Privacy Policy
Effective July 30, 2026
The short version: almost everything you do in FestiScout stays on your phone. Creating an account is optional; if you do, we store your email, a display name, and anything you choose to publish to the community — nothing else. No ads, no analytics trackers, and we never sell or share your data for marketing.
Data that stays on your device
FestiScout is built local-first. The following never leaves your phone and is never sent to our servers: your trip plans, festival check-ins (including the coordinates recorded when you check in), reviews you write, festival reminders, favorites, and app settings. If you delete the app, this data is deleted with it — we hold no copy and cannot recover it for you.
If you add a festival reminder to your calendar, the event is created in your device's calendar by the system. We only add the events you ask for; we never read your existing calendar entries.
Data we store if you create an account
An account is only needed to publish trip routes to the community and to like other travellers' routes. If you sign in, our backend (hosted by Supabase) stores:
- Your email address and a display name (an auto-generated "Traveler" name, or the name your Apple/Google account provides).
- Routes you publish: the route title, city/country label, and list of stops. Published routes are public — anyone using the app can see them along with your display name, until you unpublish them.
- Likes you give to published routes.
- Reports and blocks you submit, so we can moderate public content.
Sign-in works via a one-time email code, Sign in with Apple, or Google Sign-In. We never see or store a password. With Apple or Google we receive only your name and email address (Apple lets you hide your real email). One-time code emails are delivered through Resend, our email provider, which processes your email address for that purpose only.
Location
FestiScout asks for location permission only when you use one of two features: checking in at a festival (we compare your position to the festival city — within 50 km counts as attended) and the optional "use current location" shortcut in search. Your position is processed on the device; check-in coordinates are stored only on your phone. When you use "use current location", the coordinates are sent to the geocoding service (see below) solely to look up the place name. We do not track your location in the background, and your location is never stored on our servers.
Services the app talks to
Like any map app, FestiScout loads content from a few external services. When it does, those services receive the technical minimum a web request carries (such as your IP address):
- Supabase — authentication and database for community features.
- Resend — sends one-time sign-in code emails.
- Apple / Google — only if you choose them for sign-in, under their own terms.
- OpenStreetMap / CARTO — map tiles; tile servers see which map areas you view.
- Photon (komoot) — place search and reverse geocoding; receives the text you search and, for "use current location", your coordinates.
- Booking.com — hotel links are affiliate links. Nothing is shared until you tap one; tapping opens Booking.com with a code identifying FestiScout as the referrer, and their privacy policy applies from there. We may earn a commission on bookings.
What we don't do
No advertising, no ad tracking, no analytics SDKs, no selling or renting personal data, no reading your contacts, photos, or calendar. We don't use your data to train AI models.
Deleting your data
You can delete your account inside the app: Profile → Account → Delete account. This immediately and permanently removes your profile, email, published routes, and likes from our servers. Data on your phone is removed by deleting the app. You can also email us to exercise any data right (access, correction, deletion) — we honor these requests regardless of where you live.
Data retention & security
Account data is kept only while your account exists. All traffic between the app and our backend is encrypted in transit (HTTPS). Our backend is hosted by Supabase on infrastructure in the United States.
Children
FestiScout is not directed at children under 13, and we do not knowingly collect data from them.
Changes
If we change what data the app handles (for example, adding photo uploads), we will update this policy and the effective date above before the change ships.
Contact
Questions or requests: hello@festiscout.com