Short version: we don't sell your data, and we never will

This policy covers booth.live and the Booth iPhone app. Booth is for people 18 and over. Many shows are 21+; check the event’s own age limit.

For phone sign-in, we store your number and use Twilio to send a one-time code. Account email is private and separate from any marketing subscription. Some older website sessions use a guest or email account. We keep account identifiers, sign-in and security records, and the settings you choose.

Your profile can contain a name, username, photo, bio and card color. Signed-in people can find your username. Profile photos have public web addresses; do not upload a photo you need to keep private. Upcoming Saved and Going shows are shared with accepted friends while plan sharing is on. Past nights, ratings and taste follow your Public or Private setting: Public permits signed-out profile links; Private limits them to you and accepted friends. Notes are private unless you share them with friends. Editing a shared note makes it private again.

You can change these settings, remove friends or block accounts. A stricter setting stops future access through Booth; it cannot recall screenshots, messages or information someone already received. A signed-out visitor can still open a Public profile link.

We store the shows you save, mark Going or Went, your ratings and notes, artists you follow, music preferences, friend requests, friendships and blocks. We also collect activity such as searches, shows opened, ticket clicks and what For you showed you. This helps operate Booth, improve discovery and personalize recommendations. A ticket click records a handoff to a ticket site, not a purchase.

If you connect a music service, we use the listening information you choose to import. Apple Music and Last.fm imports save artist preferences; Last.fm also uses the username you supply. An existing Spotify connection can import a snapshot of top, followed and recently played artists and genres. Booth does not keep Spotify access or refresh tokens. Removing a connection stops that connection; retained activity follows the retention section below.

Booth works out friend closeness from activity such as shows together, chat interactions and profile visits to order friends and suggestions. These are private signals, not a score other people can view. We do not use private message text for analytics, totals or trends.

Find friends from contacts reads the contacts you permit and turns phone numbers into one-way codes on your phone. Booth receives those codes to find matches, not your address-book names or raw phone numbers. Hashes are identifiers, not guaranteed anonymity. We keep friendships and an account-level matching allowance; submitted address-book codes are not retained in the server matching table. You can turn off being found by your number. Invitations open your own messaging app and are sent only by you.

Booth keeps messages, photos and chat history so we can keep Booth safe and look into reports, even after a chat closes or a message is unsent. New content follows the retention rules below. A chat’s closing date controls when members lose access; it is not a promise that its stored history is erased.

Direct messages, groups and plan chats are private to their members. Booth staff read that content only for a report or review of a photo flagged by an automatic safety check. There is no general private-chat reader for staff. Private message text is never sent to OpenAI or another moderation provider.

Show chats are open to anyone eligible to join the show chat, so do not expect them to be private. We use show-chat activity for totals and common topics only when the group contains at least 10 people. We may share totals that cannot identify you, with at least 10 people in each group. We do not provide individual movement or private-chat analytics to artists or venues.

Chat photos are re-encoded to remove camera and location metadata before upload. The visible contents of a photo can still reveal people or places. A report saves the reported message and up to five preceding messages, including their saved hidden or unsent state and photos. The reporter can view their saved report, and authorized staff can review it. Later edits or closing the chat do not change that saved copy. Unsending hides content from the conversation; it does not erase evidence.

New photos in every chat and new text in show chats are sent to OpenAI’s moderation service for supported safety checks. These check photo sexual content and show-chat text for threats, hate, violence and sexual content involving minors. We do not send direct-message, group or plan-chat text. The check is run by an automated program, not a person. It only tells us whether something looks inappropriate; nobody reads or looks at your content to run it. We keep the resulting scores and actions for safety review. Scores for illicit content are stored but do not cause hiding.

Adult sexual photos may be covered in private chats and hidden in show chats. Show-chat threats, hate and violence can be hidden. Automated checks can miss harmful content or make mistakes; use Report when something is wrong. While a check is pending, content may be withheld for up to one minute; if the service is unavailable, it becomes readable and checks retry later.

Matching photos against known child-abuse images is not set up yet; we plan to add it soon. OpenAI’s sexual-content-involving-minors category checks text, not images. If suspected child-abuse material is reported or otherwise identified, we restrict access, preserve evidence and may freeze the sender’s ability to send. Authorized staff review it, and we report child sexual abuse material to the appropriate authorities to the best of our ability and as required by law. Preserved evidence is not routinely deleted.

OpenAI processes this content only to run the check. It does not keep what it checks or use it to train its models. That is not a sale.

Near me calculates venue distances on your phone after you allow foreground location. Booth does not read location in the background. Calendar access adds a show only when you ask; Booth does not read your calendar. Photo access uploads only pictures you select. Shake detection for Report a problem stays on the phone.

With existing location permission, Booth may check your city while you use the app, at most once every 12 hours. It works out the city on your phone and asks before changing your home city. We keep a supported city and day, not the coordinates used to detect it. Unsupported or uncertain locations are discarded.

Before Show mode first starts at a festival, we explain the location use and save your choice. You can use it without allowing location. While you use Booth with Show mode on, your phone works out stage visits. Booth keeps stage names, time intervals and matching sets; the location fixes used for that calculation stay on your phone. Stage and time can still reveal where you were.

Friends see only the precise spots you deliberately share, not a continuous live location feed. Those pins are sent to Booth and shared with currently authorized friends. Exact coordinates are removed within a day. Turning Show mode off stops stage recording and removes your shared pins; if offline, server removal finishes when Booth reconnects. Stage/time history remains. Opening a pin in Apple Maps sends that chosen point to Apple Maps. Maps also use Apple or Mapbox services to display map content.

When app analytics is enabled, PostHog receives allowed usage events, screen names, app and operating-system versions, public show identifiers, broad counts and an installation or account identifier. This can link activity to an account, so it is not anonymous. Search analytics uses query-length and result-count ranges rather than the words you typed. Message bodies, private notes, contact details and precise location are excluded from analytics.

Sentry receives crash and error diagnostics with code locations, app/device details and a limited screen trail, with automatic personal data and typed text removed. If you choose Report a problem, we receive your message, category, optional reply email, device/app details and recent screen/action context. A screenshot from a shake is shown for review and is sent only if you keep it. We do not use session replay.

If you email us, we keep the conversation so we can respond. Security logs and service providers may process network addresses and request details. Booth’s form-abuse records use an IP hash, browser fingerprint and user-agent rather than storing the raw IP in that table. This does not mean network providers never receive an IP address.

The site uses a small number of first-party cookies strictly for session handling (for example, your Booth account or our admin login). We do not run third-party advertising trackers.

When website measurement is enabled, we use PostHog to understand weekend return visits, reopening saved shows, marking Went, completed shares, accepted friend invitations, and steps from the website toward the app. PostHog measurement is entirely off when its public project key is not configured.

We keep one random browser identifier in local storage and replace it after 12 months. It also measures those website-to-app steps. Local records prevent counting the same weekend more than once, or reopening the same show more than once per Pacific day. The show identifier stays in the browser; it is not sent with measurement.

This website measurement does not send names, handles, phone numbers, email addresses, account or user identifiers, show, plan or profile identifiers, messages, or other free text. These website events never identify your account to PostHog. Weekend counts use Friday through Sunday in San Francisco time; action counts are sent only after the action succeeds.

To see how the closed-beta invitation works, Booth counts a few steps on its own servers: when a beta invitation is shown or Apply is tapped, which invitation or tagged link it came from, how far the application form gets, and whether it was sent. Each browser tab gets a random visit number that is forgotten when the tab closes. These counts don't include your name, email, account, IP address, browser details or your answers, and they aren't linked to an application. These separate first-party counts do not depend on PostHog being enabled.

We store and send no measurement when your browser sends Do Not Track or Global Privacy Control, or after you turn it off below. Turning it off clears measurement identifiers and local counting records and stops both PostHog measurement and the separate beta counts. We keep only your choice to leave measurement off in this browser.

If you enable notifications, Booth stores an Apple push token, app installation/environment, preferences and private delivery records. Apple receives the token and message to deliver it. Chat notifications may include the sender’s name and message. Your iPhone’s Show Previews setting controls lock-screen display. An accepted push is not proof that you read it.

Joining the Thursday text is separate from sign-in. We store your number, signup source and consent choices for roughly one text each week. Reply STOP to opt out or HELP for help. Message and data rates may apply; carriers are not liable for delays. Email marketing requires its own consent checkbox. Simply supplying an account email does not subscribe you. We keep opt-out records to respect your choice.

We keep new activity, messages, photos, reports and safety history for as long as Booth runs, to keep Booth safe and working well. This includes stage/time and city/day history. We keep only the limited totals described above for sharing outside Booth.

This longer retention starts at the recorded activation cutoff for each feature; it is not retroactive. Older messages still follow their earlier chat-deletion schedule: plan and show chats after 90 days, and direct chats 30 days after their closing trigger. Older reports keep their one-year expiry. A new report may preserve its own evidence copy of earlier content. Older activity continues under its earlier retention rules.

Delete account in Settings starts a 30-day waiting period. Your account becomes unavailable to other people, and ordinary activity is blocked. You can cancel during that period. After it ends, a scheduled process deletes the account, profile, contact details, credentials, push tokens and private notes. It replaces account identifiers in retained history with random identifiers, including other participants where needed. Retained messages can appear as from a deleted user.

This unlinking is not a guarantee of anonymity: names or identifying details written in a message, photo or report can remain. Retained chat and report photos can remain after profile-photo removal. Legally preserved safety evidence is retained. Deleting an account cannot recall copies already delivered to other people or automatically remove data already received by analytics and support providers; contact us about those records.

Form-abuse logs expire after 90 days. Marketing entries remain until opt-out or removal, with limited opt-out evidence kept. Backup copies are separate from active accounts and are not used to restore a deleted account to normal use. Backup and provider deletion schedules are managed operationally; contact us for the applicable schedule rather than assuming every copy disappears on day 30.

We do not sell your personal information or share it for advertising, and we never will. We share information as described here to run the service, deliver what you request, handle safety reports and meet legal obligations.

Our providers include Supabase for accounts, data and photos; Vercel for website hosting; Twilio for sign-in and SMS; Apple for notifications, maps and optional music access; Mapbox for maps; PostHog for measurement; Sentry for diagnostics and feedback; and OpenAI for moderation. Spotify, Last.fm and Deezer supply optional music information or public artist content. These services receive network information when your device connects. Links to ticket sites, Maps and other external apps are governed by those services’ own policies.

If Booth is sold or merges with another company, information may transfer with it and this policy’s promises still apply. We will tell you before changes to those promises take effect.

Use Settings to manage profile privacy, plan sharing, contacts discoverability, notifications and account deletion. You can also ask for access, correction or deletion by emailing hello@booth.live. We may verify that you control the account before acting. We explain any retained safety or legal records in response to your request.

We update this page when practices change and email you before material changes take effect; if we don’t have your email, we tell you in the app. A later policy does not silently extend the retention promised for older data. The effective date at the top is the date this version is published with the corresponding features.