Privacy Policy

Rehearsal Portal ("EnsaioFacil") · Last updated: September 6, 2026

Rehearsal Portal ("we", "our", "the Service") is a multitrack rehearsal player for musical groups, bands, and worship ministries. This Privacy Policy explains what data we collect, why, and how it is protected when you or your organization use the Service at ensaiofacil.com.

1. Data we collect

Account data: email address and a securely hashed password (never stored in plain text) for each user you create.
Organization data: your organization's name and the setlists/song folder references you create inside the app.
Google Drive OAuth tokens: if your organization's admin connects Google Drive, we store an encrypted access token and refresh token so the Service can list and stream your own multitrack files on your behalf.

2. How we use Google user data

When your organization connects Google Drive, Rehearsal Portal requests read-only access (drive.readonly) strictly to:

List the folders and audio files inside the Google Drive location your admin configures as the "multitracks root folder".
Let your browser stream those audio files directly from Google Drive's servers using a short-lived access token — Rehearsal Portal's own servers never download, store, cache, or proxy your audio files.

We do not use Google user data for advertising, do not sell it, and do not share it with third parties except Google itself (to make the necessary Drive API calls) and our infrastructure providers listed below, strictly to operate the Service. Rehearsal Portal's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3. Where data is stored

Application hosting: Cloudflare Pages (Cloudflare, Inc.).
Database: Upstash Redis, storing account, organization, setlist, and encrypted OAuth token records.
Your multitrack audio files themselves are never stored by us — they remain exclusively in your organization's own Google Drive.

Google OAuth access and refresh tokens are encrypted at rest (AES-256-GCM) before being written to our database, and are only ever decrypted in memory, per-request, to make an authorized Drive API call on behalf of your organization.

4. Data isolation between organizations

Rehearsal Portal is multi-tenant: every user, setlist, and Google Drive connection is scoped to a single organization ID. Application logic enforces that a user can never read or act on another organization's data, and Google Drive tokens are never mixed or shared across organizations.

5. Your controls

An organization admin can disconnect Google Drive at any time from the Storage Providers panel, which deletes the stored tokens immediately.
You can also revoke Rehearsal Portal's access directly from your Google Account permissions page.
To request deletion of your account or organization's data, contact us using the email below.

6. Contact

Questions about this policy or your data? Contact: [email protected]