PRIVACY POLICY

1. What SetLab Is

SetLab is a web app that helps DJs plan setlists. It imports your Serato library, uses AI (Claude by Anthropic) to generate a sequenced set based on your gig context, and exports the result back to Serato as a .crate file.

SetLab is operated by Kel Wu, an individual developer. Contact: kelcwu@gmail.com

2. What Data We Collect

Account

• Email address (used to log in and contact you)
• A Supabase-generated user ID (UUID)
• Account creation timestamp
• No passwords are stored by {BRAND.name} — Supabase Auth handles credential storage using bcrypt hashing

Serato Library

When you upload your Serato library file, SetLab extracts and stores per-track metadata:

• Artist name
• Track title
• BPM
• Musical key
• Genre
• File path (the path on your local machine as stored by Serato — used only to generate .crate files for re-import; {BRAND.name} never accesses your files remotely)

Audio files are never uploaded. Only the text metadata above is stored.

Generated Setlists

When a setlist is generated, we store:

• Setlist name, genre, crowd context, duration, and lineup slot
• Energy arc settings
• The ordered list of selected tracks with transition notes and AI annotations
• Creation timestamp

Setlists are private by default. You can publish a setlist to get a public share URL — see Section 5 for how that works.

What We Do NOT Collect

• Payment information ({BRAND.name} has no paid features)
• Audio files or audio content
• Location data
• Analytics or behavioral tracking data
• Advertising identifiers

3. How We Use Your Data

• To log you in and keep your session active
• To store and retrieve your Serato library across devices
• To generate AI setlists using your library and gig parameters
• To match setlist tracks to your library for .crate file export
• To display your setlist history on your dashboard

We do not sell your data. We do not share it with third parties except as described in Section 4.

4. Third-Party Services

Supabase

Supabase provides our database and authentication. All user data — accounts, library metadata, and setlists — is stored in Supabase on AWS infrastructure in us-east-1. Row-Level Security policies ensure each user can only access their own data. Supabase Privacy Policy ↗

Vercel

SetLabis hosted on Vercel. Standard server logs (request metadata, IP addresses) are retained per Vercel's own policy. Vercel Privacy Policy ↗

Anthropic (Claude AI)

When you generate a setlist, SetLab sends your library metadata (artist, title, BPM, key, genre) and gig parameters to the Anthropic Claude API. No personally identifying information is included. Anthropic does not use API inputs to train its models by default. Anthropic Privacy Policy ↗

Spotify Coming Soon

A future update will let you connect your Spotify account to save tracks to a wishlist. Here is what that integration will look like when it launches:

• What we request: Read-only access to your saved tracks / liked songs (OAuth scope: user-library-read)
• What we store: Track artist and title only — no listening history, no audio features, no personal profile data
• OAuth tokens: Stored in Supabase, encrypted at rest. Used only to fetch your saved tracks on your behalf.
• Revoking access: You can disconnect Spotify from your Spotify account settings at any time (spotify.com/account/apps)

Spotify Privacy Policy ↗

5. Public Setlists

Setlists are private by default. If you click “Make Public” on a setlist, it becomes accessible to anyone with the link at setlab.ai/set/[slug]. Public setlists show the track list, energy arc, and metadata — no account information is exposed. You cannot currently undo a public setlist through the UI; contact kelcwu@gmail.com to make one private again.

6. Cookies

SetLab uses one cookie: the Supabase session cookie (prefixed sb-), set when you log in. It is HTTP-only, Secure, and SameSite. It expires when you sign out or after the session token expires (~1 hour, auto-refreshed while you're active).

No advertising cookies. No analytics cookies. No third-party tracking of any kind.

7. Your Rights

• Access: Your library and setlists are visible in the app at any time.
• Delete library:Use the “Clear” button in the Library tab to delete all imported tracks at any time.
• Delete account: Account deletion is not yet available in the UI. Email kelcwu@gmail.com and all your data — account, library, and setlists — will be permanently deleted within 7 days.
• Data portability: Your generated setlists can be exported as Serato .crate files. Contact us if you need a full data export.

8. Data Security

All data is stored in Supabase with Row-Level Security — database policies prevent any user from reading another user's data, even if they have valid credentials. Connections are encrypted in transit (TLS). Passwords are hashed by Supabase Auth (bcrypt).

SetLab is a small indie project. While we follow reasonable security practices, no system is perfectly secure. Do not store sensitive personal information in setlist names or notes.

9. Children's Privacy

SetLab is not directed at children under 13. We do not knowingly collect personal information from anyone under 13. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

10. Changes to This Policy

When we make material changes, we'll update the “Last updated” date at the top. Continued use of SetLabafter changes means you accept the updated policy. For significant changes, we'll notify users by email if possible.

11. Contact

Questions, deletion requests, or anything else: kelcwu@gmail.com

SetLab is operated by Kel Wu · kelcwu@gmail.com