Privacy policy

Who is responsible

The controller for this website and the sawthem.live app is Daniel Brüggemann. Write to hello@sawthem.live about anything in this policy. The postal address is in the imprint.

This website

Vercel hosts this website. When you open a page, your browser sends technical data such as your IP address, the date and time, the page and your browser type. Vercel processes this data to deliver the website and keep it secure. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in a working and secure website.

The website sets no cookies. Your language comes from the address (/de for German), not from a cookie.

Website analytics

We count visits with Pirsch, a cookie-free analytics service from Germany. Pirsch does not store your IP address. It builds an anonymous identifier from your IP address and browser that changes every day, so we see how many people visit, not who they are. Query strings in links are not sent to Pirsch. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in knowing how the website is used.

Pirsch runs on the website only, never in the app.

The contact form

The contact form sends us your message, your email address and your name, if you enter it. It reaches our inbox as an email through [PENDING] SMTP provider and region. We use this data only to answer you. We keep it in our inbox, not in a database.

To stop abuse, the form carries a signed timestamp. It shows how long the page was open. The web server also counts messages per IP address and allows three per hour. The counter lives only in the server's memory and expires after one hour.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in answering your request. For requests about using the app: Art. 6(1)(b) GDPR. We delete the message once your request is settled. We keep it longer only where the law requires it.

What the app stores

Your account: your email address, your password (stored by Supabase only as a secure hash) and a username that is created automatically when you sign up and can also be used to sign in.

Your concerts: line-up, location and city, date, tags, notes and the photos you add. Photos are resized on your phone and stored in a private storage bucket. Only your account can read your data. There is no sharing and no public profile.

The app sends account emails, such as the sign-up confirmation and the password reset. It contains no analytics, tracking or advertising tools and keeps your login session on your device.

To run and secure the service, Supabase logs technical data about requests from the app, such as your IP address, device and app information, and the times you sign in.

If you tap a location, the app opens Apple Maps and passes the location name and city to Apple. Apple's privacy policy applies to that.

Legal basis: Art. 6(1)(b) GDPR, because we need this data to provide the app to you; for the technical logs, Art. 6(1)(f) GDPR, our legitimate interest in a secure service. Without an email address you cannot create an account.

Who processes your data

We use these service providers. They process data only on our behalf and under a data processing agreement (Art. 28 GDPR).

Supabase (Supabase Inc.): database, login and photo storage for the app, hosted in the EU (region eu-west-1, Ireland). Vercel (Vercel Inc.): hosting of this website. Pirsch (Emvi Software GmbH, Germany): cookie-free website analytics. [PENDING] SMTP provider and region: sending account and contact form emails.

Supabase and Vercel are US companies. Where they can access data from outside the EU, the transfer is based on the EU-US Data Privacy Framework or the EU standard contractual clauses (Art. 45 and 46 GDPR).

How long we keep it

App data stays until you delete your account. Contact form messages are deleted once your request is settled. The abuse counter expires after one hour. Vercel and Supabase keep technical logs only as long as needed for operation and security. Supabase backups are overwritten on a rolling basis, so deleted data also disappears from them after a short time.

Deleting your account

In the app, open Settings and tap Delete account. This deletes your login, all your concerts, bands, locations and tags, and all your photos right away. You can also ask us by email.

Your rights

You have the right to access (Art. 15 GDPR), correction (Art. 16), deletion (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Write to hello@sawthem.live.

Right to object: where we process data based on our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time for reasons arising from your particular situation (Art. 21 GDPR).

You can also complain to a data protection supervisory authority (Art. 77 GDPR), for example the one where you live.

We do not use automated decision-making or profiling.

Changes

We update this policy when the website or the app changes. The date at the top shows the current version.