Your life, your map, your terms.

What we hold for you

• The captures you share with us, encrypted at rest.
• The structured parse of each capture — event, date, place — so the wallet and map can render.
• Your profile, your friend graph, your anonymous handle and view count.

What we drop on the way in

• Passport numbers.
• Payment details and loyalty numbers.
• Anything that looks like an identity document.

What we never share or sell

• Your location history. Ever.
• Your travel data. Ever.
• Your friend graph.

The time-shift rule

Future events are never visible beyond your Inner Circle. Past events follow whatever audience you set. This is enforced in the database — there is no setting that turns it off.

1. Who we are

GigTrotter ("we", "us", "our") is a live-music and event tracking service operated by Mark Loughran, trading as GigTrotter. Questions about this policy can be sent to markloughran7@gmail.com.

2. Data we collect

• Account information: email, display name, avatar.
• Event data: captures you share with us (ticket screenshots, booking confirmations) and the structured metadata we parse from them (event name, date, venue).
• If you buy a ticket sold through GigTrotter: the order (event, ticket type, amount, time), the email address used at checkout, and the ticket codes issued to you. Card details go to Stripe and are never stored by us.
• Usage data: pages viewed, features used, device type, and IP address (anonymised after 30 days).
• Optional data: profile bio, friend connections, venue reviews, discussion posts.

3. How we use your data

• To provide and improve the GigTrotter service.
• To populate your wallet, map, and stats pages.
• To send service-critical notifications (e.g. event reminders you opted into).
• We do not sell your data. We do not serve behavioural advertising.

4. Data sharing

• With other users: only the data you explicitly share via your chosen audience circle (Vault, Inner Circle, Friends, or Open).
• Hosting: Vercel serves the website and apps.
• Database, sign-in and file storage: Supabase, in its EU (Ireland) region.
• Reading your tickets: the image you add is sent to Anthropic's API to extract the event details. It is used only to answer that request.
• Maps: your browser loads map tiles from Mapbox when you open the map.
• Payments: when ticket sales are switched on, Stripe will process card payments and pay promoters through Stripe Connect. We will never see your card details.
• With the promoter of an event you buy a ticket for: your name, the ticket type and the ticket code, so they can admit you at the door.
• Legal basis: Supabase, Vercel and Stripe process your data because it is necessary to provide the service you asked for (performance of a contract). Anthropic (ticket reading), Mapbox (maps) and any analytics or error reporting run under our legitimate interest in operating and improving the service; ticket reading only happens when you add an image. Our database is hosted by Supabase in the EU (Ireland). Vercel, Anthropic, Stripe and Mapbox may process data in the United States; where they do, the transfer is covered by the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses in each provider's data processing terms, or by the UK-US Data Bridge where the provider is certified.
• With law enforcement: only when required by law.

5. Data retention & deletion

We retain your data for as long as your account is active. You can export all your data as JSON at any time from Settings. You can delete your account at any time, which permanently removes all associated data within 30 days.

6. Security

Data is encrypted in transit and at rest. The ticket images you add are additionally encrypted with a per-user key, and access to every row in the database is restricted to its owner and the audience they chose, enforced in the database itself.

7. Your rights

• Access: view all your data within the app or export as JSON.
• Rectification: edit your profile and event data at any time.
• Erasure: delete your account and all associated data.
• Portability: export your data in a machine-readable format.
• Objection: contact us to opt out of any processing.

8. Children

GigTrotter is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, contact us and we will delete it.

9. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via in-app notification or email. Continued use of GigTrotter after changes constitutes acceptance of the updated policy.

10. Contact

For privacy-related questions, email markloughran7@gmail.com.