Privacy policy
LookAhead is a place to keep demos and unreleased music and play them to the people you choose. This page says what we store about you, why, who else handles it, how long we keep it, and how to get it changed or deleted.
Who is responsible: Quinn Trustfull, the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 94032300 ("we"). Questions or requests: contact@lookahead.studio.
What we store
If you have an account
- Your email address, to sign you in with a link or code. We never ask for a password.
- Your profile: the name you choose, and if you add them, a handle, a short bio, links and a picture. Your artist page (if you make one) is public; the rest is only shown to people you work or share with.
- Your music and everything around it: the audio you upload or connect from Dropbox, the versions we make of it for playback (compressed copies, waveforms, loudness), covers, notes, lyrics, playlists, project and song details.
- What you do with it: comments and reactions, who you invite and share with (including the email addresses you type in for invitations), share links and their settings, the projects you follow.
- Listening activity: when someone plays a song, which version, how long and how far. The person who shared the song can see this per listener, by name. That is one of the main features of LookAhead, so it can't be switched off.
- Feedback you send us: your message, the page you were on and your browser's name and version.
- Dropbox, if you connect it: your Dropbox account id, email and name, the folder you picked, and an access token (stored encrypted) so we can read the music in that folder. When you upload a song to a project linked to Dropbox, we add that file to the folder. We never change, overwrite or delete files in your Dropbox.
- Your settings (look, player options), so they follow you between devices.
If you open a share link without an account
You get a temporary guest account with no email address. We store the name you give (if you comment), your comments and your listening activity on that link, which the person who shared it can see.
Everyone
- Page counts: how often each page type is opened per day and roughly how many different visitors there were. Ids in addresses are removed first, so we don't record which song or link you opened. Visitors are told apart by a code made from your IP address and browser, with a key that changes every day and is then thrown away. It can't be turned back into your address or used to follow you from one day to the next, and nothing is stored on your device for it.
- Abuse protection: to stop people guessing passwords for share links or flooding the service, we count attempts per IP address for up to a day. The address is stored only as a keyed code, never as is.
- Bot check: when you ask for a sign-in email, open a share link for the first time or invite someone, Cloudflare Turnstile checks in the background that a person is there, using technical signals from your browser (such as its type and how the page was loaded). It doesn't use cookies for this and isn't used for advertising; we only get a yes or no.
- Server logs from our hosting providers (IP address, time, page requested), kept by them for a short time for security and debugging.
We don't sell your data, show ads, or use your music or data to train AI models. We don't use tracking or advertising cookies, analytics services or social media plugins.
Why we may use it (legal basis)
- To provide LookAhead to you (contract, GDPR art. 6(1)(b)): your account, music, sharing, comments, listening activity, Dropbox sync, settings.
- Legitimate interests (art. 6(1)(f)): keeping LookAhead secure and available (abuse limits, logs, backups), and understanding which pages are used (page counts without identifying you). You can object to these; see "Your rights".
- Legal obligations (art. 6(1)(c)): for example keeping records we're required to keep.
Who else handles it
We use these services to run LookAhead. They process data only on our instructions, under a data processing agreement:
| Service | What for | Where |
|---|---|---|
| Supabase | Database, sign-in | EU (Frankfurt) |
| Cloudflare R2 | Storing audio, covers and file backups | Cloudflare's network (EU and elsewhere) |
| Cloudflare Turnstile | The bot check | Cloudflare's network (EU and elsewhere) |
| Resend | Sending sign-in emails | United States and EU |
| Vercel | Hosting the website | EU (Frankfurt) for our code; worldwide network for delivery |
| Fly.io | Processing uploaded audio | EU (Frankfurt) |
| GitHub | Encrypted database backups | United States |
| Dropbox | Only if you connect it, to read your music folder | United States and elsewhere |
Where a service is based outside the EU (Cloudflare, Resend, Vercel, Fly.io, GitHub and Dropbox are US companies), transfers are covered by the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. Our database backups are encrypted before they leave our systems, with a key only we hold.
Fonts are part of the site itself; your browser doesn't contact Google or any other font service.
How long we keep it
- Your account and everything in it: until you delete it. Deleting your account removes it, your music files and everything listed above right away.
- Backups: deleted data stays in our encrypted backups for up to 30 days, then it's gone.
- Guests: comments and listening activity are deleted together with the music they belong to (when its owner deletes the song, project or account). The guest account itself, which holds only a name, stays until you ask us to remove it.
- Abuse-protection counts: up to 1 day. Page counts: kept, but they contain nothing about you.
- Feedback: until it's dealt with, at most 2 years.
- Technical job records (for example "process this upload"): 30 days.
Your rights
You can ask us to see the data we have about you, correct it, delete it, restrict or object to its use, or get it in a portable format. Write to contact@lookahead.studio; we answer within a month.
You can do most of this yourself:
- Delete your account: Settings, Account, Delete account. It's immediate and removes everything listed above.
- Change your name, profile and settings: in Settings and on your profile.
- Disconnect Dropbox: Settings, Dropbox, Disconnect. Also revoke access in your Dropbox account settings if you like.
- Guests: to have your guest comments or listening activity deleted, write to us with the link you used.
If you think we handle your data wrongly, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), or the data protection authority where you live. We'd appreciate the chance to fix it first.
Children
LookAhead is not for children. You must be at least 16 to use it. If we learn that someone younger has an account, we delete it.
Security
Connections are encrypted (HTTPS). Music files can only be fetched with short-lived signed links. Access to every project, song and comment is checked in the database itself. Dropbox tokens and backups are encrypted. Our own access to the services that run LookAhead is protected with two-factor sign-in. No system is perfectly safe; if a breach puts your data at risk, we'll tell you and the authority as the law requires.
Changes
If we change this policy in a way that matters, we'll tell you in LookAhead or by email before it takes effect. Last updated: 19 October 2026.