Privacy Policy

Effective: 26 October 2026

1. Information We Collect

When you create an account via Google OAuth, we receive your email address, display name, and avatar URL. We also collect data you provide through the service: subscriptions (artists, venues, shows you follow), votes (genre match votes, Spotify match votes), error reports you submit, and city requests (name, email, marketing opt-in preference).

2. How We Use Your Information

We use your information to manage your account, deliver personalised event feeds based on your subscriptions, and improve the service. We do not use your data for advertising.

3. Third-Party Services

  • Supabase — hosting, database, and authentication
  • Google — OAuth sign-in and Maps integration
  • Rybbit — self-hosted website analytics using random visitor and session identifiers. We measure pageviews, listening and ticket-link interactions, and successful sign-ins. Browser details, language, timezone, screen size and focused reading time help us distinguish automated traffic. IP addresses are used to determine approximate location and are not stored in our analytics events. Account names, email addresses, passwords and authentication tokens are not sent to Rybbit.
  • Spotify — embedded music player for artist previews
  • Last.fm — optional artist information lookup (no user data sent)

4. Cookies

We use authentication session cookies (httpOnly, sameSite: lax) to keep you signed in. First-party analytics cookies store random identifiers: a visitor identifier for up to one year and a session identifier that expires after 30 minutes without recorded activity. We do not use advertising cookies.

5. Data Sharing

We do not sell your personal data. Third-party services listed above receive only the information necessary for their function (e.g., Google receives your OAuth token during sign-in).

6. Your Rights

  • View your data — visit your profile page
  • Export your data — download a JSON file of all your data from your profile page
  • Delete your account — permanently delete your account and all associated data from your profile page
  • Opt out of marketing — uncheck the marketing opt-in when submitting a city request

7. Data Retention

Account data is retained until you delete your account. Event and venue data is public information and is retained independently of user accounts.

8. Children

finda.show is not directed at children under 16. We do not knowingly collect personal information from children under 16.

9. Changes

We may update this privacy policy from time to time. Changes will be reflected on this page with an updated effective date.

10. Contact

For privacy inquiries, contact us.