Privacy Policy

What we collect and why

• Account details — a username, an email address, and a password (stored only as a bcrypt hash). Used to create your account, sign you in, and recover access. Required to have an account.
• Phone number — optional. If you add one, it is used for account recovery and so people who already have your number can find you. You can use SETLST without ever providing one, and you can remove it at any time in Settings.
• Profile content — your display name, bio, and profile picture, if you add them. Public.
• Activity you create — reviews, ratings, crates, discussion posts, replies, comments, likes, votes, follows, saved albums, and concert attendance. This is the content the app exists to store. Public, except as noted below.
• Direct messages — the messages you send other members, so they can be delivered and shown in your inbox. Private between you and the recipient; we access them only when one of you reports a message.
• Location — optional, and only when you tap to find concerts near you. Your coordinates are sent to our concert search and to OpenStreetMap to turn them into a city name. They are used for that search and are never stored on our servers or linked to your account.
• Contacts— the iOS app never accesses your address book. On platforms that support the browser Contact Picker, you can choose specific contacts to check against SETLST. Those numbers are hashed on your device and only the hashes are sent; we compare them in memory, return the matches, and store nothing — not the hashes, and nothing at all about contacts who aren't members. See “Finding friends” below.
• Push notification token — if you allow notifications, so we can send you the alerts you enabled. Nothing else.
• Spotify account link — optional. If you connect Spotify, we store access tokens so we can read your listening history to recommend albums and concerts. Disconnect at any time in Settings; the tokens are deleted when you do.
• Subscription status — if you buy SETLST Pro, we store which plan you have and when it renews. Apple handles the payment; we never see your card details.
• Technical data — session cookies, and IP addresses used transiently for rate limiting and abuse prevention. We do not build advertising profiles and we do not use third-party analytics SDKs that track you across other apps.
• Moderation records — if you report content or are reported, we keep the report, a copy of the reported content, and the outcome, so we can enforce our rules and handle repeat offenders.

Finding friends

Contact matching is opt-in and happens only when you start it. Your device normalizes each number and hashes it with SHA-256 before anything is sent, so we never receive the phone numbers in your address book. We compare the hashes against members who chose to add their own number, return those matches to you, and discard everything else immediately. We never message your contacts, never invite them on your behalf, and never use this data for anything other than showing you which of your contacts are already on SETLST.

What's public vs. private

Your username, profile, reviews, ratings, crates, and discussion activity are visible to other users — that is the point of the app. Setting your account to private limits your content to followers you approve. Your email address, phone number, password, location, and direct messages are never shown publicly.

Who we share data with

We do not sell your data or share it with data brokers. We share the minimum necessary with the following service providers, who process it only to operate SETLST:

• Vercel — hosting and delivery of the app.
• Turso — the database your account and content are stored in.
• Resend — sending verification, sign-in, and password-reset emails.
• Twilio — sending sign-in codes by SMS, if you use a phone number.
• Apple — App Store purchases, and delivery of push notifications.
• RevenueCat — managing SETLST Pro subscription status.
• Spotify — only if you connect your account, to read your listening history.
• SeatGeek — concert listings; receives coordinates or a city when you search for shows.
• OpenStreetMap (Nominatim) — turning coordinates into a city name.
• Apple Music, MusicBrainz, and Wikipedia — album, artist, and release information. These receive search terms, not your identity.

We may also disclose information if we are legally required to, or where it is necessary to investigate a credible threat to someone's safety.

Deleting your account and data

You can delete individual reviews, posts, and messages at any time. You can permanently delete your entire account from inside the app: Settings → Delete account. That removes your profile, reviews, ratings, comments, discussions, crates, messages, follows, and any phone number or Spotify tokens on your account. It takes effect immediately and cannot be undone. We retain moderation records where we are required to for safety and legal reasons, and backups roll off within 30 days. If you would rather we do it for you, email support@setlst.dev.

Data retention

We keep your account data for as long as your account exists. Rate-limiting records are transient and expire within minutes. Contact-matching hashes are never written to disk. Reports and their evidence are kept for as long as needed to enforce our rules.

Your rights

You can access and correct your information in Settings, delete your account in the app, and ask us for a copy of your data. Depending on where you live (for example the EEA, UK, or California) you may also have the right to object to or restrict certain processing, and to lodge a complaint with your data protection authority. Email support@setlst.dev and we will respond within 30 days.

Children

SETLST is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child under 13 has created an account, email us and we will delete it.

Security

Passwords are stored hashed with bcrypt, traffic is encrypted in transit, and access to production data is limited. No service can promise perfect security, but we will notify affected users promptly if a breach puts their data at risk.

Changes

We may update this policy. Material changes will be reflected by the date above and, for significant changes, surfaced in the app.

Contact

Questions about your privacy, or want your data deleted? Email support@setlst.dev. See also our Terms of Use and Copyright policy.