PRIVACY POLICY
Effective Date: March 19, 2026
Who we are
This platform is operated by Headphone Commute. We also run Headphone Community on Patreon, a platform for artists and labels to share their music and connect with their audience.
What we collect and why
The table below lists each category of personal data we process, the reason we collect it, and the legal basis under UK/EU GDPR.
| Data | Purpose | Legal basis |
|---|---|---|
| Hashed IP address | Prevent duplicate code claims for the same release | Legitimate interest |
| Email address (admin & artist accounts) | Authentication, password resets, system notifications | Contract performance |
| Email address (replenish notifications) | One-time notification when a sold-out release is restocked | Consent |
| Patreon display name, user ID, Headphone Community membership status and entitled tier | Verify eligibility for Headphone Community Patreon-gated releases; record who claimed a code. | Contract performance / Legitimate interest |
We do not collect names, phone numbers, or physical addresses from standard (non-gated) visitors. We do not use geolocation or third-party tracking pixels.
How long we keep it
- Hashed IPs and claim records — retained for 1 year after the associated release is archived, then deleted.
- Patreon verification cache — deleted automatically after 24 hours.
- Replenish notification emails — deleted immediately after the notification is sent, or when you de-register, whichever comes first.
- Admin and artist account emails — retained while the account is active; deleted when the account is removed.
Patreon-gated releases
Some releases are restricted to verified Patreon members. If you attempt to claim such a release, you will be redirected to Patreon to confirm your Headphone Community membership via OAuth.
- We request only the Patreon identity scope needed to verify your Headphone Community membership status for the release you are claiming.
- We use your Patreon display name and Headphone Community membership status and entitled tier solely to verify eligibility.
- Your Patreon access token is used only during the verification request and is never stored.
- We do not retain a list of your memberships to other Patreon creators.
- A short-lived verification record is cached for up to 24 hours to avoid repeated OAuth prompts, then automatically deleted.
- When you successfully claim a code, your Patreon display name and user ID are recorded in the claim log for that release. This is visible to the release owner and site administrators.
- If you do not complete the OAuth flow or your membership does not qualify, no data is stored.
Email notifications
When a release runs out of codes, you may optionally leave your email address to be notified when codes become available again. This requires your explicit consent.
- Your email is used only to send a one-time notification for the specific release you signed up for.
- Your email is automatically deleted after the notification is sent.
- You can de-register at any time using the link provided at signup or in the notification email. De-registering immediately deletes your email from our system.
- Your email is never shared with third parties, never used for marketing, and never visible to site administrators.
Cookies
The public claim page does not set cookies for standard releases. If a release requires Patreon membership verification, a short-lived cookie is set after you complete the Patreon OAuth flow. This cookie contains only an opaque identifier and expires after 24 hours.
International data transfers
Headphone Commute is based in the United States. If you are located in the UK or EU, your personal data is transferred to and processed in the US. We rely on the following third-party processors, each of which maintains appropriate safeguards (such as Standard Contractual Clauses) for international transfers:
- Resend — transactional email delivery (password resets, welcome emails, replenish notifications).
- Patreon — membership verification for gated releases. We do not store your Patreon access token or share data with Patreon beyond what is required for the OAuth flow.
No tracking pixels, analytics services, or advertising networks are used.
Your rights
If you are located in the UK or EU, you have the following rights regarding your personal data:
- Access — request a copy of the data we hold about you.
- Rectification — ask us to correct inaccurate data.
- Erasure — ask us to delete your data, subject to any legal obligation to retain it.
- Restriction — ask us to pause processing while a dispute is resolved.
- Objection — object to processing based on legitimate interest.
- Portability — request your data in a structured, machine-readable format.
- Withdraw consent — where processing is based on consent (e.g. replenish notifications), you may withdraw at any time without affecting prior processing.
To exercise any of these rights, contact us at [email protected].