Privacy

CAUGHT IT.LIVE (“we”, “us”) is a small, independently-run project operated by Joseph Reddie, trading as CAUGHT IT.LIVE, not a registered company. This page explains what we collect, why, and what you can do about it.

What we collect

When you sign in (email or Google), we store:

• Your email address
• A display name (suggested from your email or OAuth profile — you can change it)
• A URL slug for your binder (auto-suggested at signup — you can change it in account settings)
• Whether your binder is public or private (public by default at sign-up — you choose before creating your account, and can switch it any time)

When you log a gig, we store which setlist.fm setlist you logged, the artist it belongs to, and when you logged it.

That’s it. We don’t collect anything beyond what’s needed to run your binder.

Why we collect it

Purely to run the service you signed up for: keeping your account, remembering what you’ve caught, and — only if your binder is public — showing it to other people at a link you can share.

The legal basis for this is performing our contract with you — running the account and binder you signed up for. Where we use your IP address to prevent abuse (see below), the basis is legitimate interest: keeping the service usable for everyone.

What’s public vs private

At sign-up you choose whether your binder is public (ticked by default) or private. Public means your display name and everything in your binder (gigs, songs, rarity) become visible to anyone with the link. You can switch this any time in account settings. Your email address is never made public, whichever you choose.

Cookies

We use one cookie: a session cookie from our authentication provider (Supabase), which keeps you signed in. It’s strictly necessary for the app to work. We don’t use tracking or advertising cookies, and our analytics (below) don’t use cookies either, so there’s no cookie banner. If that changes, this page will be updated first.

Who else sees your data

A small number of other services help run CAUGHT IT.LIVE:

• Supabase — hosts our database and handles sign-in, including if you choose to sign in with Google (they see that you’re signing in to CAUGHT IT.LIVE, and we receive the basic profile details — email, display name — that sign-in method shares).
• Vercel — hosts the app itself, and provides basic analytics (page views, coarse country, device/browser type). This is aggregate and cookieless — it doesn’t identify you individually or track you across sites.
• setlist.fm, MusicBrainz, the Cover Art Archive, and Wikimedia Commons — public music/gig data APIs we query on your behalf when you search for an artist or log a gig. We don’t send them your email, name, or account details — only the artist or song you’re searching for.

We don’t sell your data, and we don’t share it with anyone for advertising.

Supabase, Vercel, and Google are based in, or transfer data to, the United States. Where that happens, it’s covered by legally recognised safeguards — Standard Contractual Clauses (with the UK’s International Data Transfer Addendum) or, where a provider is certified, the EU-US Data Privacy Framework.

IP addresses

We briefly use your IP address, in memory only, to stop automated abuse of the artist-search and setlist-lookup endpoints. It’s never written to a database or log file, and it’s discarded automatically within minutes.

How long we keep it

We keep your data for as long as your account exists. Deleting your account deletes your profile and everything in your binder.

Your rights

Under UK GDPR you can ask to see, correct, export, restrict, object to, or delete your data at any time. Account deletion isn’t yet self-service in the app — email privacy@caught-it.live and we’ll action it, normally within a few days.

If you think we’ve mishandled your data, you can complain to us directly using the contact details below, or to the UK’s supervisory authority, the Information Commissioner’s Office (0303 123 1113).

Children

CAUGHT IT.LIVE isn’t directed at children and we don’t knowingly collect data from anyone under 13.

Changes

If this policy changes materially, we’ll update the date at the top and, where reasonable, let signed-in users know.

Contact

Questions about this policy: privacy@caught-it.live.