Privacy.

The short version

J26 Productions Ltd operates Studio Exchange. We use your Patreon identity and J26 paid-membership status to control access. Your listening link, notes and review feedback stay between you and authorised J26 reviewers. A separate discussion is optional.

We do not ask for your Patreon password, date of birth or identity documents. Studio Exchange has no advertising trackers, audio uploads or automatic audio embeds.

For privacy questions or requests, email mark@j26productions.com. Do not include passwords, Patreon tokens or ID documents in your first message.

What we process and why

• Access: your Patreon account identifier and J26 campaign/tier entitlement, successful-payment, trial and gift indicators. Patreon may also return identity information during sign-in; the application retains the identifier, not your profile name, email or other creator memberships. The permission requested is Patreon identity.
• Your sign-in: an encrypted, short-lived Patreon access token, a hashed session identifier and security values. We use these to keep you signed in and recheck membership. We do not retain a refresh token.
• Your content: artist name, title, submission type, listening link, notes, rights confirmation, comments, review status and private feedback.
• Safety: reports, moderation decisions and limited action history. Rate limits use secret-salted identifiers and short-lived counters; the application does not store raw IP addresses in its rate-limit table.
• Age declaration: a yes/no declaration that you are 18 or over, stored only in your encrypted session. It is not verified age evidence.

The lawful basis for essential membership access and the requested submission/review service is performing our service agreement with you. Safety, abuse prevention, service security and proportionate record-keeping rely on our legitimate interests in operating a safe service. Optional sharing is your choice and is off by default; it is not consent to advertising or publication of your music.

Without the essential access information we cannot provide Studio Exchange. There is an automated eligibility check, not an automated decision about artistic merit. If access seems wrong, contact J26 for a human review; do not pay again just to resolve an access error.

Who can see it

Your private submission and private comments are available to you and the authorised J26 creator/reviewer account. Other eligible members see only the title, artist name, type and comments of a discussion you choose to open. Private audio links, notes and J26 feedback are not copied into that discussion.

Anything you type into a shared comment can be read by other eligible members. Avoid contact details and other people's private information. Closing a discussion stops member access to it; it is not immediate deletion of the underlying records.

Cloudflare hosts the application and database. Patreon provides authentication and membership information under its own privacy arrangements. SoundCloud or Vocaroo processes visits when someone opens a listening link under that host's own policies. J26 does not automatically fetch or embed submitted audio.

These providers operate internationally; this service does not promise UK-only processing. Cloudflare's published data processing addendum describes its processing and international-transfer safeguards. You can request further information from J26.

How long information is kept

• Sign-in sessions and their encrypted Patreon tokens expire after at most one hour, sooner on logout or a private-test deadline. Expired rows are cleared by the scheduled cleanup.
• We remove a closed submission, its listening link, notes, feedback and associated comments/reports 90 days after closure.
• Open submissions are reviewed for continued need once they reach 12 months. They are not permanent archives. J26 closes records no longer needed and applies the 90-day closure rule.
• We strip free-text audit notes after 90 days and retain only minimal action records for up to 12 calendar months. When associated content is removed, its audit notes and direct item references are removed too.
• An unresolved report or documented preservation hold can delay content deletion and associated record cleanup while the issue is investigated. Holds must have a reason and regular review; they are not permission for indefinite retention.

Deletion from the working database is not immediate erasure from provider recovery history. Cloudflare D1 recovery history can persist for up to 30 days depending on plan. Restored data must have deletion decisions reapplied before the service is reopened. We do not use recovery copies as a member archive.

Your choices and rights

You can keep your discussion private, close a shared discussion and sign out. To request a copy, correction, deletion or restriction of your information, object to legitimate-interest processing, or ask about portability where applicable, contact J26. We will use proportionate checks to establish that a request concerns your account; we will not ask for a Patreon password.

Rights are subject to applicable limits—for example, information may need to be retained for an unresolved complaint or legal obligation. We will explain any refusal or extension. Requests should normally be answered within one month, subject to the applicable rules. You can complain to the UK Information Commissioner's Office.

Cookies and safety

Essential, secure, HTTP-only cookies connect the sign-in attempt and your temporary session to this browser. A private pilot may also use a temporary invitation cookie. There are no optional analytics or advertising cookies in the Studio Exchange application.

Studio Exchange is 18+ only. Paid Patreon membership and the age declaration are not independent age verification. If you believe an under-18 account is using the service, contact J26 without posting the person's details in a discussion.