Privacy

CAUGHT IT.LIVE(“we”, “us”) is a small, independently-run project. This page explains what we collect, why, and what you can do about it.

What we collect

When you sign in (email, Google, or GitHub), we store:

• Your email address
• A display name (suggested from your email or OAuth profile — you can change it)
• A URL slug for your binder (auto-suggested at signup — you can change it in account settings)
• Whether your binder is public or private (private by default)

When you log a gig, we store which setlist.fm setlist you logged, the artist it belongs to, and when you logged it.

That’s it. We don’t collect anything beyond what’s needed to run your binder.

Why we collect it

Purely to run the service you signed up for: keeping your account, remembering what you’ve caught, and — only if you choose to make your binder public — showing it to other people at a link you can share.

What’s public vs private

Your binder is private by default. If you switch it to public in account settings, your display name and everything in your binder (gigs, songs, rarity) become visible to anyone with the link. Your email address is never made public.

Cookies

We use one cookie: a session cookie from our authentication provider (Supabase), which keeps you signed in. It’s strictly necessary for the app to work. We don’t use tracking or advertising cookies, and our analytics (below) don’t use cookies either, so there’s no cookie banner. If that changes, this page will be updated first.

Who else sees your data

A small number of other services help run CAUGHT IT.LIVE:

• Supabase — hosts our database and handles sign-in.
• Vercel— hosts the app itself, and provides basic analytics (page views, coarse country, device/browser type). This is aggregate and cookieless — it doesn’t identify you individually or track you across sites.
• Spotify and setlist.fm— public music/gig data APIs we query on your behalf when you search for an artist or log a gig. We don’t send them your email, name, or account details — only the artist or song you’re searching for.

We don’t sell your data, and we don’t share it with anyone for advertising.

IP addresses

We briefly use your IP address, in memory only, to stop automated abuse of the artist-search and setlist-lookup endpoints. It’s never written to a database or log file, and it’s discarded automatically within minutes.

How long we keep it

We keep your data for as long as your account exists. Deleting your account deletes your profile and everything in your binder.

Your rights

Under UK GDPR you can ask to see, correct, export, or delete your data at any time. Account deletion isn’t yet self-service in the app — email privacy@caught-it.liveand we’ll action it, normally within a few days.

Children

CAUGHT IT.LIVEisn’t directed at children and we don’t knowingly collect data from anyone under 13.

Changes

If this policy changes materially, we’ll update the date at the top and, where reasonable, let signed-in users know.

Contact

Questions about this policy: privacy@caught-it.live.