Privacy policy
Who looks after your data
The data controller of this site is CopperFrame Studio. For any privacy matter, including data subject requests, use the contact at the end of this page. This policy applies to the Rhythm Nexus stage portal and follows the Brazilian General Data Protection Law (LGPD, Law 13.709/2018). It does not cover the game or Steam, which have their own rules.
What we collect
When you create an account: driver name, email, password, stored only as a hash, and whether you are under 16, with your parent or guardian's email in that case. When you use the site: the account creation date, your stages, likes and reports, including the text you write in them. When you publish: the stage file, music, cover, title, artist and description. For security: your IP address is used to limit attempts, and our database keeps only an irreversible digest of it, not the IP itself.
Why we use it and our legal basis
Creating and keeping your account, publishing and delivering stages, and sending confirmation and password recovery emails are needed to provide the service you asked for (performance of a contract). Preventing abuse, protecting accounts and moderating content are based on legitimate interest. When needed, we also process data to comply with the law or to defend rights in legal proceedings.
What is public
Your driver name, account creation date, stages and their details are visible to anyone, and stages can be downloaded. Your email and your reports do not appear on the site. Do not put personal data in titles, descriptions or covers.
Who we share it with
We do not sell data or show advertising. We use Cloudflare to host the site, database and files, and Resend to send email, which receives the recipient address and the message content. These providers act on our behalf. We may also hand data to authorities when the law or a court order requires it.
International transfers
These providers operate outside Brazil, and your data may be processed in other countries, including the United States. These transfers are needed to provide the service and follow the contractual safeguards offered by these providers.
How long we keep it
Account data, stages, likes and reports are kept until you delete them or delete the account. A session lasts up to 30 days, or until you sign out. The confirmation link is valid for 48 hours, the parent or guardian authorization link for 7 days, and the new password link for 1 hour. Attempt counters expire within minutes or hours and are then discarded. When you delete your account, all of this is removed from the site immediately; it may remain in automatic backups for up to 30 days. We may keep what the law requires or what is needed to defend rights in legal proceedings.
Cookies
We use two cookies, neither for advertising: "sessao", which keeps you signed in for up to 30 days, and "lang", which stores your chosen language for 1 year. We do not use third-party analytics or trackers, so there is no consent notice.
Your rights
You may request confirmation of processing, access, correction, anonymization, blocking or deletion of unnecessary data, portability, information about sharing and review of automated decisions, and you may object to processing based on legitimate interest. In My account you can change your password and delete your account. For other requests, use the contact below. We may ask you to confirm that the account is yours. You may also complain to the Brazilian data protection authority (ANPD).
Automated decisions
A stage is automatically hidden, until a person reviews it, when it receives copyright reports from 3 people or reports from 5 people in total. If this happens to your stage, you can ask for a review through the contact below.
Security
We use encrypted connections, hashed passwords with an individual salt and a secret kept outside the database, plus attempt limits and single-use links. No system is fully secure: use a password you do not reuse on other sites. If an incident may cause relevant risk or harm, we will notify the ANPD and the people affected, as the law requires.
Children and teenagers
There is no minimum age to use the site and download stages. To create an account, anyone who says they are under 16 gives the email of a parent or guardian, who receives a request to authorize or refuse. The account stays inactive until authorized and is deleted if they refuse or do not answer within 7 days. After authorization, their email stays linked to the account. We collect only what is needed, show no advertising and do not build behavioral profiles. Do not use your real name as your driver name. Parents and guardians can request access to the data or removal of the account through the contact below.
Changes to this policy
We will publish any change here and, if it is important, also let you know by email. Version of October 30, 2026.