Your privacy

Here's what releaseit keeps about you, where it lives and who else gets to see it. "We" on this page means the people who run releaseit.

Last updated 15 October 2026.

What we keep

Only what the app needs to help your team ship releases:

  • Your Telegram account ID, display name and avatar link, from signing in. Never your phone number.
  • The public keys of your passkeys, plus session cookies, so you stay signed in.
  • The work you add: releases, notes, results and uploaded files, along with who did what and when.
  • SoundCloud connection tokens and IDs, only if your label chooses to connect SoundCloud.
  • Request data, your IP address included, which our hosting and CDN providers see when you visit.

How we protect it

Telegram IDs and connection tokens are encrypted with AES-256-GCM under one key. Telegram IDs also get a lookup index, an HMAC-SHA-256 made with a second, separate key, so we can find them without decrypting them.

Those two keys are server secrets, kept outside the database.

Files and backups rely on Cloudflare R2's encryption at rest.

Names and release details are stored as they are, without extra encryption.

Where it lives

The database runs on Railway in its EU West region. That's a region we choose, backed by Railway's data processing agreement and standard contractual clauses.

Files and nightly backups sit in Cloudflare R2, in its EU jurisdiction.

Who else sees some of it

A few services outside the EU see some data along the way:

  • Railway keeps its platform logs in the US for 90 days, and those logs include IP addresses.
  • Cloudflare's proxy runs on its global network, so your visits can pass through servers outside the EU.
  • Telegram handles sign-in, and posts to your label's group chat when your label turns that on. It isn't where your data is kept.
  • SoundCloud receives the tracks and playlists your label syncs, only once your label opts in.

SoundCloud

When your label disconnects SoundCloud, we delete its SoundCloud data within 7 days.

Tracks and playlists already on SoundCloud stay there until a member deletes them on SoundCloud.

Getting or erasing your data

For a copy of your data, or to have it erased, write to [email protected]. We handle every request within one month.

Erasure redacts your notes and results, anonymises your name and removes your sign-in data.

Your label keeps its files and its history, which then refers to you by an ID only.

Once your data is erased, it leaves the nightly backups within about 60 days of your request.

If something goes wrong

If a breach ever touches your data, we'll let you know. Spotted a problem? Write to [email protected].

Say hello

Questions about this page? Write to [email protected]. The same address takes export and erasure requests.