Privacy policy

This policy explains what data the Festosh app and the festosh.fr website process, why, for how long, and how to exercise your rights.

Festosh is published by Alexandre Godet, as an individual, who is the data controller under the General Data Protection Regulation (GDPR). For any question about your data: contact@festosh.fr.

Your account

• your email address, username and language;
• your password, stored only in hashed form: nobody can read it back;
• your profile picture: the one from your Google, Apple or Facebook account if you sign in with it, otherwise the one linked to your email on Gravatar, if any;
• if you sign in with Google, Apple or Facebook: your account identifier at that provider, and the email and name it sends us.

What you do in Festosh

• the festivals you follow, your running orders (the concerts you picked and their status) and your favourites;
• statistics computed from your running orders (year in review, most seen artists…).

Crews

• the crews you belong to and your role;
• the messages you send in a crew chat;
• the location you choose to share with your crew: a spot on the festival map, a note, and your GPS position if you send it.

Festosh never tracks your location in the background: it is only read when you decide to share it.

Your feedback

• the festivals you suggest, the programme mistakes and the content you report, with their message;
• the corrections you suggest on artist or concert pages.

Technical data

• server logs: IP address, date and request, for security and troubleshooting;
• app crash reports: device model and operating system, app version and error trace. They contain neither your messages nor your location.

On your device

The app keeps a local copy of festivals and of your running orders, to work offline, as well as your sign-in tokens, in the system's secure storage.

Subscriptions (festosh.fr website)

Payments are handled by Stripe. We keep the subscription reference and its end date, never your card details.

Cookies on festosh.fr

The website sets the cookies it needs to work (session, preferences). If you accept it in the cookie banner, and only then, it also measures its audience with Google Analytics: pages viewed, visit length, device type and, if you are signed in, your account's technical identifier. In the app, audience measurement (Firebase Analytics, by Google) is off by default: it only starts if you turn it on in Profile, Settings, and you can stop it there at any time. It measures the screens viewed and the main actions (opening a festival, downloading a program…), with technical device information (model, system, country) and an identifier specific to the installation, never the advertising ID, your email or your crews' names.

• Providing the service: creating your account, saving your running orders, running crews, chat and location sharing, sending service emails (account confirmation, password reset). Legal basis: performance of the terms of use you accept.
• Handling your feedback and reports, moderating content: legal basis, our legitimate interest in offering a reliable and safe service.
• Securing and fixing the service (logs, crash reports, abuse prevention): legal basis, our legitimate interest.
• Producing concert statistics (their popularity, computed from running orders, including anonymised ones): legal basis, our legitimate interest.
• Sending you notifications: legal basis, your consent, which you can withdraw at any time in the settings.
• Measuring the website's and the app's audience: legal basis, your consent, given or refused in the cookie banner (website) or turned on in the settings (app), and changeable at any time.

Without a Premium account, the Android app shows ads provided by Google AdMob, except during an ongoing festival you have a running order for. Before the first ad, a Google window asks for your consent: if you accept, ads may be personalized using your device's advertising ID; if you decline, they are not. You can change your mind at any time in Profile, Settings, Ad consent. Festosh does not sell your data and never sends Google your email, your name or your running orders.

• Members of your crews see your username, picture, messages, the location you share and the concerts of the running order you link to the crew.
• A running order you share by link or QR code can be seen by anyone who has the link.
• Our technical providers, only for the service they provide: OVH (server and database hosting, in France), Amazon Web Services (image storage, Paris region), Google (sending emails, storing backup copies, ads in the Android app with AdMob and, if you accept it, measuring the website's and the app's audience), Sentry (crash reports) and Stripe (subscription payments).
• Google, Apple or Facebook, if you choose to sign in with one of them.
• Music services (Deezer, Spotify, YouTube…): when you play a preview or open a link, your device contacts their servers directly, under their own privacy policy.

Some of these providers may process data outside the European Union, in particular in the United States. These transfers rely on the safeguards provided by the GDPR: an adequacy decision of the European Commission or standard contractual clauses.

We only disclose your data to an authority when the law requires it.

Festosh uses YouTube API Services to find and show artists' videos.

• What Festosh stores: only the public information of each artist's videos (ID, title, channel, thumbnail), which it never shows for more than 30 days without refreshing it from YouTube. Festosh sends no data about your account to YouTube and does not access any data of your Google or YouTube account.
• What Google receives: when you view an artist's videos or play one, your device loads the thumbnails and the YouTube player directly from Google's servers. The player is used in privacy-enhanced mode (youtube-nocookie.com); Google still receives your IP address and information about your device, and may place, read or recognise cookies or similar technologies on your device or in your browser.

Google processes this data under the Google Privacy Policy. By watching a video, you also agree to the YouTube Terms of Service.

• Your account, running orders, crews, messages and locations: as long as your account exists. A shared location stays visible until you remove it, leave the crew or the crew is deleted.
• When you delete your account: your account, crew memberships, messages, locations and subscriptions are erased immediately. Your running orders are anonymised: detached from your account and stripped of their title and of your personal events, they are no longer accessible to anyone and are only used for concert statistics. Crews you created are handed over to their oldest member. Your feedback and suggested corrections are kept without any link to you.
• Server logs: 180 days.
• Crash reports: 90 days at most.
• Website audience measurement cookies: 13 months at most.
• App audience measurement data: 14 months at most.
• Database backups: 30 days. Deleted data therefore disappears from backups within 30 days.

At any time, you can:

• access your data and receive a copy in a readable format (portability);
• have it corrected;
• have it erased: from the app (Profile, then "Delete account"), or by email if you no longer have the app;
• object to a processing or ask for it to be restricted;
• withdraw your consent, for instance for notifications or audience measurement (website cookies, app setting);
• set instructions about what happens to your data after your death.

To exercise these rights, write to contact@festosh.fr. We answer within one month. If you believe your rights are not respected, you can lodge a complaint with the CNIL (www.cnil.fr), the French data protection authority.

Festosh is meant for people aged 15 and over. Below that age, the consent of a parent or guardian is required.

Traffic between the app and the server is encrypted (HTTPS), passwords are hashed, and access to data is limited to what the service needs to work.

This policy may change. If a change is significant, we will let you know in the app or by email. The last update date is shown at the top of this page.