Privacy Policy

Stubbed (“we”, “us”) is the controller of your personal data under the UK GDPR and the EU GDPR, and the “business” for the purposes of US state privacy laws.

For anything about privacy, including exercising your rights, email support@getstubbed.app. We don’t have a Data Protection Officer because the law doesn’t require one for a service of our size and nature.

For each kind of data below we say why we use it and, for people in the UK and EU, the legal basis that allows it.

Waitlist

• Your email address, so we can invite you when spaces open up. Legal basis: your consent, which you can withdraw at any time.
• Where you came from (a campaign tag or the referring website), so we know which links bring people to Stubbed. It’s stored with your email. Legal basis: our legitimate interest in understanding how people find us.

Your account

• Email address and password. Passwords are stored only as a secure hash by our authentication provider; we can’t see them.
• If you sign in with Google, Google shares your name, email address and profile picture with us. We don’t get your Google password or access to anything else in your Google account.
• Your profile: handle, display name, avatar, and your default visibility setting.

Legal basis: performing our contract with you (the Terms), since we can’t give you an account without them.

Your diary

• Entries: the show, venue and date, and optionally a rating, a note and a photo.
• Trips and labels you create, and the entries in them.
• Shows and venues you add to the shared catalogue. These are visible to everyone and may stay in the catalogue if you leave, without your name attached.

Legal basis: performing our contract with you. Please don’t put sensitive information (for example about your health, beliefs or sexuality) in notes, especially public ones.

Photos and show detection

When you add a photo to an entry, your browser reads the date, time and location the photo was taken from its metadata (EXIF), then makes a resized copy with all metadata removed. Only that clean copy is uploaded. The original photo never leaves your device, and we never store the photo’s location.

To suggest the show and venue for you, we may also:

• send the photo’s location to OpenStreetMap services to look up nearby theatres and the city. This is sent from our servers without your name, email or any account identifier;
• send the clean copy of the photo, its date and time, an approximate location (rounded to about 100 metres) and the nearby theatres to an AI provider (see who we share data with), which may search the web to identify the show.

Suggestions are only suggestions: nothing is saved until you confirm it, and you can always fill in an entry by hand without a photo. Legal basis: performing our contract with you, as this is a feature you choose to use. We don’t make any decisions about you by automated means that have legal or similarly significant effects.

Importing ticket emails

If you import booking confirmation emails, your browser opens the email files and sends only their readable text (subject, sender, date and body) to our servers, where an AI provider reads out the show, venue, date, time, seats and price. Booking emails can contain other details, such as your name, address or an order number; we don’t look for or keep them. The email text isn’t stored or logged: you get draft entries to review, and only what you confirm is saved. Legal basis: performing our contract with you, as this is a feature you choose to use.

Technical data

Like any website, our hosting and database providers log technical details of each request, such as your IP address, browser type and the pages you visit, to keep the service running and secure. Legal basis: our legitimate interest in operating a secure service.

Your handle, display name and avatar are public. Once you set a handle, you also get a public profile page at /@yourhandle. It shows your public entries and their photos, plus stats and a calendar based only on public entries. Clear your handle to take the page down. Entries and trips are public by default: anyone, including people without an account and search engines, can see them, along with any photo attached. You can make any entry or trip private, or change your default to private, at any time. Private entries are visible only to you.

If you share a card or a link, the people and services you share it with (for example Instagram or WhatsApp) can see and keep what you shared, under their own privacy policies.

We use only cookies that are strictly necessary to keep you signed in and protect your account. We don’t use analytics, advertising or tracking cookies, so we don’t ask for cookie consent. The landing page sets no cookies at all. If you choose to sign in with Google, Google sets its own cookies on its own website.

Because we don’t track you across websites, there is nothing for a browser “Do Not Track” or Global Privacy Control signal to switch off.

We don’t sell your personal data, and we don’t “share” it for cross-context behavioural advertising as defined by California law. We share it only with service providers (processors) that help us run Stubbed, under contracts that let them use it only on our instructions:

• Supabase: database, sign-in and photo storage.
• Vercel: website hosting.
• AI providers: reading photos and ticket emails, as described above. We use Anthropic (Claude) by default, and may use Google (Gemini), Groq or Cerebras instead. We use their paid business services, whose terms don’t allow them to use this data to train their models.
• Google: sign-in, only if you choose “Continue with Google”.
• OpenStreetMap services: nearby-theatre lookups, as described above, with no account details attached.

We may also disclose data if the law requires it, to protect the rights, safety or property of our users or others, or to a successor if Stubbed is ever transferred to someone else, in which case this policy will continue to apply to your data.

Some of our providers are based in, or process data in, the United States and other countries outside the UK and the European Economic Area. When your data is transferred there, we rely on safeguards the law recognises: an adequacy decision (such as the EU–US Data Privacy Framework and its UK extension, where the provider is certified), or the European Commission’s Standard Contractual Clauses with the UK Addendum. Email us for a copy of the relevant safeguards.

• Waitlist: until we invite you or you ask to be removed, and in any case no more than 12 months after public launch.
• Account and diary: for as long as you have an account. When you delete your account or an entry, we delete it from the live service within 30 days; copies in backups are overwritten within a further 90 days.
• Technical logs: kept by our providers for a short period, typically no more than 30 days.
• Photo location, ticket email text and AI results: not stored by us. They’re used to make your drafts and then discarded.

We may keep a limited record for longer where the law requires it or to deal with a legal claim.

Wherever you live, you can ask us to:

• give you a copy of your personal data, in a portable format (CSV);
• correct data that’s wrong;
• delete your data and your account;
• remove you from the waitlist or withdraw any consent you gave, which doesn’t affect what we did before.

In the UK and EU you also have the right to restrict or object to our use of your data (including where we rely on legitimate interests), and to complain to a data protection authority. In the UK that’s the Information Commissioner’s Office; in the EU, it’s the authority in the country where you live or work. We’d appreciate the chance to sort things out first.

In the US, residents of California and other states with privacy laws have the right to know what personal information we collect, use and disclose (described above), to access, correct and delete it, and to opt out of its sale, sharing for targeted advertising, or profiling. We don’t do any of those things. We won’t treat you differently for exercising your rights. You can use an authorised agent, and if we decline your request you can appeal by replying to our decision.

To exercise any right, email support@getstubbed.app from the address on your account. We may ask you to confirm your identity. We’ll reply within one month (45 days in the US), and it’s free.

Data is encrypted in transit and at rest. Database rules ensure that private entries can be read only by their owner. Photos are stored without their original metadata. No system is perfectly secure, but if a breach affects your data we’ll tell you and the regulators as the law requires.

Stubbed is not for anyone under 16. We don’t knowingly collect personal data from children under 16, including children under 13 in the US. If you think a child has given us their data, email us and we’ll delete it.

If we change this policy, we’ll update the date at the top. If the change is significant, we’ll also tell you by email or in the app before it takes effect.

Stubbed. Email: support@getstubbed.app.