SECURITY & PRIVACY

Security & privacy at AirCues

Last updated: 25 October 2026

Your releases are your work. Here, in plain words, is what we store, who can see it and how it's protected. Technical details are at the bottom.

In short

Your promo is private until you share it. Press kits (EPKs) have random, unlisted addresses. They are not in search engines, not in our sitemap and not listed anywhere.
Only people with the link can open it. You can change the link at any time, and the old one stops working.
We don't sell your data, and we don't use your music, images or texts to train AI.
Delete it and it's gone. Deleting a release or your account removes its files from storage.
Recipients aren't tracked across the web. No tracking cookies, no device fingerprinting.

What we store

Account: your email address, a securely hashed password (or your Google sign-in) and your active login sessions.
Your content: artist and release details, artwork, tracks, press photos, press texts and download files you upload.
Statistics: page opens, plays, downloads and link clicks for your releases. Visitors are counted with a daily- changing anonymous estimate; we only keep the referring site's domain, not full addresses.
No payment card details. When paid plans go live, payments are handled by Stripe.

Who can see what

Page	Who can open it
Press kit (EPK)	Only people who have the link. Unlisted, never indexed.
Personal (per-recipient) links	Lead to the same press kit. You see opens, plays and downloads on that link. Recipients see a short note that the link is personal.
Smart link (fan page)	Public, if you turn it on for a release. Off by default.
Artist page (/@handle)	Public, if you turn it on. Off by default.

Good to know: anyone who has a press kit link can forward it. If a link spreads further than you wanted, change it from your dashboard.

Inside AirCues: only the founder has admin access, and uses it only for support you ask for, or to handle abuse reports.

Where your data lives

App and database: Railway (managed Postgres).
Files: Cloudflare R2, encrypted at rest.
Email: Resend (sign-up confirmation, password reset).
Sign-in: Google, if you choose "Continue with Google".

These are our subprocessors. OurPrivacy Policylists them with what each one handles.

Crawlers & AI

Press kits carry a noindex tag and are excluded from the sitemap.
Our robots.txt blocks AI training crawlers — GPTBot, ClaudeBot, Google-Extended, CCBot, PerplexityBot, Bytespider, Applebot-Extended and others — from your artist pages (/@handle), press kits and smart links. AirCues's own pages — home, guides, legal, this one — stay crawlable so journalists and search tools can find us.
Smart links and artist pages remain indexable by regular search crawlers (Google, Bing, DuckDuckGo). They are your public fan pages. The AI block above only covers training crawlers, not search indexing.

Deleting your data

Delete a file, release or your whole account at any time.
Files are removed from storage when you delete them. Account deletion removes your data within 30 days; short-lived backups expire after 7 days.

Reporting a security issue

Emailsecurity@aircues.com. During the pilot we aim to reply within 48 hours. If we ever have a security incident affecting your data, we'll tell you without undue delay.

What we're working on

We're a small team in a pilot phase, and we'd rather be honest about what's next:

Signed, short-lived download links for large files
Two-factor sign-in (email code during pilot, authenticator app after)
Admin access log
External security review before public launch

Technical details

Accounts: Passwords hashed with Argon2id · server-side sessions · session cookie httpOnly, Secure,SameSite=Lax · rate limiting on sign-in and password reset · CSRF protection on all state-changing requests · single-use, time-limited password reset links · Google sign-in via OAuth.
Transport: TLS 1.2 and 1.3 (1.3 preferred) · HSTS with a two-yearmax-age · Content-Security-Policyupgrade-insecure-requests · HTTP automatically upgraded to HTTPS · all assets served over HTTPS.
Access control: EPK slugs and per-recipient tokens are cryptographically random · EPKs carry<meta name="robots" content="noindex"> and are excluded from the sitemap · smart links and artist landing pages are opt-in per release / per artist (default off) · stored URLs are normalised to HTTPS on save.
Analytics: No cookies for visitors · daily-rotating visitor hash (resets every 24 hours, cannot identify a person across days) · referrer domain only, never full URLs · no fingerprinting or cross-site tracking.
Storage: Cloudflare R2, encrypted at rest · deleting a file, release or artist purges the underlying R2 objects, not just the database rows.

← Back to the home page