Privacy Policy

Effective Date: August 4, 2026

1. Introduction

This Privacy Policy describes how Gryphon Graham, operating as go·for·show ("we", "us", or "our"), collects, uses, and protects information when you use our website (goforshow.io) and applications, including load·in (collectively, the "Services").

We are based in New York City, USA. For privacy inquiries, contact us at goforshowio@gmail.com.

Who is responsible for your data. For the purposes of the EU and UK General Data Protection Regulations, the data controller is Gryphon Graham, trading as go·for·show, New York City, USA, reachable at goforshowio@gmail.com. go·for·show is operated by one person; there is no separate data protection officer, and one is not required for processing of this kind and scale. Under other privacy laws — for example Canada's PIPEDA, Australia's Privacy Act, or Brazil's LGPD — the equivalent role (organization, APP entity, or controlador) is held by the same person.

What this policy covers. This policy covers the goforshow.io website and every go·for·show application we make available, on the web and on iOS. Most of the detail below describes load·in, which is the application most people use and the one that handles show files.

2. Information We Collect

2.1 Information You Provide Directly

Email Address: When you purchase a Pro license, create an account, or contact us, we collect your email address.

Payment Information: Web payment processing is handled by Stripe. App Store purchases are handled by Apple, with RevenueCat used to manage purchase entitlement state. We do not receive or store your full card number or Apple ID credentials.

2.2 Information Stored Locally on Your Device

Application Data: Stage plots, input lists, settings, and project data are stored locally using browser or app storage. If you sign in or use cloud sync, the project data selected for synchronization is transmitted to and stored in our Supabase-backed account service. Sharing and collaboration features transmit the content you choose to share.

Console and DAW Files: The native app can process supported formats on-device. In the web app, supported console import and export workflows send the selected file or export payload to a go·for·show API for transient processing. Those payloads are not intentionally retained after the response. If you deliberately submit a diagnostic capture to help verify a console format, that copy is stored for review as the upload screen explains.

Preferences and Settings: Your application preferences, language selection, theme choices, and license information are stored locally in your browser.

2.3 Analytics and Usage Data

We use analytics services to understand how our Services are used. This helps us improve the product and fix bugs.

Service	Purpose	What's Collected
Plausible Analytics	Privacy-friendly usage analytics	Page views, referrers, device type, and product-usage events (for example: which console format was exported, how many channels were imported, whether a Pro gate was shown). Events carry feature and format labels, not the contents of your show files. No cookies.
Google Analytics (GA4) — not loaded in the EU/EEA/UK	Usage patterns and demographics	Anonymized usage data, approximate location (country/city level)

Important: Plausible Analytics is cookie-free and runs everywhere. Google Analytics does use cookies, so it is loaded only for visitors outside the EU, EEA, and UK — see §8.1. Where it is loaded, it receives the technical usage data described above. Analytics and error-monitoring scripts are not loaded by the native iOS app.

2.4 Error Monitoring

We use Sentry for error monitoring. When a JavaScript error occurs in the application, Sentry may collect:

• Error messages and stack traces
• Browser type and version
• Operating system
• Page URL where the error occurred

We configure error reporting for technical diagnostics, not for collecting stage plots or show-file contents. Do not place sensitive information in URLs or support descriptions.

2.5 Information We Do Not Collect

• Your name (unless you provide it in communications)
• Your work for advertising or model training
• Precise device location (analytics may infer an approximate region from a network address)
• Your browsing history outside our site
• Any information from children under 13

2.6 Your Show Files — Light Touch

Your show files are yours. You keep the copyright and every other right in them — that is set out in full in Terms of Service §8.2. Depending on platform and format, they are processed on-device or sent to our API long enough to complete the import or export. We do not use their contents for advertising or model training, we do not sell them, and we do not intentionally retain transient processing payloads after the request completes.

Diagnostic captures. A file you deliberately submit through the diagnostic capture tool is different: we store it, in a private location that is not publicly readable, and we use it only for compatibility research and product development — working out how a particular desk, model, or firmware writes its files. We do not publish it, share it, sell it, or use it to train models. We do not alter it either: we store the file exactly as you send it, because changing the bytes would destroy what we are trying to study. That means a capture may contain band, venue, and crew names, which is why the upload screen asks you to remove sensitive content first.

Captures are retained until you ask us to delete them. Deleting your account does not automatically delete a capture you submitted — captures are stored separately from your account. Email goforshowio@gmail.com and we will delete them.

Shared links are public links. When you create a share link for a plot, anyone who has that link can view it without signing in. We ask search engines not to index it, but a link that is forwarded is a link that works. You can revoke a share link at any time from the app, which deletes the shared copy.

When you export a show, we write only the values covered by the supported workflow for that format. The app is designed and tested to leave unrelated show data alone on verified round-trips, but third-party console files vary by model, editor, and firmware, so exported files should be checked before show use.

We never overwrite your original. An export always goes to a new file. Best practice on your side: work from a copy, and rename the exported file so you do not overwrite anything on a USB stick or drive.

3. How We Use Your Information

We use the information we collect for the following purposes:

• To process purchases: Your email or platform purchase identifier is used to provision and restore your purchase entitlement
• To provide customer support: Responding to your questions and resolving issues
• To send product updates: Buying a Pro license on the web adds your email address to our product-update list. Creating an account adds it only if you tick the opt-in box in the sign-in dialog — that box is unchecked by default, and leaving it unchecked keeps you off the list. (App Store purchases do not give us your email address.) Every message we send to that list carries an unsubscribe link, deleting your account also removes you from it, and we do not sell or rent the list
• To improve our Services: Analytics help us understand what features are used and what needs improvement
• To prevent fraud: Verifying purchase and account entitlement records and preventing abuse of our services
• To comply with legal obligations: Tax reporting, responding to lawful requests

4. Third-Party Services

We use trusted third-party services to operate our business. Each has their own privacy policy:

Service	Purpose	Data Shared	Privacy Policy
Stripe	Payment processing	Email, payment info	stripe.com/privacy
RevenueCat	App Store purchase entitlement management	Purchase status, product identifiers, purchase entitlement state	revenuecat.com/privacy
Supabase	Account, entitlement, and optional cloud-sync storage	Email, account identifiers, entitlement records, and synchronized project data	supabase.com/privacy
Vercel	Hosting and infrastructure	HTTP requests, IP addresses	vercel.com/legal/privacy-policy
Resend	Transactional email (sign-in codes, license delivery, account notices) and product-update list contacts	Email addresses	resend.com/legal/privacy-policy
Upstash	Rate limiting and abuse prevention on our API	IP address or license identifier, held as a short-lived request counter	upstash.com/trust/privacy
Google Fonts	Web font delivery on our website and web app	IP address and browser/device information, sent by your browser when it requests the fonts	policies.google.com/privacy
Plausible	Analytics	Anonymized usage data	plausible.io/privacy
Google Analytics (outside the EU/EEA/UK only)	Analytics	Anonymized usage data	policies.google.com/privacy
Sentry	Error monitoring	Error data, browser info	sentry.io/privacy

Some optional features (PDF, spreadsheet, QR, and text-recognition tools) load their code on demand from public code CDNs — currently cdnjs.cloudflare.com, cdn.sheetjs.com, and cdn.jsdelivr.net. Your browser's request to those CDNs exposes your IP address and browser information to the CDN operator. No show data is sent to them.

We do not sell, rent, or share your data with any other third parties.

5. Cookies and Local Storage

5.1 Essential Storage

Our applications use browser localStorage and IndexedDB to store your stage plots, settings, and license information. This is essential for the app to function and cannot be disabled without losing functionality.

load·in also sets one strictly necessary first-party cookie, loadin_lk, scoped to /loadin with a one-year lifetime. It holds your license key so that Pro stays unlocked across sessions and page loads. It is not an analytics or advertising cookie, it is not sent to any third party, and it is cleared when your license is removed. Because it is strictly necessary to deliver a feature you asked for, it does not require consent under the ePrivacy rules — but you should know it is there. See our Cookie Policy.

5.2 Analytics Cookies

Google Analytics sets first-party cookies (_ga and _ga_<container-id>) to distinguish unique users. These cookies do not contain personal information. They are not set at all if you are in the EU, EEA, or UK — Google Analytics is not loaded there, so there is nothing to set them (see §8.1 for how that is determined). Everywhere else, you can opt out of Google Analytics by using the Google Analytics Opt-out Browser Add-on, or by blocking analytics requests in your browser.

Plausible Analytics does not use cookies.

For more information, see our Cookie Policy.

6. Data Security

We take reasonable measures to protect your information:

• Encryption: All data transmitted between your browser and our servers is encrypted using HTTPS (TLS)
• Secure infrastructure: Our database (Supabase) uses encryption at rest and in transit
• Access controls: Only authorized personnel have access to our systems
• Regular security updates: We keep our dependencies and infrastructure up to date

However, no method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

For more information, see our Security page.

7. Data Retention

• Purchase and entitlement records: Retained while needed to provide purchase restoration, prevent fraud, and meet legal or tax obligations
• Cloud-synced project data: Retained until you delete it or delete your account, subject to backup and legal-retention limits. Deleting your account deletes your synced plots.
• Share links: A shared copy stays available until you revoke the link, which deletes it. Share links do not expire on their own.
• Diagnostic console captures: Retained for compatibility research until you ask us to delete them. They are stored separately from your account, so account deletion does not remove them — email us and we will (see §2.6).
• Purchase records: Retained after account deletion, because we need them for tax, accounting, and to honor your license if you come back. They are keyed to the license, not to the account.
• Product-update list entries: Retained until you unsubscribe or delete your account
• Analytics data: Retained per each provider's default policy (typically 26 months for GA4, indefinitely for Plausible aggregated data)
• Error logs: Retained for 90 days in Sentry
• Local application data: Stored on your device until you clear your browser data or delete it manually

8. Your Rights

8.1 Rights Under the EU GDPR and UK GDPR (Europe and the United Kingdom)

If you are in the European Union, the European Economic Area, the United Kingdom, or Switzerland, you have the following rights over your personal data:

• Right to access: Request a copy of your personal data and information about how we use it
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure: Request deletion of your data ("right to be forgotten")
• Right to restrict processing: Request that we limit how we use your data
• Right to data portability: Receive the data you gave us in a structured, commonly used, machine-readable format, and have it sent to another controller where technically feasible
• Right to object: Object to processing based on legitimate interests. You can object to direct marketing at any time, for any reason, and we will stop — no justification needed
• Right to withdraw consent: Withdraw consent where we rely on it, at any time, without affecting processing already carried out
• Right not to be subject to automated decision-making: We do not carry any out — see §3
• Right to complain: Lodge a complaint with your supervisory authority — see §13

Exercising any of these is free and will not affect your license, your account, or the support you get. See §8.6 for how.

Legal basis for processing. We rely on the following, by activity:

What we do	Legal basis (GDPR Art. 6)
Provisioning, restoring, and verifying your Pro purchase; delivering your license key; providing account sync, sharing, and console-file processing	Contract performance — Art. 6(1)(b)
Sign-in codes, receipts, and other transactional email	Contract performance — Art. 6(1)(b)
Adding your email to the product-update list when you tick the opt-in box while creating an account	Consent — Art. 6(1)(a). Withdraw at any time via the unsubscribe link in any message, or by emailing us.
Adding your email to the product-update list when you buy Pro on the web, to tell you about updates to the product you bought	Legitimate interests — Art. 6(1)(f) — in keeping our own customers informed about the product they own; and, for electronic marketing in the EU/EEA/UK, the existing-customer ("soft opt-in") route under the ePrivacy Directive and, in the UK, PECR reg. 22. Every message carries an unsubscribe link, and you can opt out at any time.
Rate limiting, abuse prevention, fraud prevention, and security	Legitimate interests — Art. 6(1)(f)
Analytics and error monitoring, to understand what is used and to fix bugs	Legitimate interests — Art. 6(1)(f). In the EU/EEA/UK no analytics cookies are set at all — see §8.1.
Compatibility research on diagnostic captures you choose to submit	Consent, given by choosing a file and submitting it — Art. 6(1)(a)
Tax, accounting, and responding to lawful requests	Legal obligation — Art. 6(1)(c)

Automated decision-making. We do not make decisions about you by automated means that produce legal or similarly significant effects, and we do not profile you.

Analytics and cookies in the EU/EEA/UK: We do not ask you for analytics consent, because in your region we do not set analytics cookies at all. Google Analytics — the only service on our site that sets a non-essential cookie — is not loaded for visitors in the EU, EEA, or UK. (The one other cookie we set, loadin_lk, is strictly necessary to keep your Pro license unlocked and is described in §5.1.) Your browser's time-zone setting is read before any analytics script is requested, and if it indicates a European jurisdiction, or if it cannot be determined at all, Google Analytics is skipped and no _ga or _ga_<container-id> cookie is ever written. Analytics in your region is carried entirely by Plausible, which is cookie-free, sets no persistent identifier, and processes no personal data. This is why you will not see a cookie banner: there is nothing in your region for you to consent to.

8.2 Rights Under the CCPA/CPRA (California)

If you are a California resident, you have the following rights under the California Consumer Privacy Act as amended by the CPRA:

• Right to know: Request disclosure of the categories and specific pieces of personal information we have collected, the sources, our purposes, and the categories of third parties we disclose it to
• Right to delete: Request deletion of your personal information
• Right to correct: Request correction of inaccurate personal information
• Right to opt out of sale or sharing: We do not sell personal information, and we do not share it for cross-context behavioral advertising — and we have not done so in the preceding 12 months. There is therefore no "Do Not Sell or Share My Personal Information" link on this site, because there is nothing to opt out of.
• Right to limit use of sensitive personal information: We do not collect sensitive personal information as the CPRA defines it, and we do not use or disclose any for purposes requiring this right
• Right to non-discrimination: We will not deny you service, charge you a different price, or give you a lower quality of service for exercising your rights. We offer no financial incentives for personal information.

Categories collected in the last 12 months: identifiers (email address, license key, IP address, device and account identifiers); commercial information (purchase and entitlement records); internet or network activity (usage and error diagnostics); and the contents of files you choose to sync, share, or submit. We collect these from you directly, from your browser, and from our payment and entitlement providers. We disclose them to the service providers listed in §4 for the business purposes described in §3, and to no one else.

Authorized agents. You may use an authorized agent to make a request. We will ask for proof of the agent's authority and may ask you to verify your own identity directly.

8.3 Rights in Canada (PIPEDA)

If you are in Canada, you may access the personal information we hold about you, ask us to correct it if it is inaccurate, and withdraw consent (subject to legal or contractual restrictions and reasonable notice). We collect, use, and disclose personal information only for the purposes described in this policy. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca. Residents of Quebec have additional rights under Law 25, including the right to be informed of automated decisions (we make none) and the right to data portability.

8.4 Rights in Australia

If you are in Australia, the Australian Privacy Principles give you the right to access the personal information we hold about you and to ask us to correct it. You can complain to us first at goforshowio@gmail.com, and if you are not satisfied, to the Office of the Australian Information Commissioner at oaic.gov.au. Because we are based in the United States and use the service providers listed in §4, your personal information is disclosed to overseas recipients, principally in the United States — see §9.

8.5 Rights in Brazil, Japan, South Korea, and Elsewhere

We ship load·in in eleven languages and sell worldwide, so people use it under many privacy laws. Wherever you are, we will honor a request to access, correct, delete, or port your personal data, to withdraw consent, or to object to marketing — on the same terms and in the same timeframe as we give everyone else, whether or not your local law requires it of us.

• Brazil (LGPD): confirmation of processing, access, correction, anonymization or deletion, portability, information about sharing, and withdrawal of consent. Complaints go to the ANPD.
• Japan (APPI): disclosure, correction, and cessation of use of retained personal data.
• South Korea (PIPA): access, correction, deletion, and suspension of processing.

8.6 How to Exercise Your Rights

Email us at goforshowio@gmail.com with:

• The email address associated with your purchase or account
• A description of what you want us to do
• Enough information for us to verify it is really you — usually replying from the address on the account is enough

We will respond within 30 days, or sooner where the law requires it (for example, one month under the GDPR, extendable by two months for complex requests, and 45 days under the CCPA/CPRA, extendable once). Exercising a right is free. If a request is manifestly unfounded or excessive we may charge a reasonable fee or decline, and we will tell you why and how to complain.

You can do some of this yourself, right now: delete your account and its stored plots from the app (Files tab → your email → Delete account) or at goforshow.io/account/delete; unsubscribe from product updates using the link in any message; and revoke any share link from inside the app.

9. International Data Transfers

We are based in the United States. If you use our Services from outside the US, your information will be transferred to, stored, and processed in the US, and in other countries where the service providers listed in §4 operate. Those countries may have different data protection laws than your own.

How we make those transfers lawful. For personal data covered by the EU or UK GDPR, we rely on the European Commission's Standard Contractual Clauses, and for the UK on the ICO's International Data Transfer Addendum, incorporated into our agreements with the providers in §4 — together with the technical measures described on our Security page, principally encryption in transit and at rest. Where a provider is certified under the EU–US Data Privacy Framework or its UK extension, we may rely on that instead. For Australia, this is a disclosure to overseas recipients under Australian Privacy Principle 8; for Canada, a transfer to a service provider under PIPEDA.

You can ask us for information about the safeguards that apply to a particular transfer by emailing goforshowio@gmail.com.

10. Our Service Providers and Sub-processors

The providers listed in §4 process personal data on our instructions. We use providers that offer a data processing agreement, we do not authorize them to use your data for their own purposes, and we make a reasonable assessment of their security before relying on them. If we change a provider in a way that materially affects how your data is handled, we will update §4 and note it in the change history at §13.

11. Children's Privacy

Our Services are professional tools for live sound and production work. They are not directed to children, and we do not knowingly collect personal information from children under 13.

Our Terms of Service §3.3 set a minimum age of 16 to use the Services and 18 to make a purchase. In the EU, member states set the age of digital consent between 13 and 16; our 16 floor is set at the highest of those so that the same rule works everywhere.

If you are a parent or guardian and believe your child has provided us with personal information, contact us at goforshowio@gmail.com. We will delete it promptly.

12. Do Not Track Signals

Some browsers offer a "Do Not Track" signal, but there is no consistent industry implementation. You can block analytics with browser privacy controls or content blockers, and you can contact us to exercise the rights described above.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do:

• We will update the "Effective Date" at the top of this page
• For significant changes, we will notify you via email (if we have your email address)
• Continued use of the Services after changes constitutes acceptance of the updated policy

We encourage you to review this Privacy Policy periodically.

14. Complaints and Regulatory Contact

If you have concerns about how we handle your data and are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority:

• EU/EEA residents: Contact your local supervisory authority (list of EU authorities)
• UK residents: Information Commissioner's Office (ICO) at ico.org.uk
• California residents: California Attorney General at oag.ca.gov/privacy

15. Contact Us

If you have questions about this Privacy Policy or how we handle your data:

Email: goforshowio@gmail.com
Operating as: go·for·show
Location: New York City, USA

We will respond to your inquiry within 30 days.