1. Scope
This Privacy Policy applies to The Collective website, Creator Hub, Newsletter Sender, Creator Resources, Smart Link creator pages, public leaderboard, and other Collective-controlled website features. It explains information processed directly by The Collective when you visit the site, sign in with Discord, connect an email provider, use AI Auto-Detect, or send a newsletter.
The Collective also interacts with independent services including Discord, Alto, Google, Microsoft, IONOS, Google Gemini, and music platforms. Information those companies process under their own accounts, websites, APIs, or infrastructure is also subject to their own privacy policies and terms.
2. Information The Collective may process
Discord and Creator Hub information
When you sign in to Creator Hub with Discord, The Collective may process your Discord user ID, username, display name, avatar information, and information needed to confirm current Collective membership through Alto. The website records basic Creator Hub sign-in history associated with your Discord user ID, including first and most recent sign-in times and a sign-in count. It also maintains a limited first-party activity log for signed-in Creator Hub use, as described below. Newsletter creators may also save a Newsletter Appearance sender name and optional uploaded profile image used as their newsletter identity and on recipient-facing unsubscribe screens; these settings can replace the displayed Discord name or avatar for those newsletter features.
Core Collective subscriptions and billing
If you purchase Core Collective, The Collective links your Discord user ID with Stripe identifiers and subscription records, including the Stripe customer and subscription IDs, selected plan, current subscription status, billing-period end date, cancellation setting, and role-synchronization information. This is used to recognize your membership, grant or remove the Core Collective Discord role, provide billing-management access, handle webhook notifications, and resolve subscription support issues. We do not collect or store your full payment-card number or card security code on The Collective's server. Payment details are collected and processed by Stripe on its hosted checkout and billing pages.
Creator Hub activity analytics
When you are signed in, The Collective may record limited first-party activity analytics tied to your Discord account so administrators can understand service use, troubleshoot problems, investigate abuse, and operate Creator Hub. These records may include your Discord user ID, current username or display name and avatar URL, a timestamp, a general page or feature category, and a short action label such as viewing a Creator Hub page, updating a profile, using Discovery Vote, changing newsletter settings, connecting or disconnecting a provider, sending a newsletter, deleting a submission, or submitting a bug report.
The Creator Hub analytics store is designed not to record newsletter bodies, recipient email addresses, passwords, OAuth tokens, verification codes, uploaded newsletter images, bug-report descriptions or attachments, raw request bodies, or IP addresses. It does not use advertising identifiers, fingerprinting, or cross-site tracking. Some infrastructure or security systems may separately process technical request information as described under Technical website information.
Community and leaderboard information
To operate public and member-facing community features, The Collective may receive information from Alto and Discord integrations, including:
- Discord user IDs, display names or usernames, avatars, active avatar decorations or profile flares, and relevant Collective server roles used to configure role-aware Creator Hub features;
- submitted track titles and links;
- publicly displayable artwork or thumbnails obtained from supported music platforms;
- leaderboard positions, votes, favorites, submissions, and other engagement information made available through Alto;
- basic Discord server information such as community name, icon, and approximate member count.
Smart Link creator pages
If you use the Smart Link Builder, The Collective stores the creator name you enter, the URL slug generated from that name, the page type used for the feature, and the page configuration you choose. The feature may use your current Collective Producer role to present the Smart Link as a Producer Page rather than an Artist Page. Depending on what you add, stored configuration can include a tagline, location, genres, bio, uploaded profile image, uploaded background image, appearance settings, featured-release title, release type, uploaded artwork, release date and call-to-action link, streaming and social links, custom link labels and destinations, uploaded custom-link icons, button order, a featured-button choice, and optional page-sharing title, description, and uploaded share image. Smart Link image uploads are stored in Collective-controlled media storage so the selected files can be used in the builder and displayed with a published page. When you publish, the applicable fields and images are intentionally displayed on a public page at a URL such as /artist/artist-name or /producer/producer-name. If you do not upload a separate profile image, the page may use the Discord avatar associated with your signed-in Creator Hub account as the public profile image.
The public URL is based on the creator name entered in Smart Link Builder rather than the member's Discord username. Published Smart Link pages are available to anyone who has or discovers the URL. Images selected for a published Smart Link page, including custom-link icons, are likewise intended for public display. Unpublishing removes the page from normal public access while retaining the saved builder data and selected media for later editing or republishing; deleting the page data from Smart Link Builder removes the Collective-controlled Smart Link record and its associated Smart Link upload folder.
Smart Link pages also maintain limited aggregate performance counts for the page owner, such as total page views, total destination-link clicks, per-button click totals, and the most recently recorded view or click time. These Smart Link counts are not designed to identify individual visitors: the Smart Link analytics feature does not create a visitor profile, store a visitor identifier, add an analytics cookie, or store visitor IP addresses in the Smart Link record. Repeat visits, automated traffic, or shared devices may affect the counts.
Electronic press kits and Collaboration Marketplace
If you create an electronic press kit (EPK), The Collective stores your chosen name, public page slug, headline, biography, location, genres, press or testimonial quotes, professional credits, achievements, release details, streaming and social links, contact name and email, profile image link, and any press photographs you upload. You can start with details already saved on your Creator Page, then edit the EPK independently. EPK drafts are available only to the signed-in owner; if you publish, the selected information, contact email and photographs become publicly available at a shareable /epk/... URL. Visitors can save the page as a PDF using their browser and download photographs individually.
If you create a collaboration profile, The Collective stores the profile name, role, description, location, genres, skills, types of collaborators sought, availability, image and relevant links, and any contact email or contact URL you provide. Marketplace profiles are opt-in. Published profiles may appear in public search and filter results at /collaborations. The Marketplace now uses private message requests instead of displaying a contact button; any contact information you saved earlier is not displayed on marketplace cards. Both resources associate saved settings with your Discord user ID for account management. The public URLs may include an abbreviated identifier to keep creator names distinct. You can unpublish without deleting your draft, or permanently delete the EPK or marketplace profile from its editor. Deleting an EPK also removes press photographs saved by its EPK upload tool, subject to ordinary infrastructure backups or logs.
Connected email accounts
If you use the Newsletter Sender, you may choose to connect Gmail, Outlook/Microsoft, or IONOS. Depending on the provider, The Collective may process and store:
- the email address and display name associated with the connected account;
- OAuth authorization credentials, such as Google or Microsoft refresh tokens, needed to keep the account connected;
- for IONOS, the mailbox email address and the password or app password supplied for SMTP authentication;
- additional Gmail From addresses that you verify through The Collective, together with verification timestamps and limited verification-attempt metadata.
Google and Microsoft OAuth credentials and IONOS passwords are encrypted before they are written to the Newsletter Sender account store. The Collective does not display stored secrets back to users.
Additional Gmail From-address verification
When you ask to add another Gmail From address, The Collective sends a six-digit code to that address through your connected Gmail account. The code itself is not stored in plaintext; the application stores a cryptographic verification value, expiration time, send time, and attempt count needed to complete and protect the verification flow. Verification shows that the person completing the process can receive email at that address; it does not independently confirm that Gmail has configured the address as an authorized “Send mail as” identity.
Newsletter content and recipients
When you send a newsletter, The Collective processes the sender name and address, recipient email addresses, subject, newsletter HTML, image slices or attachments, links, reusable footer settings, and related message content needed to prepare and transmit the message through the email provider you selected. If you save a reusable newsletter footer, its heading, message, contact or postal line, reusable links, uploaded brand image, image click-through URL, and optional uploaded link-icon images are stored with your Creator Hub newsletter settings so they can be applied to future newsletters. If you use the Email List feature, recipient email addresses and optional contact names are stored with your Creator Hub newsletter settings so you can manage a reusable audience. Complete newsletter bodies are not maintained as a send-history database after the send is completed. The Collective may retain one-way cryptographic delivery identifiers, the most recent send time, the sender email addresses used for those sends, and the creator's public Discord profile information needed to provide the recipient-facing unsubscribe manager. The delivery identifiers are not designed to store the recipient address in plaintext.
Newsletter unsubscribe and suppression data
Every newsletter sent through The Collective includes a Collective-hosted unsubscribe link. When a recipient enters the address that received the newsletter, The Collective first checks a one-way cryptographic delivery identifier to confirm that the unsubscribe link belongs to a creator who previously sent to that address. The unsubscribe page may then show the Creator Hub accounts that have previously sent newsletters to that address, including their public Discord profile image and username and the sender email addresses recorded for those newsletter sends. The recipient can select one, several, or all eligible creators to unsubscribe from. For each selected creator, The Collective creates a one-way cryptographic suppression identifier. The raw recipient address is not stored in the cryptographic suppression list. If that recipient is also present in a selected creator’s saved Email List, the saved contact remains visible there and is marked Unsubscribed so the creator can see that the address may no longer receive newsletters through The Collective. The Collective also creates a private Creator Hub announcement for each selected creator showing the unsubscribed email address and unsubscribe time so the creator is clearly notified of the opt-out. The email address stored for this announcement history is encrypted at rest. Suppression identifiers and unsubscribe timestamps are retained so future newsletter sends from those selected Creator Hub accounts can automatically exclude the opted-out address.
Collaboration Messages
When you send a collaboration request, The Collective stores your and the recipient's Discord user IDs, display names, the introductory message, timestamps, the request status (pending, accepted, or rejected), subsequent messages if the request is accepted, and which participant has read each message. Messages are stored on the Collective server and are visible in Creator Hub only to the two participants; they are not end-to-end encrypted. Authorized website operators and service providers may access the stored records as needed to maintain security, investigate abuse, comply with law, or provide support.
Recipients can accept or reject incoming requests. Until accepted, senders cannot send further messages in that conversation. The service limits new requests and message volume to reduce spam. Conversation data may be retained while accounts and the messaging service remain active, including rejected requests needed to prevent repeated unwanted requests. Avoid sharing passwords, financial credentials, or other sensitive personal information through messages.
AI Auto-Detect
If you explicitly use AI Auto-Detect, the newsletter image you submit is transmitted to the configured Google Gemini API so the model can identify possible clickable regions and return suggested hotspot coordinates, labels, and accessibility text. The Collective also keeps a per-user daily usage counter so the current limit of three successful AI Auto-Detect runs per day can be enforced. Failed AI requests are designed not to consume a successful use.
Technical website information
When you use the website, your device necessarily sends technical information such as an IP address, browser information, request details, and network metadata to the server and hosting/network providers. The application may use IP addresses and request information transiently for rate limiting, security, troubleshooting, and abuse prevention. Infrastructure providers may retain their own operational or security logs under their own practices.
3. How information is used
The Collective uses the information described above to:
- authenticate Creator Hub members and maintain signed-in sessions;
- confirm Collective membership and provide member-specific Creator Hub features;
- manage paid Core Collective subscriptions, verify payment and cancellation status, and synchronize premium website access and the Discord role;
- display live leaderboard, profile, submission, favorite, and community information;
- create, publish, update, unpublish, and delete member-directed Smart Link creator pages and their public links;
- connect, maintain, and disconnect member-authorized Gmail, Outlook, and IONOS accounts;
- send newsletters and From-address verification messages only when a member initiates those actions, and automatically prevent delivery to recipients who have unsubscribed from that member’s newsletters through The Collective;
- provide AI Auto-Detect when a member chooses to use it and enforce the applicable daily usage limit;
- maintain service reliability, understand use of Creator Hub features, prevent abuse, investigate errors, and protect accounts and infrastructure;
- moderate the community and respond to safety, legal, privacy, or rights-related requests where appropriate.
The Collective does not currently operate an advertising network or sell personal information through the website. Depending on the law that applies, processing may be carried out because it is necessary to provide or secure a requested service, to comply with legal obligations, or because The Collective has legitimate operational interests such as service security, fraud and abuse prevention, troubleshooting, and understanding feature use. Where applicable law requires consent for a particular non-essential technology or use, The Collective should obtain that consent before enabling it.
4. Connected services and information sharing
The Collective shares or transmits information to third-party services only as needed to provide a feature you use, operate the community, protect the service, or comply with applicable obligations. Examples include:
- Stripe: to securely process Core Collective subscription payments, provide hosted billing management, and send verified billing events to The Collective; Stripe processes payment and billing information under its own privacy notice;
- Discord: for Creator Hub sign-in, Discord identity information, community access, and links to the Collective server;
- Alto: for Collective membership checks and Creator Hub, leaderboard, profile, submission, favorite, and related community data;
- Google / Gmail: for Google OAuth identity information and sending messages through a Gmail account that the user has connected and authorized;
- Microsoft / Outlook: for Microsoft OAuth identity information and sending messages through a connected Outlook or Microsoft mailbox;
- IONOS: for SMTP authentication and sending messages through a connected IONOS mailbox;
- Google Gemini: when the user chooses AI Auto-Detect, to analyze the submitted newsletter image and return hotspot suggestions;
- Music and media platforms: such as Spotify, SoundCloud, YouTube, Apple Music, or Bandcamp, when The Collective retrieves or displays links, artwork, thumbnails, or related public content.
Email providers receive the message and recipient information required to deliver newsletters. Recipient email addresses may therefore be processed by the selected sender’s email provider. When a creator chooses to use the saved Email List feature, The Collective also retains those list contacts until the creator removes them or an applicable deletion request is completed.
5. Google API user data
Google information obtained through OAuth is used only to provide the user-facing Gmail connection and Newsletter Sender functionality described in this Policy. The Collective does not use Google user data for advertising, does not sell Google user data, and does not use it to build advertising profiles.
The Collective’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
A user may disconnect Gmail from the Newsletter Sender at any time. The Collective removes the stored Gmail connection from its Newsletter Sender account store and attempts to revoke the stored Google authorization token. Users may also manage or revoke third-party access from their Google Account security settings.
6. Cookies, sessions, embedded media, and advertising
The Collective uses essential first-party session and OAuth security cookies to sign members and administrators in. Creator Hub sessions last up to approximately 24 hours, admin sessions up to approximately 8 hours, and short-lived OAuth state cookies around 10 minutes. These cookies are necessary for login and security and cannot be disabled through the website's optional-media setting.
The Collective does not currently use website advertising cookies, cross-context behavioral advertising trackers, or an independently installed third-party analytics SDK. Creator Hub maintains first-party signed-in activity records and published creator pages store aggregate views and clicks; neither feature requires a separate analytics cookie.
Optional third-party media: The homepage includes Spotify playlist players, and Discovery Vote can launch Spotify, YouTube, and SoundCloud players. Those players may use their own cookies, identifiers, or other device technologies. We hold the embedded players and playback SDKs until you opt in using our banner, settings, or media placeholder. Declining does not stop you browsing the website, signing in, voting, or opening a music link on its provider's own site.
Your optional-media preference is stored in this browser using first-party local storage, not a tracking cookie. You can change it at any time using or visiting our Cookie Policy. Withdrawing permission stops and unloads supported embeds; cookies already set by another provider may need to be cleared through your browser or that provider.
When you choose an external platform link, that website controls its own cookies and privacy practices. Some ordinary images, artwork, and links on The Collective may also be provided from external sources; media consent specifically covers embedded players and their related playback services.
7. Retention and deletion
Core Collective subscription records: Subscription identifiers, Discord account association, plan and status, and billing period metadata are retained as reasonably necessary to verify benefits, resolve disputes, satisfy record-keeping obligations, and prevent billing or access errors. Stripe maintains its own payment and transaction records according to its policies and legal obligations. Canceling a subscription does not automatically delete historical billing records.
The Collective keeps information for as long as reasonably needed to provide the relevant feature, secure the service, maintain required records, or address legitimate operational or legal needs.
- Creator Hub sessions: active server-side sessions are designed to expire after approximately 24 hours, and signing out ends the current session.
- Creator Hub sign-in history: first sign-in time, last sign-in time, and sign-in count are stored with the Discord user ID until removed through administrative cleanup or an applicable deletion request.
- Creator Hub detailed activity analytics: timestamped signed-in page and action events are automatically pruned after 90 days by default. The configured retention period may be shortened or adjusted where operational or legal requirements change, but detailed identifiable activity should not be kept longer than reasonably necessary for its stated purposes.
- Electronic press kits: EPK drafts remain private until published. Publishing makes the chosen contact email, biography, credits and uploaded photographs public. Unpublishing disables the public page and unauthenticated photo downloads but retains the saved draft. Using Delete EPK removes the stored EPK record and its EPK photo directory.
- Collaboration Messages: private requests and accepted message histories are stored for participants and for abuse-prevention purposes. You may request removal of your message history using the contact methods in this policy.
- Collaboration Marketplace: only profiles explicitly published by their owners are shown in the public directory. Unpublishing hides the profile while retaining its draft. The Delete profile action removes the saved marketplace record.
- Smart Link creator pages: saved Smart Link page details, configuration, uploaded Smart Link images, and aggregate page-view/link-click counts remain associated with the Creator Hub account until the member deletes the page data or an applicable deletion request is completed. Unpublishing hides the public page but intentionally retains the saved builder data, selected uploads, and aggregate counts so the page can be edited or republished later.
- Connected email accounts: connection records remain associated with the member’s Creator Hub account until the member disconnects the provider or the data is otherwise deleted. Disconnecting a provider removes that provider’s stored connection record from the Newsletter Sender store.
- Gmail From verification: verification codes expire after approximately 10 minutes. Expired pending verification metadata may remain temporarily until it is overwritten, removed during later account activity, or the Gmail connection is removed. Successfully verified additional From addresses remain saved until the member removes them or disconnects Gmail.
- Newsletter appearance: a saved newsletter sender name and optional uploaded profile image remain associated with the member’s Creator Hub account until changed, removed, or deleted through an applicable request.
- Reusable newsletter footer: saved footer settings, including optional brand images and link-icon images, remain associated with the member’s Creator Hub account until the member changes, disables, deletes, or requests deletion of those settings.
- Saved Email List: email addresses and optional contact names added by a Creator Hub member remain associated with that member’s account until the member removes them or an applicable deletion request is completed. Contacts that unsubscribe may remain visible in that list with an Unsubscribed status so the opt-out is clear to the creator.
- Recipient unsubscribe suppression: one-way cryptographic suppression identifiers and unsubscribe timestamps are retained for as long as reasonably necessary to honor the recipient’s opt-out and prevent future newsletters from that Creator Hub account. The suppression list is not designed to store the recipient’s plaintext email address.
- Unsubscribe announcements: The Collective may retain up to 500 recent unsubscribe notices per Creator Hub account. These notices include the unsubscribed email address and timestamp, store the address encrypted at rest, and are shown only to the creator whose newsletter list the recipient opted out from.
- AI usage: the application stores a dated usage counter to enforce the current daily limit. The counter is logically reset for a new UTC day when usage is next evaluated.
- Newsletter sends: the current application is designed to process newsletter recipients and message content for transmission without maintaining a permanent send-history database containing the complete recipient list or newsletter body. One-way recipient delivery identifiers and a last-sent timestamp may be retained to validate future unsubscribe requests for that specific Creator Hub sender.
- Leaderboard/community caches: some live community information is cached for short configured intervals to improve reliability and performance.
Third-party providers may retain information independently under their own policies. Removing a Collective connection does not by itself delete records that Google, Microsoft, IONOS, Discord, Alto, Gemini, or another provider is independently required or permitted to retain.
8. Age requirements
The Collective is not intended for anyone below the applicable minimum age. If administrators learn that an underage person is participating or that information has been processed contrary to this requirement, they may restrict access and take reasonable steps regarding Collective-controlled data.
9. Your choices and requests
You can manage or cancel a Core Collective subscription through Membership, which opens Stripe’s secure Customer Portal for the Stripe account linked to your Discord identity. You can request information about The Collective’s subscription records through the contact channel below. Requests to access or correct payment information held by Stripe may also need to be made through Stripe.
Creator Hub members can sign out, publish or unpublish a Smart Link creator page, permanently delete their saved Smart Link page data, publish or unpublish and delete their EPK or marketplace profile, disconnect Gmail, Outlook, or IONOS from the Newsletter Sender, and remove additional Gmail From addresses that they previously verified. Disconnecting an account prevents future sends through that stored connection unless it is connected again. Newsletter recipients can use the unsubscribe link included in a Collective newsletter to stop future newsletters from that Creator Hub sender through The Collective.
You may contact The Collective administrators to ask about Collective-controlled information, including Creator Hub sign-in or activity records, request access, correction, or deletion where appropriate, object to or request restriction of certain processing where applicable, or raise a privacy concern. Identity may need to be reasonably verified before a request is completed. Some limited information may be retained where reasonably necessary for security, fraud prevention, legal compliance, dispute handling, or to honor an opt-out.
Because some information originates from or is controlled by Discord, Alto, an email provider, Gemini, or an external music platform, certain requests may also need to be made directly to that provider using its privacy controls.
Depending on where you live, applicable privacy law may provide additional rights regarding access or knowledge, correction, deletion, portability, restriction, objection, or opting out of certain sales or sharing. The Collective does not currently sell personal information or share it for cross-context behavioral advertising through this website.
10. Security
The Collective uses technical measures intended to reduce unauthorized access and abuse. Current measures include signed HTTP-only Creator Hub session cookies, CSRF protection for authenticated changes, OAuth state validation, request and feature-specific rate limits, server-side secrets, restricted access to Creator Hub and administrative routes, and admin-only access to the Creator Hub analytics dashboard.
Google and Microsoft refresh tokens and IONOS passwords stored by the Newsletter Sender are encrypted using authenticated encryption before being written to the account store. Gmail From-address verification codes are stored as cryptographic verification values rather than plaintext codes.
No internet service can guarantee absolute security. Members should use strong provider credentials, use app passwords where appropriate, protect their Discord and email accounts, and promptly disconnect an account if they believe its authorization is no longer secure.
11. Changes to this Policy
This Policy may be updated when Creator Hub features, Creator Resources such as Smart Link Builder, Newsletter Sender functionality, AI tools, integrations, operational practices, or legal requirements change. The current version is identified by the “Last updated” date above.
12. Contact
Privacy questions or requests relating to The Collective’s website or Creator Hub can be directed to The Collective administrators through the The Collective Discord server.
For information controlled directly by Discord, Alto, Google, Microsoft, IONOS, Gemini, or another external service, you may also need to use that service’s privacy controls or contact process.