Privacy Policy

Hey there! 👋

We believe in being straightforward about how we use your data. This privacy policy explains what information Analog Rooms, LLC ("we", "us", or "our") collects, how we use it, and the choices you have about your data.

1. What Information We Collect

1.1 Information you give us:

- Your email address (for account access and notifications)

- Your subscription status and purchase identifiers (so your access works across iOS and web)

- Your city (you select this)

- The concerts that you save

- Your music preferences

- Your profile picture (if you add one)

- Any other content you create or submit to the Analog Rooms app

1.2 Information we collect automatically:

- Basic device information (deviceType, your iOS version in the app, or your browser and operating system on the web).

- Anonymous usage data (through PostHog analytics — always on, but never tied to you; see Section 10)

2. How We Use Your Information

We use your information to:

- Help you discover great shows in your selected city

- Keep track of the concerts you're interested in

- Let you know when your favorite artists are coming to town

- Improve the app based on how you use it

3. Where We Store Your Data

Account data and our backend functions are hosted in the United States. Anonymous analytics are processed in the EU. Our hosting provider's global network may briefly handle requests at locations near you to deliver the App faster. We use trusted third-party services to operate Analog Rooms:

- Supabase (US): Stores your account data and concert information

- Supabase Auth: Handles secure email authentication via magic links

- PostHog Cloud EU: Helps us understand how people use the app, anonymously (see Section 10)

- Waitlist: Manages our email waitlist

- Resend: Sends transactional and marketing emails

- Framer: Powers our website and GDPR compliant by default web analytics (aggregated and anonymized views at the country level)

- Vercel: hosting, content delivery network (CDN), and serverless functions for the web app

- Stripe: payment processing for web subscriptions. Stripe collects your payment details directly and may collect device and browser information to prevent fraud, under its own privacy policy. We do not store your card number.

- RevenueCat: manages your subscription status and access across the iOS app and the web app. It receives your account identifier and your purchase and subscription information.

We share information with the service providers listed above, who process it on our behalf, and with law enforcement if required by law (we'll let you know unless legally prevented).

3.1 System Logs and Technical Data

For security and to maintain service quality, we collect and process:

- System logs for troubleshooting

- Error reports

- Basic server performance data

- IP address information

System logs and error reports for Supabase are automatically deleted within 7 days. Hosting request logs on Vercel are kept for up to 30 days.

4. Relationship with Terms of Use

This Privacy Policy is part of and incorporated into our Terms of Use. By agreeing to this Privacy Policy, you also agree to be bound by our Terms of Use, which can be found at https://analogrooms.com/terms 

5. Data Protection and Regional Compliance

This privacy policy is governed by the laws of the State of Florida, United States. 

5.1. CCPA Compliance

For California residents, we comply with the California Consumer Privacy Act (CCPA). You have specific rights regarding your personal information, including:

- The right to know what personal information we collect and how we use it

- The right to delete your personal information

- The right to opt-out of the sale of your personal information (though we never sell your data)

- The right to non-discrimination for exercising your CCPA rights

5.2. GDPR and EU Users

Analog Rooms is available to users in the United States, Canada, Australia, and New Zealand, and we restrict access from other countries. We are not currently offered in the EU or UK, but we're designing our practices with GDPR compliance in mind. If we expand to the European Union:

- We will establish a separate EU-based database in Frankfurt through Supabase

- No international data transfers will occur

- All data processing will comply with GDPR requirements

- Push notifications and marketing emails are opt-in first rather than opt-out.

- In-app analytics are always-on but fully anonymous and never tied to your identity (see Section 10), which is why we don't currently gate analytics behind a separate consent step in the US. If we expand to the EU, we will add an explicit consent step for analytics as part of that expansion, even for our always anonymous tracking.

5.3.Canada, Australia, and New Zealand

Your information is stored and processed in the United States and, for analytics, the EU. We handle personal information in line with applicable privacy laws in these countries. You can request access, correction, or deletion at hello@analogrooms.com.

6. Notification Consent

We believe in explicit consent for sending any notifications:

- Push notifications: You'll be asked to opt-in during signup, or you'll be prompted to enable when relevant 

- Marketing emails: You'll need to explicitly subscribe during signup

All these settings can be modified in your account preferences at any time

7. Data Retention

We keep different types of data for different periods:

- Account information: Retained while your account is active

- System logs: 7 days for Supabase, 30 days for Vercel.

- Analytics data: Using Posthog’s default data retention  

When you delete your account:

- All of your app data is immediately marked for deletion

- Removed from our active systems within 30 days

- Cleared from backups within 60 days

Billing records are kept as required by tax and accounting law, even after account deletion. Deleting your account does not cancel an active subscription. If you have one, we keep the billing information needed to let you manage or cancel it (see Terms 7.6) until it ends.

8. Security and Data Breaches

We take protecting your information seriously. So much so that we do not intentionally seek to obtain sensitive information in the first place. In the event of a data breach:

- We will notify all affected users via email within 72 hours of discovery

- The email will include:

  - What information was compromised

  - When the breach occurred

  - Steps we're taking to address it

  - Recommended actions for users

  - Contact information for questions

8.1 Technical Security

We protect your data using:

- Data encryption in transit and at rest

- Access controls for our team

- Regular security updates

8.2 System Maintenance

To keep our service reliable, we occasionally perform maintenance:

- Some features may be temporarily limited

- Your data remains secure

- We'll notify you about significant disruptions

- We minimize impact on your experience

9. Website Privacy

Our website (analogrooms.com):

- Uses Framer's built-in analytics, which is GDPR compliant by default (https://www.framer.com/help/articles/gdpr-and-cookies/)

- Does not use traditional browser cookies

- Does not collect any personal information beyond anonymous usage data

- Does not track users across other websites

Our web app (app.analogrooms.com):

- Persists essential sign-in session tokens (via Supabase Auth) in your browser's cookies or local storage to keep you logged in, and a service worker cache that stores app files on your device for faster loading.

- Uses Revenuecat Stripe billing. Stripe may set cookies or identifiers when you check out, for payment processing and fraud prevention.

- Sets a temporary session identifier for in-app analytics that resets each time you launch the app. It is never reused and never tied to your account.

- Does not use advertising or cross-site tracking cookies. You can clear stored data in your browser settings; signing out clears your session tokens.

The primary data collection and processing described in this policy applies to our iOS app and web app. For our website, we only collect anonymous usage data to help us improve the site experience.

10. In-App Analytics 

We use PostHog to understand how people use Analog Rooms. Every analytics ID is generated fresh when the app launches. It's never reused, so no session can be linked to another, and none of it is tied to your account. We don't record IP addresses. This helps us do the following without being able to trace in-app events to any specific individual:

- Find and fix problems

- See which features people love (and which ones they don't)

- Make the app better for everyone

We don't:

- Track you across other apps or websites

- Share your data with data brokers

- Use your data for targeted advertising

- Sell your personal information to advertisers or other third parties

- Record IP addresses in our analytics or store them in our database. Like any website however, our database service (Supabase), hosting provider (Vercel), payment processor (Stripe), and subscription provider (RevenueCat) may process IP addresses to deliver the service and prevent fraud or abuse. We use the approximate country derived from your IP address only to check that the App is available in your region, and we don't store it.

11. Marketing and Aggregated Data

We may use aggregated, anonymized data for marketing purposes. This means we might say things like "80% of our users love indie rock" or "Users in Seattle save twice as many shows as the average." We never share individual user data for marketing - only broad, anonymous trends.

12. Account Security

We keep things simple and secure:

- We use email magic links for authentication (no passwords to worry about!)

- Each login link can only be used once

- Login links expire after 1 hour

13. Your Choices

You can:

- Update your profile information anytime

- Change your selected city whenever you move

- Choose what notifications you want to receive

- Delete your account and data

- Opt in and out of marketing emails and push notifications

14. AI and Machine Learning

We may use AI and machine learning to better understand our business and to create new features in the App, such as enabling our concert discovery features. We may use your data, for example the concerts you save or your music preferences, to train our internal AI and ML models. Training data is linked only to your account ID (not your email address or payment details). These features are designed in-house, and your data is never sent to third party AI services. AI and machine learning systems and generated content may contain errors.

15. Your Privacy Rights

We extend these privacy rights to all our users, regardless of location:

15.1 Access and Portability

You can email us at hello@analogrooms.com to request a copy of your personal data in a portable format

15.2 Deletion

You can delete your account and associated data as described in our Data Retention section

15.3 Transparency

We list all the ways we use your data in this policy

15.4 No Data Sales

We never sell your personal information to third parties

15.5 Non-Discrimination

We will never discriminate against you for exercising any of these rights

To exercise any of these rights, contact us at hello@analogrooms.com. We'll respond to your request within 30 days.

16. Changes to This Privacy Policy

When we make important changes to this policy, we'll let you know by email or when you next open the app.

17. Contact Us

Have questions about your privacy? Email us at hello@analogrooms.com

Thanks for trusting us with your data! 🎸