1. Overview and controller
This Privacy Policy explains how the individual sole operator of Stage Heat ("Stage Heat", "we", "us") processes personal data when you use our mobile apps, hosted web app, and API (the "Service"). It applies to users in the European Union, European Economic Area (EEA), United Kingdom, United States, and other regions where we make the Service available.
Data controller: the individual sole operator of Stage Heat. Contact legal@stageheat.app for privacy and data protection requests. For general support use contact@stageheat.app.
We process personal data as described below and in our Terms of Service. This Policy does not apply to third-party websites or services you reach through links (for example ticket sellers or streaming platforms).
2. Categories of data we process
Account and identity: Firebase Authentication user identifiers; email address and password hash if you register with email; whether you use an anonymous (guest) or persistent account; profile or display fields you provide; campaign (UTM) tags and referring site name from your first visit when you allow analytics storage (stored on your account for product attribution, not ad targeting).
Usage and device data: on the web app, Firebase Analytics events (such as screen views, feature use, and app opens), device and browser type, operating system, app version, language, and approximate location derived from IP where Analytics collects it after you Accept cookies. On the iPhone and Android apps we don't use Firebase Analytics; we only collect crash reports through Firebase Crashlytics (see Section 5).
Location (only if you tap "Use my location"): on the web app, your browser asks for permission and, if you allow it, gives the app your device's current coordinates (latitude and longitude). The app sends those coordinates directly from your browser to BigDataCloud (see Section 5) to look up the name of your city. As with any web request, BigDataCloud also receives your IP address, your browser's user agent, and our site address (www.stageheat.app) as the requesting origin. The coordinates are not sent to Stage Heat's servers and we do not store them; we keep only the resulting city name and country code, as described below. Analytics records only whether the lookup succeeded, timed out, or was denied, never your coordinates or the detected city. If you deny the prompt or type a city instead, no coordinates are collected.
City you search for: the city you type or that is detected (and its country code) is saved in your browser's local storage on your device so Discover remembers it, and it is sent to our API with Discover and concert requests to find setlists and shows for that city. It is not saved to your account, but it can appear in our server request logs (Section 6), and our concert caches may keep city names as search keys without linking them to you.
Streaming connections: OAuth access and refresh tokens, token expiry, provider user IDs, and display names or account labels returned by Spotify, Apple Music, YouTube, or other supported streaming services when you connect them.
App activity: setlist and artist searches; concert and tour listings viewed; artists you follow; playlist export and sync actions; entitlement tier (free vs Stage Heat Plus); bar or venue playlist Proposals you create and related metadata; API request logs (timestamps, endpoints, and hashed or truncated identifiers for security).
Public Proposal pages: if you use shareable Proposal links (for example /p/… on the web app), the playlist suggestion content you choose to publish may be visible to anyone with the link.
Notifications: tour or show notification preferences; device push tokens (for example for Firebase Cloud Messaging when you enable push); delivery status where needed to operate notifications.
Payments: if you subscribe to Plus, Stripe, Apple, or Google process payment and billing details. We receive subscription status, product identifiers, and transaction or customer references—not full card numbers.
3. Purposes of processing
Provide the Service: authenticate you; store follows and preferences; connect streaming accounts; build and sync playlists; show Discover and setlist content; fill in your city when you ask us to use your location; deliver Proposals to venues; send notifications you opt into; enforce free vs Plus limits.
Security and integrity: detect abuse, rate-limit API use, investigate incidents, and protect users and infrastructure.
Improve Stage Heat: understand aggregate feature usage via Analytics and fix defects.
Communications: respond to emails and support requests.
Legal and compliance: comply with law, respond to lawful requests, and enforce our Terms.
4. Legal bases (EEA/UK GDPR)
Where the GDPR applies, we rely on the following bases: (a) Contract—processing needed to provide the Service you request (account, streaming sync, Plus, Proposals you submit); (b) Legitimate interests—security, fraud prevention, service improvement, and (outside the EEA/UK) product analytics balanced against your rights (you may object as described in Section 10, including via "Cookie settings" in the web footer); (c) Consent—in the EEA/UK, analytics run only after you Accept on our cookie banner; also the optional "Use my location" lookup (you consent by tapping the button and allowing your browser's or device's location prompt), or optional marketing if we offer it in the future; (d) Legal obligation—records we must keep by law.
You can withdraw consent to location access at any time by changing the location permission for www.stageheat.app (or the app) in your browser or device settings, or simply by typing your city instead. You can change or withdraw analytics cookie consent anytime via "Cookie settings" in the footer (see Section 8).
We do not use automated decision-making that produces legal or similarly significant effects solely without human involvement.
5. Where data is stored and processors
Primary Service data (accounts, follows, OAuth tokens, Proposals, and PostgreSQL application data) is hosted in Microsoft Azure, West Europe (WEU) on Microsoft Azure.
Firebase Authentication, Firebase Cloud Messaging (push), Firebase Analytics, and Firebase Crashlytics are provided by Google under project playsync-a39e4. On the hosted web app, Firebase Analytics runs only after you Accept on our cookie banner (Google Consent Mode). We do not enable Firebase Analytics collection on the iPhone and Android apps. On the iPhone and Android apps, Firebase Crashlytics collects crash reports: the error and where in the app it happened, the app version, device model, operating system version, the screen you were on, and a random installation ID created by Crashlytics. Crash reports don't include your name, email, Stage Heat account ID or advertising identifiers. Crashlytics is off on the web app and in test builds. Google may process data in the United States and other countries under Google's terms and, where required, Standard Contractual Clauses (SCCs) or equivalent transfer tools.
When you subscribe to Stage Heat Plus, the campaign tags you arrived with (utm_source, utm_medium, utm_campaign, utm_content, and utm_term) are sent to Stripe with your checkout session so we can tell which campaign led to a subscription. No ad networks receive that data from Stage Heat.
When you connect YouTube, we use Google OAuth and YouTube Data API access only to operate features you choose (such as creating or updating playlists from setlists). We do not use Google user data for advertising or sell it. Our use is limited as described in Google's API Services User Data Policy.
Other processors include: payment providers (Stripe, Apple App Store, Google Play); setlist.fm when you search setlists; Ticketmaster when you view tour or ticket metadata; and email or infrastructure vendors under contract.
Concert and music lookups: when you search Discover or concert listings by city or artist, our API may query Songkick, TicketSwap, Bandsintown, and Deezer (and related public pages they publish) to find shows and related music metadata. Those requests send city, country code, artist, or event search terms only—not your Stage Heat account id, email, or other user identifiers. Responses may be cached on our servers under city or artist keys without linking them to you.
Apple MusicKit JS (web): when you connect Apple Music on the hosted web app, your browser loads Apple's MusicKit JavaScript from js-cdn.music.apple.com and talks to Apple to obtain a Music User Token. That script is not loaded until you start an Apple Music connect flow. We send the resulting token to our API so we can sync playlists you request; Apple processes the authorize flow under Apple's terms.
Google account photo (web): if you sign in with Google and your Google profile includes a photo URL, the app may load that image from Google's googleusercontent.com (or related Google media hosts) in your browser so we can show your avatar. The image request goes from your browser to Google; we do not re-host the photo on Stage Heat servers.
Web fonts and Flutter rendering: Oswald and DM Sans are bundled with the app and are not fetched from fonts.gstatic.com at runtime. Flutter's CanvasKit renderer is served from www.stageheat.app (same origin) rather than from Google's gstatic CDN. Firebase Authentication and Firebase Analytics may still load scripts or resources from Google domains (including gstatic or googleapis) as part of those Google services, as described above.
Location lookup (BigDataCloud): when you use "Use my location" on the web app, your browser sends your coordinates directly to BigDataCloud Pty Ltd (Adelaide, South Australia) through its free client-side reverse-geocoding service (api.bigdatacloud.net), which returns a city name. BigDataCloud is not our processor: it receives the request directly from your browser and decides for itself how to use it. It states that it does not link location data to identifiable individuals and that it uses the pairing of coordinates and IP address, in aggregated form, to improve its IP geolocation services. See BigDataCloud's Privacy and Cookie Policy at https://www.bigdatacloud.com/privacy-and-cookie-policy.
In our native iOS and Android apps (where available), the city is looked up instead with the operating system's built-in geocoding service, which sends the coordinates to Apple (iOS) or Google (Android) under their own privacy terms.
6. Retention
We keep account, follow, streaming connection, and Proposal data while your account is active or as needed to provide the Service. OAuth tokens are deleted when you disconnect a provider or delete your account, subject to short backup retention.
Server and security logs are typically retained for up to 90 days unless a longer period is needed for security investigations or legal holds.
Crash reports are kept for up to 90 days.
Location: Stage Heat does not store your coordinates; the app holds them in memory only for the few seconds needed for the lookup. The resulting city and country code stay in your browser's local storage until you change city or clear site data for www.stageheat.app. When the city is sent with Discover or concert requests, it can appear in our server request logs for the period above. BigDataCloud's retention is governed by its own policy.
Analytics data is retained according to Firebase/Google settings (generally months, configurable in our project) for product analytics.
Billing records may be kept for the period required by tax and accounting law (often 6–10 years depending on jurisdiction).
7. Sharing and disclosure
We share personal data with service providers who process it on our instructions under data protection agreements, including cloud hosting, authentication, analytics, payment, and concert or setlist data partners when you use those features.
Public Proposal links may expose proposal content you publish to viewers with the link; do not include sensitive personal data on public pages.
We do not sell your personal information. We may disclose data if required by law, court order, or to protect rights, safety, and security of Stage Heat, users, or others.
If we undergo a merger, acquisition, or asset sale, data may transfer subject to this Policy and notice where required.
8. Cookies and similar technologies (web)
The hosted web app uses cookies and local storage as follows:
_ga and _ga_<id>: Google Analytics cookies (typically up to 2 years). In the UK/EEA (and Switzerland for our Consent Mode region list) these are set only after you Accept analytics on our cookie banner. Outside those regions we rely on legitimate interests for analytics and keep ads signals denied; you can still opt out via Cookie settings.
Firebase Authentication local storage: strictly necessary for sign-in and session security.
stageheat_consent_v1: stores your analytics cookie choice (Accept or Reject).
stageheat_first_touch_utm_v1: first-touch campaign tags (utm_source / medium / campaign / content / term). In UK/EEA banner regions we keep these in memory until you Accept analytics, then persist them; elsewhere they are stored on first visit with UTMs.
Discover city cache: your last Discover city / country code and a short-lived results cache on your device so the app can show your city without asking for location again.
stageheat_plus_checkout_pending_v1: short-lived marker while Stripe Checkout is open so we can attribute a successful return (cleared after success or cancel). Campaign tags from first-touch UTMs may also be sent to Stripe with your checkout (see Section 5); no ad network receives them.
In the UK/EEA we show a cookie banner on first visit when no choice is stored. Accept enables analytics storage; Reject keeps it denied and clears existing _ga cookies for stageheat.app. Change your choice anytime with "Cookie settings" in the web footer. You can also control browser cookies; blocking strictly necessary storage may limit sign-in or web functionality. We do not load advertising pixels.
9. International transfers
Personal data may be transferred to countries outside your own, including the United States, where data protection laws may differ.
For transfers from the EEA, UK, or Switzerland to countries without an adequacy decision, we implement appropriate safeguards, including the European Commission's Standard Contractual Clauses (2021/914) and UK International Data Transfer Addendum where applicable, supplemented by technical and organizational measures (encryption in transit, access controls, and vendor assessments).
BigDataCloud is based in Australia and states that its data is stored in Australia and the United States. The European Commission has not adopted an adequacy decision for Australia, and we have no contract with BigDataCloud for its free service, so no Standard Contractual Clauses apply to it. Your browser sends the request only when you choose "Use my location" and allow the location prompt; that transfer relies on your explicit consent (Article 49(1)(a) GDPR). Data protection laws in Australia and the United States may not give the same protection as in the EEA or UK. If you do not want this, type your city instead.
You may request a copy of relevant transfer safeguards by contacting legal@stageheat.app.
10. Your privacy rights
Depending on your location, you may have the right to: access your personal data; rectify inaccurate data; erase data ("right to be forgotten") in certain cases; restrict processing; data portability; object to processing based on legitimate interests (including profiling for direct marketing if we ever use it); and withdraw consent where processing is consent-based without affecting prior lawful processing.
To exercise rights, email legal@stageheat.app from the address linked to your account or describe your request clearly. We may verify your identity before responding. We aim to respond within one month as required by GDPR, or within applicable US state timelines.
If you are in the EU, EEA, or UK, you may lodge a complaint with your local data protection supervisory authority.
11. California and US state privacy
California residents: in the preceding 12 months we may collect identifiers, commercial information (Plus status), internet activity (Analytics and logs), geolocation (approximate from IP, and the city you enter or that is detected when you use "Use my location"; Stage Heat does not collect precise geolocation on its servers), and audio/visual information only as reflected in playlist metadata you process through the Service. We collect data for the purposes in Section 3. We do not sell or share personal information for cross-context behavioral advertising as defined under California law. We do not use sensitive personal information for purposes requiring a "limit" opt-out beyond providing the Service.
You may request access, deletion, or correction by contacting legal@stageheat.app. We will not discriminate against you for exercising privacy rights. Authorized agents may submit requests with proof of authorization where permitted by law.
Residents of other US states with similar privacy laws may use the same contact channel; we honor applicable rights to the extent required.
12. Children
The Service is not directed at children under 13 (or under 16 where local law requires for information society services). We do not knowingly collect personal data from children. If you believe a child provided data, contact legal@stageheat.app and we will delete it where required.
13. Security
We use technical and organizational measures appropriate to the risk, including encryption in transit (TLS), access controls, and secure storage of OAuth tokens. No method of transmission or storage is completely secure; please use a strong password and protect your devices.
14. Google user data (YouTube)
Data accessed: when you choose to connect YouTube, Stage Heat requests the Google OAuth scope https://www.googleapis.com/auth/youtube. With that access we: (a) read your YouTube channel id and channel title to show connection status; (b) search YouTube for videos that match songs from a setlist you export; (c) list your YouTube playlists and read playlist item titles and channel titles when you use playlist sync that includes YouTube; (d) create a private YouTube playlist titled from your setlist (description: "Created by Stage Heat"); and (e) add the matched videos to that playlist. We store OAuth access and refresh tokens, token expiry, your YouTube channel id, and display name so the connection can continue until you disconnect.
Use: we use this Google/YouTube data only to provide YouTube connect, setlist export to a YouTube playlist, and playlist sync features you initiate. We do not use it for advertising, we do not sell it, and we do not use it to train AI models.
Sharing and transfer: we do not share Google user data with third parties except as needed to run the Service—primarily calling Google OAuth and YouTube Data API endpoints you authorize, and storing connection records on our Azure-hosted API and database.
Protection: OAuth tokens are stored encrypted at rest in our PostgreSQL linked_accounts table (AES-256-GCM). Tokens and API calls are transmitted over HTTPS (TLS) in transit.
Retention and deletion: we keep YouTube OAuth tokens and related connection metadata while your YouTube account remains connected to Stage Heat (or until your Stage Heat account is deleted), subject to short backup retention. Cached YouTube search matches (artist/title to video id) are deleted or refreshed within 30 calendar days per the YouTube API Services Developer Policies. You can disconnect YouTube in the app under Accounts (Disconnect); we revoke the OAuth token and remove connection data we store. You can also revoke Stage Heat's access at https://myaccount.google.com/permissions. To request deletion of Google/YouTube-related data we hold, email contact@stageheat.app or legal@stageheat.app.
Stage Heat's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. See https://developers.google.com/terms/api-services-user-data-policy, the YouTube Terms of Service https://www.youtube.com/t/terms, and the Google Privacy Policy https://policies.google.com/privacy.
15. Changes and contact
We may update this Policy. We will post changes in the app with a new "Last updated" date and provide additional notice for material changes where law requires.
Privacy and data protection: legal@stageheat.app. General inquiries: info@stageheat.app. Support: contact@stageheat.app.