Privacy

VMD keeps the least it can to run a band space, and nothing that watches you.

What is kept

• Your email address, so you can sign in and so bandmates can invite you.
• A password hash if you set a password. The password itself is never stored; the hash cannot be turned back into it.
• Your Google account id if you sign in with Google. Google tells VMD your email address and that it is verified; VMD asks for nothing else and cannot read anything in your Google account.
• Sign-in sessions: a random token in a cookie on your device and a hash of it on the server, for seven days. The cookie is only used to keep you signed in.
• Band spaces you create or join: the space name, who is a member, and invitations sent by email.
• Rate-limit counters keyed by a hash of your network address, kept for a day, to slow down password guessing.

What is not kept

There is no analytics, no advertising, no tracking pixel and no third-party script on these pages. Nothing about you is sold or shared for marketing.

Who handles the data

• Cloudflare runs the site and its database.
• Resend delivers the confirmation and invitation emails from band@kufirre.com.
• Google handles sign-in only when you choose "Continue with Google".

Deleting your account

Email band@kufirre.com from the address on the account and it is removed, along with your sessions and memberships, within seven days. Spaces you own are handed to another member or deleted with you.

Contact

VMD is made by Kufirre. Questions about this policy: band@kufirre.com. Last updated 6 September 2026.