Last reviewed: 2016-12-18
tl;dr Bandcamp:
- collects an acceptable level of information.
- may share information too readily.
- may use aggressive/pervasive tracking
- will keep some or all of your information even if you delete it or close your account
- will keep some or all of your information even if you change it
- may be working with data brokers
Note that for some things, you can use false or no information.
- information you enter on your profile, including your name, location, and your website's URL; this information is optional and doesn't have to be real
- what's necessary to create an account, including an email and/or username, and password
- photos, if you upload them to Bandcamp
- your purchase history
- technical information, such as your IP address and browser details
- if you buy using PayPal, Bandcamp will not store your payment information, but may receive some data from PayPal about you and/or the payment
- your credit card details, if you add them to Bandcamp
- information gathered via analytics, including information collected by the third party providers of those services; this includes technical information about your browser and device, your IP address, cookie information, the pages you request, some geographical information, ISP, etc.
- information gathered via server logs, i.e. what your browser automatically sends to Bandcamp's servers when you use the service
- Bandcamp "may receive a confirmation when you open an email from Bandcamp", suggesting the use of tracking pixels.
- Bandcamp uses cookies, but does not put personally identifiable information in them. It also vows not to mix their data with data that identifies you.
- Bandcamp uses third party analytics, including Google Analytics and Quantserve, so they automatically share some information about you; these services also collect information of their own, and you're bound to their privacy policies.
- Aggregate, anonymised data may be shared with Bandcamp's partners.
- If you do business with a Bandcamp affiliate, the affiliate may receive payment and contact information about you, in addition to some personal information.
- Bandcamp contracts third parties, and may share information about you with them. This may include your name, address, email, and payment information. Third parties contracted in this manner have no right to further share your information.
- If you use "certain functionality or services", Bandcamp may share some of your personal information with bands. This includes email, country of residence, and postal code. Bands have no right to further share your information.
- Your profile is public by default, and can't be set private. This means you should consider the information in your profile as information exposed to the public. Some of your purchases may be hidden from your profile.
- Your email address may be shared with other users if you're considered contacts, and if you're using specific functionality where this makes sense.
- User information is one of the assets that may be shared or sold in the event Bandcamp buys or is bought, or if it goes bankrupt. This suggests Bandcamp may sell your information if it goes out of business.
- Bandcamp may "access, perserve, and disclose collected information" if they find it important to comply with the law, legal processes, and similar. This also applies in cases where Bandcamp seeks to enforce their TCUs, other agreements, protect their rights and/or property, protect their safety and that of their employees and users, or others. "This includes exchanging information with other companies and organizations for fraud protection and credit risk reduction."
- You are not required to provide some of the information the service may collect. This includes your profile, where you can make some things private, can use an arbitrary name or no name at all.
- "Bandcamp cannot guarantee the security of user account information." This clause safeguards Bandcamp in case their systems are compromised.
- Bandcamp lets you access and change your username, password, email, and user profile information.
- The privacy policy mentions you can "opt not to disclose information", assuming that it won't harm your use of the service.
- When you change some of your information, Bandcamp will keep "a copy of the unrevised information". This suggests changing information doesn't mean the old version gets deleted.
- You can request the deletion of your account, via [email protected]. However, Bandcamp states "that some information may remain" in their records, even if you delete your account.
- You can opt out of marketing communications, but not of important communications.
- Your information may be transmitted outside of your country of residence, due to how Bandcamp is hosted.
- Bandcamp may update their privacy policy, and vows to "notify you by posting an announcement" or via email. If you continue using the service, you're bound by the new policy.
- Information shared with third party analytics is usually non-identifying, but Bandcamp doesn't specify what it sends. However, this information can be used to fingerprint you, i.e. know that it's you by combining it with other things known about you, your device, and/or your habits.
- Bandcamp does not vow to delete all of your data after you delete it, and keeps a record of revised information.
- Bandcamp uses third party services that rely on pervasive tracking techniques.
- Bandcamp may or may not be using technologies that point to pervasive tracking.
- Because you need an account to use most functionalities of the service, your history of using it is part of their records.