This page summarizes the security and privacy controls in place across musiconnect. It reflects how the app is built today and is maintained by our team — it is not a third-party certification.
Authentication is handled by our managed backend. Passwords are never stored by musiconnect directly; the backend uses industry-standard hashing. Sessions are issued as short-lived bearer tokens with automatic refresh.
Every database table enforces row-level access rules. You can only read or modify rows that belong to you, that you are a member of (e.g. a conversation), or that are explicitly public (e.g. published posts). Administrative and moderation roles are stored in a separate, server-side role table — they cannot be self-granted from the client.
Conversations and messages are accessible only to their members. Images shared in DMs are stored in a private bucket and served through short-lived signed URLs — direct links are not publicly browsable.
Payments are processed by Stripe. We never see or store full card numbers. Marketplace payouts use Stripe Connect; webhook signatures are verified server-side before any transaction is recorded.
Public assets (avatars, cover art, posted audio) live in public buckets by design. Licensed/paid files and private DM media live in private buckets with access policies that match the database rules.
Users can report content. Moderators can hide or remove posts, comments, messages, and ban accounts. Banned-account content is purged automatically.
If you believe you have found a vulnerability, please email hello@musiconnect.app with details and steps to reproduce. We will respond as quickly as possible. Please do not publicly disclose issues before we have had a chance to address them.
You can edit or delete your profile, posts, and conversations at any time from the app. To request a full export or full account deletion, contact us at the address above.