Privacy Policy — CatalogTracker

Last updated: October 27, 2026

CatalogTracker is an iOS app for independent artists, producers, and their teams to organize a music catalog, track royalty splits, and manage agreements. It is made by ACME Idea CO (“we”, “us”), 2967 Dundas St. W. #1751, Toronto, ON M6P 1Z2, Canada.

Trust is the whole point of this app, so this policy is written plainly and says exactly what we do and don’t do. The short version:

• Your catalog lives on your device. We don’t upload or store your catalog on our servers.
• We only receive data when a feature genuinely needs it — signing in, sharing a split sheet for confirmation, requesting verification, and limited analytics.
• We never sell your data, never advertise to you, and don’t track you across other apps or the web.
• You can permanently delete your account from inside the app, any time. Agreements you signed stay in force for every party, so they are kept as signed records with your name on them, and you get your own copies first.

CatalogTracker is offered in Canada, the United States, and Mexico, and is intended for adults (18+).

What we collect, and why

1. Your account (when you sign in)

You sign in with Sign in with Apple, or by email: a one-time code sent to your address (which creates an account if you don’t have one), or a password for accounts we provision (for example App Review and staff). When you sign in we receive, and store on our backend, a user identifier, your email address, and your name (if you choose to share it — Apple lets you hide your email behind a private relay, and that’s fine), plus the name and type of your catalog, your avatar if you set one, and your email-notification preference. We use this to create your account, back up and sync the limited cloud data below, and let collaborators see who a split sheet came from.

2. Your catalog — stays on your device

The releases, tracks, credits, splits, and agreement documents you create or import are stored locally on your device. If you use backup, your catalog is copied to your own iCloud account (Apple’s iCloud/CloudKit) — we do not have access to it and it is governed by Apple’s Privacy Policy. We do not receive, store, or have access to your catalog on our servers.

3. Shared split sheets (only when you choose to share)

When you send a split sheet to a collaborator for confirmation, we store a snapshot of just that split on our backend so the other party can review and confirm it: track title, ISRC, artist and release name, split type and percentages, each listed party’s name, the email address you enter for a collaborator, and — where present — professional identifiers such as an IPI number and a verification status. We also store:

• the split-sheet PDF the app generates for that share, and the executed copy once every party has confirmed, in private storage, each with a checksum so everyone can tell the document is the one that was sent;
• each party’s response (confirmed or declined, when, from the app or from the web link), an optional decline note, and for in-app confirmations a cryptographic confirmation receipt;
• for a response made from the web link, the IP address the response came from, the browser (user agent), the exact consent wording agreed to and its version, the SHA-256 fingerprint of the document shown, and when the emailed code was entered;
• for a response made from the web link, a six-digit code emailed to the invited address when the person chooses to accept or decline, kept only as a one-way hash, for ten minutes or until it is used;
• a change log of edits you make to the shared track’s details (title, ISRC, credits) after sending, so collaborators see what changed;
• a per-collaborator response link that only our server can read;
• an administrative log of changes to shared split sheets and of verification and beta decisions (which account acted, when), used for security review.

A split sheet you send expires 30 days after sending if the collaborator hasn’t responded; you can also withdraw it. This exists to make confirmations trustworthy; it is not your full catalog.

If you were invited and respond on our website rather than in the app, we email a six-digit code to the address the invitation was sent to and ask for it before your answer is recorded. With your answer we record your typed name, that the code sent to that address was entered, the time, your IP address and browser, the exact consent wording you agreed to, and the SHA-256 fingerprint of the document you were shown. When every party has agreed, a certificate of completion is added to the final copy and sent to every party to the agreement: each party’s name and email address, how and when they agreed and, for an answer given on the website, the IP address it came from. This record is what lets anyone show later that the agreement is what each party agreed to.

3a. Team invitations (if you invite someone to your catalog)

If you invite a collaborator to your catalog as a team member, we store the email address you invite, the role you give them, and whether they accepted.

4. Identity verification (if you request it)

If you request artist verification, we store the artist name, the public links you provide as evidence (e.g., a public profile you control), a generated challenge code, and the request’s status. If you ask to join the beta programme, we store the note you write with the request and its outcome. An administrator reviews it to confirm control of your established public presence. Verification confirms control of a public presence — it is not a confirmation of legal rights ownership.

5. Analytics and diagnostics

We use PostHog to understand how the app is used and to catch crashes and performance problems, so we can make it better. This includes product-interaction events and crash reports, associated with your account identifier, your email, and an identifier for the installation on your device. We strip personal details (such as names, emails, and rights identifiers) out of individual analytics events before they’re sent. This is first-party analytics used only to run and improve CatalogTracker — we do not track you across other companies’ apps or websites, and we do not use advertising identifiers (our privacy manifest declares NSPrivacyTracking = false), so the app does not show a tracking-permission prompt.

We do not collect your location, contacts, photos (beyond artwork you deliberately add), or advertising identifiers.

6. The waitlist on our website

If you enter your email address on the CatalogTracker page at acme-co.ca to hear when the app ships, we send one confirmation email and store nothing until you open the link in it. Only when you confirm is your address added to our list, held by Resend, our email provider. We use it for one email when CatalogTracker ships and nothing else. That email carries an unsubscribe link, and you can also write to info@acme-co.ca to be removed at any time. If someone else enters your address, the confirmation is the only thing you will ever receive, and ignoring it is the whole of opting out.

Who we share it with

We don’t sell your personal information and we don’t share it for advertising. We use a small number of service providers (“processors”) strictly to run the app:

We may also disclose information if required by law, or to protect the rights, safety, and security of our users and the service.

International processing

Our service providers (Supabase, PostHog and Resend) process and store data on servers in the United States. Because CatalogTracker is offered in Canada, the United States, and Mexico, your information may be transferred to and processed in the United States. When data is processed outside your home country, we rely on data-processing agreements and appropriate contractual safeguards requiring a comparable level of protection.

Your choices and rights

• Delete your account, yourself, any time. In the app, go to Settings → Delete Account. This permanently removes your profile, your sign-in, your verification and beta requests, the split sheets you sent that were not fully confirmed, their PDFs, and your catalog memberships from our servers, and clears your catalog from the device.
• What deleting your account does not remove: the agreements you signed. A split sheet that every party has confirmed is a signed agreement between all of them, and deleting one party’s account does not cancel or change it. So we keep each fully confirmed split sheet you created or joined, as a signed record for every party: the document and its checksum, your name, share and confirmation, your email address and professional identifiers (such as an IPI) as they appear on the record, the confirmation receipt and the public key that signed it, the record of how each party agreed (for an answer given on the website: the code check, the time, the IP address, the browser, the consent wording and the document fingerprint), its certificate of completion, and the history of that agreement. These are kept because they are the record of a contract you are party to; they are visible only to the other parties to that agreement and to us, and are not used for anything else. Before your account is deleted, the deletion screen lets you save all of your agreements to Files, and we email you a link to each one, valid for 30 days. If that email cannot be sent and you have not saved them, your account is not deleted and the app tells you why. Where your name appears on someone else’s split sheet that was never fully confirmed, your email address and professional identifiers are removed from it. Backups held in your own iCloud are controlled by you in iOS Settings → your name → iCloud.
• Access and correct. Most of your data is created and editable directly in the app.
• Withdraw sharing. You can withdraw a shared split you created before it is fully confirmed; collaborators can no longer respond to it. The withdrawn snapshot and any response already recorded stay with your account until you delete it.
• Region-specific rights. Depending on where you live, you may have rights under Canada’s PIPEDA, the California Consumer Privacy Act (CCPA/CPRA), or Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) — including to access, correct, delete, and port your data, and (in California) to know what we collect and not be treated differently for exercising your rights. We do not sell or “share” your personal information as those terms are defined under U.S. state privacy laws. You may also complain to your local privacy regulator (in Canada, the Office of the Privacy Commissioner). To exercise any right, contact us and we’ll help.

Data retention

• Account, sharing, and verification data is kept while your account exists. When you delete your account, we remove it from our live systems immediately, except the signed agreements described above, which are kept as long as they bind their parties; copies in our provider’s routine encrypted backups expire with those backups, within 30 days.
• Analytics and diagnostic data is retained for up to 24 months, then deleted or aggregated. When you delete your account, we delete the analytics profile tied to it (your account identifier and email) within 30 days.
• On-device and iCloud data persists until you remove it (delete the app, or manage the backup in your own iCloud).
• Waitlist addresses are kept until you unsubscribe, or until 30 days after the email they exist for has been sent, whichever comes first.
• We may retain limited records longer only where the law requires it.

Security

Connections to our backend use encrypted transport (HTTPS/TLS). Access to your cloud data is enforced by row-level security tied to your account. Your session is stored in the device Keychain, and confirmation receipts are signed using the device’s Secure Enclave so they can be independently verified. No method of transmission or storage is perfectly secure, but we work to protect your information and hold only what the app needs.

Age requirement

You must be at least 18 years old to use CatalogTracker. The app is used to create and manage legally significant documents (such as split sheets and agreements) that require the capacity to enter binding contracts. We do not knowingly collect personal information from anyone under 18; if you believe a minor has used the app, contact us and we’ll remove the data.

Changes to this policy

If we make a material change, we’ll update the date at the top of this page. Your continued use after an update means you accept the revised policy.

Governing law

This policy is governed by the laws of the Province of Ontario and the federal laws of Canada applicable there, without regard to conflict-of-laws rules — subject to any mandatory consumer-protection rights available to you where you live.

Contact

Questions or requests: support@acme-co.ca.

ACME Idea CO, 2967 Dundas St. W. #1751, Toronto, ON M6P 1Z2, Canada.

See also the Terms of Service.