Privacy Policy
DRAFT — not yet approved by the founder. This is a working draft for review by the founder and a lawyer. It is not final, and it may change before it is approved.
Handbill emails you when someone you follow announces a show near you or near a trip you've saved. Here's what we keep, why, who handles it for us, and how long we keep it, in plain language.
Last updated: [FOUNDER: date of approval]. Handbill is run by [FOUNDER: legal name of the person or company responsible for this service and its postal address].
What we store
Your email address, name, home city (and the coordinates and timezone we resolve it to, so we know when your local morning is), the people you follow and how far you'd travel for each, any trips you add, your email preferences, and the notifications we've sent you.
Requests to add someone. If you ask us to add a person we don't track yet, we keep the name you typed, any link you gave us, and whether you asked to follow them once they're added. The request is kept while it's open and deleted 30 days after we answer it.
Searches that find nothing. When a people search comes up empty we count the search words so we know who to add next. That count is not linked to your account, and it is deleted 90 days after anyone last searched for those words.
Usage records. We record, against your account, when you visit, which email links you use, whether a digest was opened, when you add a trip and when you unsubscribe, so we can tell whether Handbill is actually useful. Records of digest opens, link clicks, trips added and unsubscribes are kept until you delete your account; other usage records are deleted after 365 days. [FOUNDER: confirm that keeping those records for the life of the account is acceptable, or set a limit.]
The waitlist
While Handbill is invite-only, if you try to sign in without an invite and tick “Keep my address”, we keep that email address and the date you asked, and use it only to invite you. Without the tick we keep nothing. Signing in again with the box unticked removes it; so does being invited, and so does deleting an account you later make. Otherwise it is deleted 180 days after you asked.
What we use it for
Deciding what to put in your weekly digest and the occasional time-sensitive alert, running and protecting the service, and nothing else. We don't sell your personal information, we don't share it for advertising, and we don't use it to train AI models.
Cookies
We set one sign-in cookie, ea_session, when you sign in. It
keeps you signed in for up to 30 days, can't be read by page scripts, and
is only sent over a secure connection. While you connect Spotify or Google
Calendar we set one more short-lived cookie, for up to 10 minutes, to check
that the connection came back to you. We use no advertising or analytics
cookies.
Emails: opens and links
Weekly digests carry a tiny invisible image (a tracking pixel). When your email app loads it, we note that the digest was opened. Your email app may block it, and that's fine; nothing changes for you.
Ticket links in our emails go through a short redirect so we know which links get used — that's how we learn what's actually useful. We don't add tracking parameters to the ticket link itself.
We delete the redirect and open-tracking codes once every show an email mentioned is more than 90 days past.
Signing in and server logs
Sign-in links work once and expire after 15 minutes. To stop abuse we keep a scrambled (keyed hash) form of the internet address that asked for each link, never the address itself. Sign-in link records, and that scrambled address with them, are deleted 7 days after the link expires. [FOUNDER: confirm the 7-day period.]
Like most websites, our servers log the internet address and page of each request. We strip sign-in codes, email-link codes and search text out of those logs. [FOUNDER: confirm how long the hosting provider keeps logs.]
Spotify imports
If you import from Spotify we read your followed and top artists once, show them to you, and keep only the follows you confirm. We never store your Spotify token or listening data.
Google Calendar
If you connect Google Calendar, we read upcoming events on your primary calendar through Google's Calendar API — read-only, including events Google creates from Gmail (flights, hotel stays, trains). We store Google's event id and event type, the trip city, region and country, its dates, airport codes, flight or train departure and arrival times, a confidence score, a label of up to 80 characters taken from the event title, the connected account's email address and Google account id, and an encrypted token that lets us re-read your calendar. We never store event descriptions, attendees, organisers, meeting links, or your email messages.
Disconnect any time from Settings, or remove Handbill at myaccount.google.com/permissions. Disconnecting, or deleting your account, deletes all of it.
Handbill's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use this data to train models or share it with anyone.
Who handles your data for us
These processors handle data on our behalf, only to run Handbill:
- Fly.io hosts the app and its Postgres database in the United States.
- Resend delivers our email, so it sees your email address and the messages we send you.
- Tigris (object storage offered through Fly.io) holds our nightly database backups. [FOUNDER: confirm the backup provider and region once the bucket is set up.]
- Sentry receives a report when something breaks in the app, but only when error reporting is switched on. The report describes the error and the page or task it happened in; we set it up to leave out your email address, request contents and sign-in links. [FOUNDER: confirm whether error reporting is switched on, and Sentry's data region.]
- OpenStreetMap's Nominatim service turns the city you type into map coordinates. It receives the city text only, never your email or name.
- Spotify and Google, only if you choose to connect them, as described above.
Show information comes from ticketing and event sources such as Ticketmaster. We send them the names of the performers we track, never anything about you. Show details from Ticketmaster are deleted 30 days after the show, and we remove a source's listing promptly if that source asks us to take it down.
How long we keep things
- Your account, follows, trips and notification history: until you delete your account.
- A waitlist entry: until you are invited, untick the box, or delete your account, and never more than 180 days.
- Sign-in link records: 7 days after the link expires.
- Requests to add someone: while open, then 30 days after we answer.
- Empty-search counts (not linked to you): 90 days after last seen.
- Email redirect and open-tracking codes: 90 days after the shows in that email.
- Records of digest opens, link clicks, trips added and unsubscribes: until you delete your account. Other usage records: 365 days.
Your choices
Delete your account. Go to Settings and choose "Delete my account." It's permanent — your account, follows, trips, requests, notification history and any waitlist entry for your address are all removed.
Get a copy of your data. Go to Settings and choose "Download my data" for a JSON file of your account, follows, home, trips, requests and a summary of the emails we've sent you. You can download it once an hour. If you can't sign in, email us at hello@handbill.events from the address you sign in with and we'll send it to you. [FOUNDER: set the response time you commit to for emailed requests.]
Stop emails. Every email has a one-click unsubscribe link, and you can pause all email from Settings.
Age
Handbill is for people aged 16 and older. We don't knowingly collect information from anyone younger; if we learn we have, we delete the account.
Where Handbill is offered
Handbill is offered to people in the United States only, and your data is stored in the United States. California residents have the right to know what we hold about them, to have it corrected or deleted, and not to be treated differently for asking; we do not sell or share personal information as the California Consumer Privacy Act defines those terms. [FOUNDER: have counsel confirm the CCPA wording and whether any other state law applies. The service is not offered in the EU or UK, so GDPR is not addressed here; confirm that posture before anyone there is invited.]
Changes
If we change this policy in a way that matters, we'll email you before it takes effect. [FOUNDER: confirm the notice period.]
Questions
Email hello@handbill.events, or reply to any email we send you — a person reads it.