Privacy

This policy explains what VMD collects when you use band.kufirre.com, the browser workstation and VMD Live. VMD is made and operated by Kufirre. VMD does not sell personal information or use it for advertising.

Google sign-in

If you choose Continue with Google, VMD asks Google for the openid and email scopes. Google returns a stable Google account identifier, your email address, whether Google has verified that address and, for some Workspace accounts, a hosted-domain indicator.

VMD uses the identifier and email address to create or find your VMD account, link Google sign-in to an existing account and confirm that Google verified the address.
VMD stores the Google account identifier, email address and VMD verification time. It does not store the Google authorization code, ID token, access token or refresh token.
VMD does not request access to Google Drive, Calendar, Contacts, your Google profile photo or files in your Google account.
Google account data is not sent to OpenAI and is not used for advertising or to train AI or machine-learning models.

Your email address can still be used and shared in the limited ways described below: to run your account, deliver account or band emails, and let band owners or admins manage membership. The Google account identifier is not shown to bandmates.

Other information VMD stores

Account and security information: your email address; account creation, verification and last sign-in times; a password hash if you set a password; seven-day sign-in session records, including a hash of the session token and your browser's user-agent string; and short-lived confirmation and security records.
Your profile: an optional display name, instrument or musical role, default spoken-cue audience and profile photo. VMD converts a chosen photo to a normalized PNG and stores it privately. Current bandmates can view the photo, name and instrument. Band owners and admins can also see member email addresses.
Band workspaces: band name and timezone, memberships and roles, invitation addresses and delivery status, workstation-key records, schedules, venues, notes, availability responses, lineups and setlists. This information is shared with members of that band according to their role.
Saved arrangements and audio: when a band owner or admin uses Save to band, VMD stores the arrangement document, including its structure, cue text and settings, in its database. Imported track audio is stored in Cloudflare R2 by a content hash. Band members can open saved arrangements; owners and admins can change them.
Spoken cues: when you ask VMD to generate a hosted cue, VMD sends the exact cue text, language and voice instructions to OpenAI. OpenAI returns a transcript and audio. VMD validates the result and stores the rendered WAV in Cloudflare R2 so an identical cue and voice request can reuse it. VMD does not send your account email, Google identifier or band membership to OpenAI as part of that request.
Live sessions: a session code and access tokens, project name, current arrangement state, participant and audio-readiness status, access requests and grants where enabled, and audio prepared for the session. Anyone who receives a valid guest code or link can use it until that session ends.
Plan and usage records: trial and plan periods, cue allowances, credit grants, reservations and successful use. Owners can see their band's usage history. Paid subscriptions are not currently available. VMD does not store payment card details.
Security and operations: network addresses used for rate limiting, request and browser metadata handled by Cloudflare, and bounded error or storage events used to diagnose failures. Rate-limit counters are removed after 24 hours.

Cookies, local storage and caching

VMD uses essential storage only. The vmd_session cookie contains a random sign-in token and lasts for up to seven days. The server stores only a hash of that token. It is marked Secure, HttpOnly and SameSite=Lax. A separate vmd_oauth cookie holds the state needed to complete Google sign-in and expires after ten minutes.

The workstation keeps arrangements, imported audio, prepared cues, recovery copies and prepared-show packs in your browser using IndexedDB and local storage. Live host credentials and short-lived interface state can be kept in session storage. A device's cue-audience choice is kept in local storage. The browser may also cache VMD's same-origin tempo-analysis files and private downloaded project or cue audio. Private audio responses can remain in the browser cache for up to one year. Clear this site's browser data to remove those local copies. Signing out removes the current server session, but does not clear workstation files already saved in your browser.

Who receives information

Cloudflare runs the site and provides its database, object storage, temporary Live-session storage, security services and network delivery.
Resend receives the destination email address and message content needed to deliver confirmation and band-invitation emails from hello@kufirre.com.
Google handles the sign-in flow only when you choose Continue with Google.
OpenAI receives cue text and voice instructions only when hosted spoken-cue generation is requested.

There is no analytics or advertising in VMD's pages, and there are no tracking pixels. Cloudflare can apply its own security and bot-detection checks. Apart from the service providers above and the sharing inside a band or Live session described in this policy, VMD does not disclose personal information for marketing.

How information is protected

VMD uses HTTPS in production. Passwords are stored as salted hashes, and server-side session records contain a hash rather than the sign-in token itself. Sign-in cookies are restricted as described above. Authenticated pages and profile photos are sent with private or no-store cache controls, and server routes check account, band membership and role before returning private band data. No internet service can guarantee absolute security.

Retention and deletion

Sign-in sessions expire after seven days and are removed by a daily cleanup. The Google sign-in attempt cookie expires after ten minutes. Email-confirmation links expire after one day. Band invitation links stop being accepted after 14 days, although their invitation record remains with the band.
Live access ends when the session is stopped, expires or is abandoned. A session can last for no more than 12 hours. VMD removes the temporary session record and starts cleanup of its prepared Live audio when the session ends; a storage failure can require later operator cleanup.
You can remove your profile photo from Profile. VMD then removes the current photo reference and attempts to delete the stored image.
Deleting a saved arrangement removes its arrangement document. Imported band audio is content-addressed and may be shared by more than one arrangement, so it is not automatically deleted with one arrangement. Server-stored project audio and rendered cue audio currently have no automatic expiry.
Account, profile, band, planning, usage and billing records otherwise have no automatic age-based expiry. Browser copies remain until you remove them or clear the site's data in that browser.

Your choices and deletion requests

You can sign out to end the current sign-in session, remove your profile photo, leave a band you do not own, or ask a band owner or admin to remove your membership. To request access to or deletion of your VMD account data, email hello@kufirre.com from the address on the account. Kufirre may need to verify the request and resolve ownership of any bands before deleting the account. VMD does not currently provide self-service account deletion or promise an automatic completion time; ask for confirmation when the request is complete.

Contact

Questions or privacy requests: hello@kufirre.com. This policy's date changes when VMD's data handling or this explanation changes. Last updated 19 September 2026.