Privacy policy
At Metalendario we take your privacy seriously. This policy explains what data we collect and how we use it.
Data we collect
When you create an account we store your email, name and optional profile photo. If you allow it, we use your location to show you nearby concerts. We save the concerts you add to your calendar, the styles you pick and the venues you follow. If you turn on notifications, we store your devices, which kinds of alert you want and in which language, and a log of the alerts we have sent you so we don't repeat them.
Use of data
We use your data only to provide the service: personalizing the concerts you see, managing your calendar, showing you the schedule of the venues you follow and sending you notifications if you enable them. We do not sell your data to third parties.
Location
Browser location access is optional, asked for at the time, and you can revoke it from your browser settings. Separately, in Settings → Location you can save an area and a search radius to your account: we store the point you pick on the map and the number of kilometres, and use them only to decide which gigs to show you first. That point never appears on your public profile, not even with the profile switched on, and you can change or clear it whenever you want. To put a name to the area you pick we query a mapping service: see «Third parties that process your data».
Public profile and visibility
By default your activity is private: nobody can see which concerts you go to. Turning on the public profile in Settings publishes only your name and avatar. Everything else has its own checkbox, and they all start off: the concerts you're going to (which is also what puts your name among their attendees), the concerts you went to, your favourite genres, your numbers and the date you signed up. Tick only what you want, and untick it — or switch the whole profile off — whenever you like; you stop appearing immediately. Your email, your location and the venues you follow are never shown. Profile pages are not indexed by search engines. Regardless of this setting, the total number of people who saved a concert is public, but it is an aggregate, anonymous figure: it does not reveal who they are.
Third parties that process your data
We do not sell data, but we rely on a few providers to work and you should know which. Maps are served by CARTO on OpenStreetMap cartography: when you open a map, your browser requests the tiles from them, so they see your IP address and the area you are looking at. To search for a place by name and to name the point you pick on the map, it is our server that asks the mapping service —your browser never talks to them— and we send coordinates rounded to one kilometre, which is all it takes to know the municipality. Public forms (creating an account, claiming a venue) are protected with Cloudflare Turnstile, which receives your IP and browser signals to tell you apart from a bot. If you sign in with Google or Apple, they give us your email, name and picture, and they know you signed in here. And if you accept analytics cookies we use Microsoft Clarity, which beyond statistics records how you move around the page (clicks, scrolling and the fields you fill in, except hidden ones); if you decline cookies it is not loaded. Mobile app notifications go out through Expo, which hands them to Apple (iPhone) or Google (Android): all three see the text of the alert —for example, the name of the saved concert we are reminding you about— and your device identifier, but not your name or email. Browser notifications are end-to-end encrypted: your browser's push service (Google, Mozilla, Apple or Microsoft) only carries them and cannot read them. All of them process data on our behalf or under their own policy. Apart from that app notification text, which is only sent if you turn notifications on, none of them receives your calendar, your saved gigs or your password.
Your rights
From Settings → My data and privacy you can download everything we hold about you as a file (and your calendar as CSV), or delete your account — no need to ask us and no waiting for a reply. Deleting your account removes your profile, calendar, styles, votes, followed venues, notification devices and preferences and profile picture. Concerts you submitted to the catalogue stay published but are unlinked from you, so they are no longer personal data. To edit or correct your data, use Edit profile. To object to processing, restrict it or file a complaint, write to us; you may also complain to the Spanish Data Protection Agency.
How long we keep it
Your account data is kept for as long as the account exists: if you delete it, the data goes at that moment and no copy is held in waiting. Two records remain separately because the law requires us to be able to prove them — your cookie decision and the changes to your profile visibility — kept for three years from each change and deleted automatically once that period is over. We do not store your IP address alongside those records. The log of sent alerts is deleted automatically after 90 days.
Contact
For any questions about your data, write to us at contacto@metalendario.com.