Home

Privacy policy

Last updated: August 6, 2026

ConcertPrep is a non-commercial project. It collects the minimum it needs to work, shows no ads, runs no third-party analytics, trackers, or session recording, and never sells or shares your personal data. It does rely on a few infrastructure providers (hosting, database, email) to run — those are processors that act on our instructions, not advertisers or trackers.

What we collect

  • Your account — if you sign in with Google, we receive your name, email address, and profile image from Google. If you sign in with Apple, we receive your name and an email address — which is Apple's private relay address if you chose to hide yours, in which case we never see your real one. You can also add a passkey to an existing account; we store its public key and credential id, never a biometric, which never leaves your device. Browsing and predictions work fully without an account.
  • Sign-in & session records — to keep you signed in and to protect your account, each session stores a session token, your IP address, your browser's user-agent string, and timestamps. Email-link sign-in — which the app does not currently offer, though the capability exists in our backend — would also create a short-lived verification record (it expires in minutes and stores only a hashed token, never the plain link).
  • Your follows — the artists you choose to follow (stored as an artist identifier and name).
  • Your concert log — shows you mark as attended (stored as show references and dates), plus any ratings and notes you write.

We don't collect your location, contacts, or browsing history, and we don't build an advertising profile of you.

Cookies & on-device storage

  • A theme preference cookie — remembers your display theme so the page renders correctly on first paint.
  • Session cookies — keep you signed in, set only when you sign in. These include a short-lived (five-minute) signed cache of minimal session data so we don't re-check the database on every page.
  • Connect cookies — if you start connecting a streaming service, two short-lived cookies carry the security values that prove the sign-in you get back is the one you started. They expire within minutes and are set only when you tap Connect.

A few conveniences also live in your browser's own storage and are never sent to us: the names of artists you've recently viewed (so the home screen can show them), a flag remembering that you've acknowledged the "you're leaving for a ticketing site" notice, and your scroll positions as you navigate. Clearing your browser data removes all of it.

No advertising or tracking cookies, ever.

Where your data lives

The app runs on Cloudflare Workers. Your account, sign-in/session records, follows, and concert log are stored in a Neon (Postgres) database. Neon keeps backups and may keep short-lived database branches for reliability, so when you delete something it is removed from the live database right away but can persist in an encrypted backup until that backup ages out.

Setlist data itself comes live from setlist.fm and is held only in a short-lived server cache (Cloudflare KV / Cache) — ConcertPrep does not keep a permanent copy of it, and your concert log stores references to shows, not the setlists themselves. Requests to setlist.fm and other data sources are made by our server, not your browser, so those sources never see your IP address or identity. Album cover images are the one exception: they are loaded straight from the Cover Art Archive (run by the Internet Archive), so your browser contacts them directly and they can see that request — we send no referring page address with it. Song-meaning summaries are drawn from Wikipedia (attributed) and may be condensed using Cloudflare's AI on that sourced text only — never on your data.

Playlist export

If you choose to export a setlist to a streaming service, that is the one feature where ConcertPrep sends music information to a third party on your behalf. On this website, connecting Apple Music loads Apple's MusicKit script in your browser and opens Apple's own sign-in window, so Apple sees that request and your Apple ID sign-in under Apple's privacy policy — this is the only way Apple allows a website to obtain permission, and the script loads only after you tap Connect, never on an ordinary page view.

In the ConcertPrep iOS app the same feature works differently, because Apple provides apps a system-level route a website does not get. Connecting asks iOS for permission through Apple's own prompt — the app never sees your Apple ID or password, and no browser is involved. Apple then issues a token identifying your music account, which the app sends to our server and which we store encrypted exactly as described below. Disconnecting is on this website for now; the app can connect but not yet disconnect.

When you export, the song titles and the artist's name from the forecast or setlist are sent to the streaming service so it can find the tracks, along with a title and description for the playlist itself. The playlist is created in your own account — not ours. We store only a reference to it (which service, which show or artist, the playlist's id), never the songs. The access and refresh tokens linking your account are stored encrypted, are never included in your data export, and are deleted when you disconnect or delete your account. Disconnecting removes the link on our side; to revoke an Apple Music authorization entirely, use your Apple ID settings.

Exporting to YouTube Music

The YouTube Music export uses YouTube API Services. By using it you agree to YouTube's Terms of Service, and Google's handling of the data it receives is governed by the Google Privacy Policy.

Google's permission screen will say "Manage your YouTube account", which sounds broader than what happens. YouTube publishes no narrower permission that still allows creating a playlist, so that is the only one we can ask for. What ConcertPrep actually does with it is look up public videos and channels to match your song titles, then create a playlist and add those songs to it — we never read your library, your history, your subscriptions, or your own videos, and we never delete or change anything that was already in your account.

We store the encrypted access token and, so a repeat export doesn't re-do the same lookups, which YouTube video matched each song title. Those matches are deleted or refreshed within 30 days, and they describe songs, never you.

You can revoke access at any time — either with Disconnect in ConcertPrep, which deletes the token on our side, or from Google's security settings page, which withdraws the permission at Google.

Logs & security

Cloudflare, as our hosting provider, processes standard request and security logs (which can include IP addresses and user-agent strings) and network-error reports to keep the service reliable and to prevent abuse. These are operational security logs, not analytics — we don't use them to profile or track you, and we keep them no longer than needed.

Crash reports (mobile app)

The ConcertPrep mobile app uses crash reporting (Sentry) so a crash can be fixed rather than guessed at. When the app crashes or hits an error, it sends the error, where in the code it happened, and basic device and app-version information. It is deliberately configured to send no personal data, no session replay, and no request or response bodies, and it drops concert data before anything is sent. It is not analytics: we cannot see what screens you visit or what you search for. The website does not use crash reporting.

Third parties

  • Google — sign-in, under Google's own privacy policy. When you're signed in, your browser loads your profile image directly from Google's servers, so Google sees that image request.
  • Apple — Sign in with Apple, under Apple's own privacy policy. Apple sees that you signed in to ConcertPrep. If you choose to hide your email, Apple gives us a private relay address instead of your real one and we have no way to resolve it. Separate from Apple Music below, which is only about playlist export.
  • Cloudflare & Neon — hosting and database infrastructure that process data on our behalf.
  • MusicBrainz & the Cover Art Archive — album and release information, under MusicBrainz's open (public-domain) licence. Album details are fetched by our server, but cover images load directly from the Cover Art Archive, hosted by the Internet Archive, so it sees those image requests.
  • Resend — our email provider, for rare-song alerts and for the email-link sign-in the app does not currently offer. Where it is used it receives your email address and the message; never used for marketing.
  • Sentry — crash reporting in the mobile app, as described above. Receives errors and device information, never your account data or concert data.
  • setlist.fm — the source of concert data; it receives our server's queries, never your personal data.
  • Ticketmaster — the source of upcoming tour dates; it receives our server's queries, never your personal data.
  • Apple Music, YouTube & TIDAL — only if you connect one to export a playlist. Connecting Apple Music runs Apple's MusicKit script in your browser, so Apple sees your sign-in directly; the others use a normal sign-in redirect. Each then receives the song titles being exported and creates the playlist in your own account, under its own privacy policy. Nothing is sent to any of them unless you connect and export. The YouTube export uses YouTube API Services — see Exporting to YouTube Music above.
  • Genius, MusicBrainz & Wikipedia — sources for song details and meanings; they receive our server's queries, never your personal data.

Links to ticketing, lyrics, or setlist.fm pages open directly on those sites (with noopener noreferrer). Once you follow such a link, the destination site sees your browser's request under its own privacy policy — we don't track those clicks.

To help search engines find artists, the app publishes a public sitemap listing the artist identifiers that people follow. That list is an aggregate of identifiers and is not linked to you or any individual account.

Your data, your call

You can manage your own data from your profile:

  • Export — download a JSON copy of your profile, follows, concert log, any streaming accounts you have connected (which service and what you authorized — never the access tokens themselves), and a reference to each playlist you have exported (which service, which show or artist, how many tracks — never the songs).
  • Delete account — permanently removes your account, sign-in/session records, follows, and concert log, and signs you out everywhere. For your protection, deletion and export require that you've signed in recently. As noted above, deleted data clears from the live database immediately but can linger in an encrypted backup until it ages out.

Questions, or trouble using those controls? Email concertprep@adnanreza.com from the address on your account.

Changes

If this policy changes in a way that matters, the date above changes with it. Continued use after a change means the new version applies.

See also the terms of use and our security & disclosure policy.