song and album titles, version notes, setlists, sound checks and comments. Sound checks and comments are saved with the name of the person who wrote them.
- Invitations: when a band member invites someone, we store the name and email address they typed in so we can send the invitation.
- Bug reports: the text you write, together with your name and email, is emailed to the developer.
- Technical data: your IP address is used briefly to limit repeated requests (for example failed logins) and appears in the hosting provider's server logs. Logs also record the email address a message was sent to.
- Acceptance of the terms: the date you accepted the Terms of Service and this policy, and which version.
We do not collect payment details, location, contacts or anything about your device beyond the above.
3. Why we use it and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Running your account and your band's library, versions, reviews and setlists | Performing our agreement with you (Art. 6(1)(b)) |
| Sending service emails: welcome, invitations, password resets | Performing our agreement with you (Art. 6(1)(b)) |
| Sending an invitation to someone a band member names | Legitimate interest in letting bands add their members (Art. 6(1)(f)) |
| Keeping the service secure: rate limiting, logs, fixing reported bugs | Legitimate interest in a secure, working service (Art. 6(1)(f)) |
We send no newsletters or marketing email, and we make no automated decisions about you.
4. Who can see your content
- Your band. Every member of a band can see and change everything in that band, including the list of members with their names and email addresses.
- The public, only if a band chooses. A member can mark a song as public. Public songs appear on the band's public page with the band name, the song title, the name of the album the song is in, the date its current version was uploaded and the current tab, visible to anyone without an account. Notes and comments your band writes on a version are not shown there.
- Anyone with a file link. Uploaded tab files are served from long, random addresses that cannot be guessed, but that are not checked against a login. Anyone you give such a link to can open the file, so treat file links as you would the file.
5. Service providers
We use a small number of providers to run ControlTab. They act on our instructions.
| Provider | What for | Where |
|---|---|---|
| Fly.io, Inc. | Hosting of the website, the app, the database, uploaded files and backups | Servers in Paris, France. US company. |
| Resend, Inc. | Delivering emails; receives the recipient's name and email and the message | United States |
| jsDelivr | Delivers the music font and the instrument sounds used by the tab player; sees your IP address when the player loads, nothing about your account | Global content delivery network |
Where data is handled outside the European Economic Area, it is transferred under the safeguards the GDPR provides for, such as the EU-US Data Privacy Framework or standard contractual clauses.
6. How long we keep it
- Account and band content: for as long as your account exists, or until you delete it or ask us to.
- Songs you delete: removed from the database and from file storage straight away.
- Invitations: the link expires after 7 days. The record of the invitation stays with the band until it is deleted on request.
- Password reset links: valid for 1 hour.
- Backups: deleted data can remain in backups for up to 7 days before it is overwritten.
- Server logs: kept for a short period by the hosting provider.
Sound checks and comments belong to the band's review history. If you leave a band or delete your account they stay, shown under the name you posted them with, unless you ask us to remove or anonymise them.
7. Your rights
Under the GDPR you can ask for a copy of your data, have it corrected or deleted, restrict or object to its use, and receive it in a portable format. To use any of these, or to delete your account, email sergimartinezrodriguez@gmail.com from the address of your account. We answer within one month.
If you received an invitation and do not want your details kept, write to the same address and we will delete them.
You can also complain to your data protection authority. In Spain that is the Agencia Española de Protección de Datos.
8. Security
Connections are encrypted with HTTPS, passwords are stored hashed, and each band's data is only served to its members. No service is perfectly secure; if a breach affects your data we will tell you and the authority as the law requires.
9. Age
ControlTab is not meant for anyone under 16, and we do not knowingly keep their data.
10. Changes
If this policy changes in a way that matters, we will update the date above and tell account holders by email or in the app before it takes effect.