Privacy

Privacy Policy

Product policy draft for Concert Ready (concertready.app). Not legal advice; subject to counsel review before public launch.

Concert Ready helps you prepare for concerts by searching events, showing recent setlists, and optionally creating a private Spotify or Apple Music playlist. This page explains what data we handle in practical engineering terms—not a substitute for legal advice.

What Concert Ready does

You can search for concerts, open a preparation page with line-up and setlist references, and optionally connect Spotify or authorize Apple Music to save a playlist. Streaming connections are optional and only needed to create playlists in your account. Venue directions and an upcoming trip-home planner may open Google Maps in your browser.

Data we may process

  • Search queries and related API requests may appear in application and infrastructure logs while we operate and debug the service.
  • If you connect Spotify, we store OAuth tokens (including a refresh token) in our DynamoDB UserTokens table so we can create playlists on your behalf. Tokens are tied to your browser session, not a separate Concert Ready user profile product.
  • If you choose Save to Apple Music, MusicKit authorization runs in your browser. Concert Ready requests a short-lived developer token from our API, then sends your selected song ids and the opaque Music User Token to create a library playlist. We do not receive your Apple ID credentials, and we do not store the Music User Token in DynamoDB or analytics.
  • Your browser keeps a session identifier locally. Server-side session material is encrypted with AWS KMS.
  • We use Plausible analytics (privacy-oriented, cookieless) when the script is loaded, to understand aggregate site usage. Search events may include a short, normalized copy of the concert search text (artist/city style queries)—not account identifiers—so we can improve search coverage.
  • AWS services such as CloudFront and API Gateway may retain standard access logs for security and reliability.
  • Approximate country may be inferred from the CDN (CloudFront) based on your IP address to format dates and bias search defaults when you do not specify a city; this is not used for marketing tracking and is not stored as a long-lived profile.
  • For venue directions or the trip-home planner, destination or address text you enter is passed directly to Google Maps in your browser (for example via a directions URL). Concert Ready does not store that destination text on our servers.
  • Public event preparation pages store concert-oriented data (line-up, setlist references, schedule estimates, Spotify match metadata, and related artwork URLs)—not a personal account profile for site visitors.
  • Some concert pages may offer optional photos of merch from a recent show on Instagram. Choosing “Show Instagram post” loads Instagram’s embed on this page (Instagram may set cookies). You can also open the post on Instagram in a new tab. Concert Ready does not load Instagram until you choose one of those actions.

Third parties

Event and ticket facts (and often event artwork) may come from Ticketmaster; setlist references from setlist.fm; music matching, artist images, and playlist actions from Spotify; optional catalog matching and library playlist creation from Apple Music; optional merch photo links to Instagram when you follow them; maps/directions from Google Maps; analytics from Plausible. Each provider processes data under its own terms when you use their services or follow their links.

Operational caches

We temporarily cache provider responses and derived matches to build and refresh pages. Approximate windows today: setlist.fm results ~24 hours (~12 hours when the show is within 7 days); Ticketmaster single-event payloads ~12 hours; Spotify track matches ~90 days; assembled event pages adaptive soft-fresh (~12 hours within 7 days of the show, otherwise ~24 hours); search cache ~15 minutes. These are engineering defaults for operating the service, not promises about third-party completeness or freshness.

Images

Event posters may be served from Ticketmaster URLs; Spotify may supply artist imagery used in matching. We display images for concert preparation only. When present, Ticketmaster poster attribution is shown on the event page—see Data sources for more detail.

Retention and disconnection

Stored Spotify tokens are intended for active use and expire via DynamoDB TTL after about 30 days of idle time (refreshed when you reconnect or we refresh tokens during use). Disconnecting Spotify deletes the stored UserTokens item for that session. Operational caches expire on the windows above. Logs and CDN records follow normal AWS retention practices. Playlists already created in Spotify remain in your Spotify account until you delete them there.

Your choices

When connected, use Disconnect Spotify on an event page: that clears your local session and removes stored Spotify OAuth tokens for that connection on our side. You can also revoke Concert Ready access in your Spotify account settings (Apps). Disconnecting does not delete playlists already saved to Spotify.

Contact and deletion requests

For privacy questions, image takedown requests, or to request deletion of stored Spotify connection data, email mikita@mikitech.dev. We will need enough detail to locate the relevant session, page, or asset. Playlists already created in Spotify remain in your Spotify account.

Related: Data sources · Terms.