Last updated:
Privacy statement
Social Together makes companion apps that a group of friends uses together at a music festival: rate the lineup, plan a schedule, see where your crew is, and share the experience. This statement covers the apps, the web app and this website. It describes what the app actually does today.
Who is responsible
The Social Together team is responsible for your data. Write to privacy@socialtogether.io with any question or request about your data.
What we store
Each festival has its own app and its own database. An account for one festival is separate from an account for another.
- Your account: your email address and password (stored as a secure hash, never readable by us), and the date you signed up.
- Your profile: your display name and, if you add one, a profile photo. Until you choose a display name, it is the part of your email address before the @. You can change it under Profile.
- What you do in the app: your ratings of artists and any comments on them, artists you skip, your schedule, the shows you have been to, “I’m watching” and “on my way” (with your expected arrival time), your posts, photos and reactions in the feed, chat messages and shouts to your crew.
- Settings: for example whether other people’s ratings are hidden until you rate, and genres you have muted.
- Notifications: the app keeps a list of your notifications (for example when a friend rates an artist or posts).
- Questions to the assistant: what you ask the assistant in the feed, and its answers.
- Your location, only when you share it: see the next section.
Some data stays on your device and never reaches us: your language, your map-sharing setting, your personal rating tags, and your sign-in details, which the app saves so you stay signed in (signing out removes them). On Android, if you allow notification access, the app reads which song Spotify is playing to show it to you; this stays on the phone.
We use no advertising, no analytics, no tracking and no crash reporting. Notifications are created by the app itself; we use no push notification service and store no device tokens.
Your location
- The app uses your location only while a screen that needs it is open (Now, Map, Venues, GO.), and shortly before a GO. alert.
- When you tap “on my way” to a show, the app follows your location in the background until you arrive or the trip times out, so it can tell your crew you have arrived. On Android you see a notification while this runs. The app never asks for “always” location access.
- Sharing your location with your crew is off until you turn it on. When it is on, the app stores one position for you, which is overwritten each time; we keep no location history. Turning sharing off deletes it.
- A shared position is also used to tell friends how far you are from them when they call you over.
Who can see what
The app is built for a group of friends, and everyone signed in to the same festival’s app can see your display name and profile photo, your ratings and comments, your schedule, the shows you have been to, what you are watching or heading to, your posts, photos, reactions, messages and shouts, and your location while you share it.
Only you can see your starred venues, your notifications and your questions to the assistant.
Your profile photo is stored at a web address that is not secret: anyone who has the link can open it.
Services we use
These companies process data on our behalf, only to run the app:
- Supabase stores the database, accounts, photos and profile photos, and sends sign-in emails.
- Anthropic (the Claude API) powers the assistant. When you ask the assistant something, your question and the latest feed posts (with display names) are sent to it; when you ask for recommendations, your ratings are. Anthropic does not use this data to train its models.
- Cloudflare hosts this website, the web app and the app downloads, and so sees visitors’ IP addresses and requests.
- Shorebird delivers updates to the Android app; the app tells it its version and platform.
- Google Fonts delivers the fonts the app uses, and so sees your IP address.
- In the web app, map tiles come from OpenFreeMap and map fonts from OpenMapTiles, which see your IP address. Directions open in Google Maps when you tap them.
Some of these companies are based in the United States. Where data leaves the EU/EEA, the transfer relies on the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.
Why we may use your data
- To provide the app you signed up for (GDPR article 6(1)(b)): your account, profile and everything you do in the app.
- With your consent (article 6(1)(a)): location, sharing your location, photos, and notification access. You can withdraw consent at any time in the app or in your phone’s settings.
- Our legitimate interest in running a secure service (article 6(1)(f)): technical logs at our hosting providers.
How long we keep it
We keep your data for as long as you have an account. Your shared location is deleted when you stop sharing. Your posts can be deleted one by one in the app. Logs at our hosting providers are kept according to their own policies, for a limited time.
Delete your account
Email privacy@socialtogether.io from the address you signed up with and tell us which festival app you use. Within 30 days we delete your account, profile, profile photo, ratings, schedule, posts, photos, messages, location and notifications, and confirm by email. Copies in our providers’ backups disappear when those backups expire.
Your rights
You have the right to see the data we hold about you, to have it corrected or deleted, to receive it in a portable format, to object to its use and to withdraw consent. Write to privacy@socialtogether.io. You can also complain to the data protection authority in the country where you live.
Age
The app is for people aged 16 and over.
Changes
When this statement changes, we update the date at the top. If a change matters for how your data is used, we tell you in the app.