Privacy Policy

What we collect

What we do not collect

Service providers

We share data with exactly two vendors, limited to what they need to operate the Service:

We do not sell, rent, lease, trade, or otherwise disclose your personal information to advertisers, data brokers, analytics companies, venues, ticketing platforms, or any other third party. We have no plans to do so.

International data transfers

Our vendors may process data in the United States and other jurisdictions. By using the Service, you consent to the transfer of your information to these jurisdictions, which may have different data protection laws than your country of residence.

How long we keep it

• Phone number: retained as long as your account is active. Deleted when you delete your account.
• Server logs: automatically purged on a rolling 30-day cycle by Vercel.
• Saved events / preferences (future): retained as long as your account is active.

Data security

We use commercially reasonable technical and organizational measures to protect your personal information, including encrypted connections (HTTPS/TLS), Supabase's built-in row-level security and encrypted storage, and access controls limiting who can read production data. However, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

Data breach notification

In the event of a data breach that affects your personal information, we will notify affected users as promptly as possible and no later than required by applicable law (72 hours under GDPR, “expedient and without unreasonable delay” under the New York SHIELD Act). Notification will be sent via the contact method we have on file for you.

Your rights

Regardless of where you live, you have the right to:

• Access — request a copy of all personal data we hold about you.
• Correction — request correction of any inaccurate data.
• Deletion — request deletion of your account and all associated data.
• Portability — receive your data in a machine-readable format (JSON).
• Objection / Restriction — object to or restrict certain processing activities.

To exercise any of these rights, email contact.alleymap@gmail.com. We will respond within 30 days, usually much sooner.

California residents (CCPA / CPRA)

Under the California Consumer Privacy Act and California Privacy Rights Act, California residents have additional rights including the right to know what personal information is collected, the right to delete, and the right to opt out of the sale or sharing of personal information.

We do not sell or share your personal information. We have never sold personal information and have no plans to do so. The rights described in the section above fully cover your CCPA/CPRA rights. To make a request, email contact.alleymap@gmail.com.

European residents (GDPR)

If you are located in the European Economic Area, UK, or Switzerland, our legal basis for processing your personal data is your consent (when you sign in) and legitimate interest (operating and improving the Service). You have all rights described above, plus the right to lodge a complaint with your local data protection authority if you believe your rights have been violated.

Children

The Service is not directed at children under 13 (or under 16 in the EEA). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us immediately and we will delete it.

Do Not Track

We honor Do Not Track browser signals. Since we do not use any third-party trackers or advertising networks, there is nothing to disable — you are not tracked regardless of your DNT setting.

Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes (e.g., collecting a new category of data or adding a new vendor), we will update the effective date at the top and provide notice to signed-in users before the changes take effect. Your continued use of the Service after changes are posted constitutes acceptance.