// 01
What we collect
Account info — email, username, display name, avatar, bio, and favorite genres. Your password is hashed by Supabase and never visible to us.
Concert history — artist, venue, date, notes, volume rating, tags, and any photos or videos you attach. We also store whether a stub is verified and how — QR scan, GPS, or photo-library match.
Photos and videos — when you attach media to a stub, that file uploads to our storage.
Camera-roll scan — if you use this to find past concerts, we read only timestamps and GPS metadata from your photos, on your device. Nothing is uploaded.
Your photos never leave your phone during a camera-roll scan. We read only date and location metadata locally to find nights that look like concerts.
Location — used to verify you were at a show (one-time GPS check against the venue) and to surface nearby concerts.
Your GPS coordinate at verification is never stored. We run a distance check, discard the coordinate immediately, and save only the result — verified: yes or no.
Camera and microphone — only when you capture a moment in the app. We verify attendance by GPS, not by listening to music.
Messages — if direct messaging is enabled, messages are stored in our database. Not used for ads, not shared.
// 02
Who else sees your data
| Supabase | Our backend — database, auth, and file storage. US-region servers. |
| Spotify | Public artist and show listings only. Your data never goes to Spotify. |
| Ticketmaster | Public show listings only. Your data never goes to Ticketmaster. |
| setlist.fm | Setlist data only. Your data never goes to setlist.fm. |
No analytics or crash tools are running right now. Nothing is being sent to Mixpanel, Sentry, or anything similar. If that changes, we'll update this policy first.
// Coming soon — Stripe (payments) and Printful (merch) will be added later. This section will be updated when those ship.
// 03
Deleting your account
Go to Settings → Delete Account. Your profile, concert history, photos, messages, and follows are permanently deleted — not archived, not soft-deleted. It cannot be undone. Export anything you want to keep first.
// 04
Your rights
You can access, correct, or delete your data at any time. California residents have additional rights under CCPA. EU and UK residents have rights under GDPR. Email privacy@stubs.fm and we'll respond within 30 days.
Stubs is not for anyone under 13. If you think a child under 13 has created an account, contact us and we'll delete it.
// 05
Security
Row-level security means you can only access your own data. Media storage is scoped per user. Passwords are hashed and never visible to us. Security concerns: privacy@stubs.fm.
// 06
Changes
We'll update this page as the app evolves. Material changes get a notice in the app. Questions: privacy@stubs.fm.