Privacy Policy

Antonite is a Canadian solo music project run by a single individual (referred to here as “we” or “Antonite”). The websiteantonite-music.com is operated by that same individual, who acts as the data controller (the person legally responsible for personal information) and as the designated privacy officer under Quebec Law 25.

Privacy officer: privacy@antonite-music.com (this address forwards to a personal inbox).

We collect the minimum information needed for the site to work. That breaks down into a few buckets:

If you create an account

• Email address (used to sign you in and contact you).
• A display name you choose.
• An encrypted password (we never see the original).
• The date your email was verified.
• An optional country, bio, and avatar if you fill those in.
• Whether you opted into the newsletter, and the date and IP address of your opt-in (required by Canadian anti-spam law).

If you participate

• Comments you write on songs or articles.
• Votes you cast on polls.
• Submissions you upload to the Fan Gallery (lyrics, artwork, audio, photography).
• Hearts you tap on other people's submissions.

If you contribute

• The amount you contributed and the date.
• A Stripe payment identifier (we don't store your card number - Stripe does).
• Refund history, if any.

If you write us a message

• Your name, email, subject, and the text of your message.
• A one-way hash of your IP address and a truncated browser identifier (to fight spam - we can't reverse these).

If you only visit

• Aggregated visit counts via Cloudflare Web Analytics. It is cookieless and does not identify individual visitors. No IP addresses are stored.

We use what we collect for specific, narrow purposes:

• Run your account - let you sign in, recover access, and manage your data.
• Show your contributions - display your display name next to your comments, votes, and submissions.
• Send transactional email - verification, password reset, submission status, contribution receipts and refunds. You can't opt out of these and stay a user; if you don't want them, delete your account.
• Send the newsletter - only if you opted in. Every email has an unsubscribe link.
• Process payments - forward your contribution through Stripe and reconcile the result.
• Moderate - keep abusive, illegal, or off-topic content off the site.
• Improve the site - aggregated, non-identifying traffic patterns via Cloudflare Web Analytics.
• Comply with the law - respond to subject-rights requests, retain records where law requires, and assist authorities when legally required to do so.

What we do not do here: on antonite-music.com we do not sell personal information; we do not run advertising or tracking cookies; we do not build behavioural profiles from what you do on the site; and we do not share your data with third parties beyond the processors listed below. The one exception is our off-site pre-save pages, which use third-party marketing trackers and are described in section 10.

Under GDPR and similar laws, every use of personal data has to rest on a legal basis. Ours are:

• Performance of a contract - running your account, processing your contribution, sending you the receipt. You can't use the site without this.
• Consent - the newsletter; you opt in and can opt out anytime.
• Legitimate interests - site security, fraud prevention, moderation, and aggregated analytics. We weigh these against your interests before relying on them.
• Legal obligation - keeping records the tax or privacy laws require us to keep.

• Account data - for as long as your account exists. You can delete it at any time from your account page.
• Comments and submissions - until you or a moderator removes them. Soft-deleted content keeps a tombstone but the body is hidden.
• Newsletter subscription - until you unsubscribe.
• Contributions and refunds - kept indefinitely for accounting and tax compliance (Canadian tax law requires retention for six years).
• Contact messages - archived after one year unless they relate to an open matter.
• Admin audit log - retained as long as the site operates, for security investigations.
• Analytics - Cloudflare Web Analytics aggregates only; no individual record is kept beyond a rolling short window.

We use a small number of trusted service providers (called “processors”) to actually run things. Each only sees the data it needs and is bound by its own data-protection terms:

• Supabase - database and authentication. Stores the account and content data described above.
• Cloudflare R2 - file storage for audio, images, and submission uploads.
• Vercel - hosts the website and routes traffic.
• Stripe - handles contributions and refunds. Card data goes directly to Stripe; we never see it.
• Resend - sends transactional email (verification, receipts, etc.).
• Brevo - sends the newsletter to opted-in subscribers.
• Cloudflare Web Analytics - counts visits without using cookies or identifying anyone.
• Discord - receives admin-only operational alerts (no public user data is sent through these alerts beyond a project name or event type).

Most of these providers operate from the United States or the European Union, with data centres distributed worldwide. By using the site you understand that your information may be processed outside your country of residence - including in jurisdictions whose privacy laws differ from yours.

Where applicable we rely on Standard Contractual Clauses or equivalent legal mechanisms to safeguard transfers. If you live in Quebec, Law 25 applies to the assessment of these transfers; our processors' data-protection terms include the commitments Law 25 requires.

Whichever law applies to you - Quebec Law 25, Canadian PIPEDA, the EU GDPR, or another similar regime - you have meaningful rights over your data. We honour them regardless of where you live:

• Access - ask for a copy of the personal information we hold about you.
• Rectification - ask us to correct anything inaccurate.
• Deletion / erasure - ask us to delete your account and associated data. Some records (e.g. accounting entries for completed contributions) may be retained for the legal minimum.
• Portability - ask for an export of your data in a machine-readable format.
• Withdrawal of consent - for the newsletter and any other consent-based use.
• Objection - to a processing activity that relies on legitimate interests.
• No automated decisions - we do not make decisions about you using automated systems without human involvement.

Email privacy@antonite-music.com with your request. We aim to respond within thirty days. We may ask you to verify your identity so we don't hand your data to the wrong person.

We only use cookies that are strictly necessary: a session cookie that keeps you signed in, and Stripe's payment cookies during checkout. We don't use advertising or tracking cookies, and our analytics tool (Cloudflare Web Analytics) is cookieless. That's why you won't see a banner asking for consent. The one exception is our separate pre-save campaign pages, hosted off-site on show.co, which run third-party trackers and are covered in section 10.

Full details: cookies page.

Before a new release comes out we sometimes run a pre-save campaign on a landing page hosted by a third party, show.co. That page lives at a show.co web address - it is not part of antonite-music.com, and you only reach it if you follow a pre-save link we share. It lets you connect your streaming service (such as Spotify or Apple Music) so the release is saved to your library on launch day. We never see or store your streaming login or password; that exchange happens between you, show.co, and your streaming service under their own privacy policies.

To measure how these campaigns perform, we choose to enable a third-party marketing tracker on that show.co page:

• Meta (Facebook) pixel - a snippet from Meta that records visits and pre-save conversions on the page. It can set its own cookies and ties this activity to Meta's advertising system, which lets us measure results and, where we choose to, show or retarget ads to people who visited the page. For this data Meta acts as an independent controller under its own privacy policy.

This is the one place where we use a marketing tracker, and it is deliberately kept off our own site. It runs only on the show.co pre-save pages - never on antonite-music.com, which stays cookieless and shows no consent banner. Because the pre-save pages do set third-party cookies, show.co presents its own consent notice where the law requires one.

You can avoid this tracking entirely by not opening the pre-save link, or by using your browser and your Meta privacy settings to limit it. Declining has no effect on anything you do on antonite-music.com.

For any privacy question, request, or complaint, write to privacy@antonite-music.com. We'll do our best to resolve it directly.

If you're not satisfied, you can also contact a privacy regulator:

• Quebec residents - Commission d'accès à l'information du Québec (CAI): cai.gouv.qc.ca.
• Other Canadian residents - Office of the Privacy Commissioner of Canada (OPC): priv.gc.ca.
• EU / EEA residents - your national supervisory authority. A directory is maintained by the European Data Protection Board (EDPB) at edpb.europa.eu.

We may update this policy when laws, processors, or features change. The “Last updated” date at the top tells you when. Material changes (anything that affects your rights or expands what we collect) get an email to registered users at least thirty days before they take effect. Continuing to use the site after that point means you accept the updated version. If you don't, you're welcome to delete your account.