Privacy Policy
Effective date: 27 October 2026
Festmate helps groups of friends (“crews”) plan a festival and get through it together: the lineup, chat, a shared map, expenses, rides, lodging and more. It runs on iOS, Android and the web at go.festmate.app. This policy explains what personal data Festmate handles, why, who else processes it, how long it is kept and what you can do about it.
The short version
- We collect what the app needs to work. No ads, no tracking, no selling of data, no analytics SDK in the apps.
- Your crews see what you share with them. Location, battery level and your emergency card stay private until you turn them on.
- For live location we keep only your latest position, and we delete it 15 minutes after it stops updating.
- Your data is hosted in France. A few service providers (email, push notifications, crash reports, maps) process some of it for us. They are all listed below.
- You can delete your account from the app at any time.
1. Who is responsible
Festmate is run by Teddy Valente, an independent developer based in the European Union, without a company. Under the General Data Protection Regulation (GDPR), Teddy Valente is the controller of the personal data described in this policy. You can reach us at hello@festmate.app.
2. What we collect and why
Your account
- Your email address, display name, optional bio and avatar (an icon, or a photo you upload), and your language.
- Your password, if you set one, stored only as a one-way hash. You can also sign in with a link sent by email.
- If you sign in with Google or Apple: the name, email address and account identifier they send us. With Apple’s “Hide My Email” we only receive a relay address. For Apple we also keep a token so we can revoke Festmate’s access when you delete your account.
- For each device or browser you sign in from: its IP address, device model or browser, and when it was last used. This keeps you signed in and lets us spot misuse of your account.
Why: to provide the service you signed up for (GDPR art. 6(1)(b)).
Your crews and plans
- The crews you belong to and your role in them.
- What you create in a crew: chat and ride messages, photos, reactions, starred acts, expenses and settlements, budgets, packing and gear lists, rides, lodging, arrival times, outfit posts and comments, themes, polls, plans, and the tickets and festival documents you upload.
Why: this is what Festmate does (art. 6(1)(b)).
Payment details (optional)
An IBAN, BIC or payment link (for example PayPal.me or Revolut) that you add so crew members can pay you back. Your crew members can see it.
Why: to settle expenses within your crew, at your request (art. 6(1)(b)).
Location (optional)
- Live location, only when you turn on location sharing in a crew. While it is on, your device sends its precise position every few seconds, including when the app is in the background or your phone is locked. On Android a notification stays visible the whole time. We keep only your latest position and delete it 15 minutes after it stops updating. Turning sharing off stops it right away.
- Places you choose to share: a pin you drop in the chat, a meeting point, the location of your lodging.
Your phone or browser asks for your permission first, and you can withdraw it at any time in its settings.
Why: your consent (art. 6(1)(a)), which you withdraw by turning sharing off.
Battery level (optional)
If you turn on battery sharing in a crew, your phone’s battery level is shown to that crew while you share your location, so they know when your phone is about to die.
Why: your consent (art. 6(1)(a)).
Emergency card (optional, health data)
- Your blood type, allergies and medications, and the name and phone number of an emergency contact. This is health data: we process it only because you choose to fill the card in.
- Your crews see the card only if you turn on crew sharing.
- The card also has a private link, for example to show a medic. Anyone who has that link can see the card, so share it carefully. You can empty the card at any time.
Why: your explicit consent (art. 6(1)(a) and 9(2)(a)), which you withdraw by emptying the card.
Notifications
A push token from Apple (iOS), Google Firebase (Android) or your browser, and your device’s name. They are used only to deliver the notifications you have turned on.
Why: to provide the service (art. 6(1)(b)).
Calendar feed (optional)
If you subscribe to your festival schedule in a calendar app, we create a private link that lists your starred acts. Anyone with the link can read that list. You can revoke it in your profile settings.
Safety
If you block someone, we store the block. If you report a message, we store the report and review the message.
Why: our legitimate interest in keeping crews safe (art. 6(1)(f)).
Crash reports and server logs
- When the app or the web app runs into an error, a crash report is sent to Sentry. It holds technical details (the error, device model, system and app version, the last few screens visited) and your numeric Festmate user ID, so we can match it with a support request. It does not include your name, email address, IP address or screenshots.
- Our servers keep standard logs: IP address, browser, the page requested and the time. Passwords, tokens and sign-in links are filtered out.
Why: our legitimate interest in keeping Festmate working and secure (art. 6(1)(f)).
Anonymous usage counts
The apps count how often some features are used, for example opening the chat or a quick action. Each count is per crew, per platform and per day. It holds no user ID, no device ID and no content.
Why: our legitimate interest in improving Festmate (art. 6(1)(f)).
This website (festmate.app)
- Waitlist: if you join it, your email address, the page you came from and a one-way hash of your IP address (to block abuse).
- Visits: we count page views with Umami, an analytics tool we host ourselves. It sets no cookies. The Festmate apps and go.festmate.app do not use it.
Why: your consent for the waitlist (art. 6(1)(a)), and our legitimate interest in knowing how the website is used (art. 6(1)(f)).
What we don’t collect
Your contacts, your browsing history or any advertising identifier. The apps don’t use your camera or microphone: photos come from your phone’s photo picker.
3. What your crews see
Members of a crew see your display name, avatar and bio, and everything you post in that crew. Depending on the settings you choose for each crew, they also see your starred acts, your photos in the shared album, your location and battery level, and your emergency card. They also see your payment details if you have added any. Other Festmate users who are not in your crews see none of this.
4. Who else processes your data
We don’t sell your data. These service providers process some of it to run Festmate. Except where noted, they use it only for the task listed:
- Scaleway (Paris, France): hosts our servers, database and uploaded files, so it holds all the data above.
- Resend (United States): sends our emails (sign-in links, confirmations, crew notices, your data export). It receives your email address and the content of the email.
- Google Firebase Cloud Messaging and Apple Push Notification service: deliver push notifications on Android and iOS. They receive your push token and the notification text.
- Your browser’s push service (from Google, Mozilla, Apple or Microsoft): delivers web notifications, if you allow them in your browser.
- Sentry (data stored in Germany): crash reports, as described above.
- Google and Apple, if you choose to sign in with them. Their own privacy policies apply to your Google or Apple account.
- Map providers: Apple Maps on iOS, Google Maps on Android and OpenStreetMap on the web display the maps. They receive your device’s IP address and the area of the map you are looking at, not your crew’s positions. On Android, Google Maps also collects technical details about your device, its own crash reports and how you pan and zoom the map, which Google uses to run and improve its services under its own privacy policy.
To fill in festival information (lineups, dates, venues, FAQs, weather, exchange rates), our servers also use Anthropic (Claude), Brave Search, Browserless, OpenStreetMap Nominatim, Open-Meteo and the European Central Bank. They receive festival information only, never your account, messages or location.
Some of these providers are based in, or process data in, the United States. Those transfers rely on the EU–US Data Privacy Framework or on the European Commission’s standard contractual clauses.
We may also disclose data if the law requires it, for example in answer to a valid court order.
5. How long we keep it
| Account and crew data | As long as your account exists. See “Deleting your account” below. |
|---|---|
| Live location | Only your latest position, deleted 15 minutes after it stops updating. |
| Meeting points | Until they expire. |
| Notifications in your inbox | 30 days. |
| Signed-in devices | Until you sign out, or after 180 days without use. |
| Crash reports | 90 days at most. |
| Server logs | Rotated automatically. We keep no archive. |
| Waitlist | Until we invite you or you ask us to remove you. |
| Usage counts | As long as the crew exists. |
| Database backups | 30 days. |
6. Deleting your account
In the app, go to Settings › Delete account. On the web, sign in at go.festmate.app and open Delete account from your profile. If you can’t sign in any more, write to hello@festmate.app from your account’s email address and we will delete it for you.
- Immediately: you are signed out on every device and your sign-in links stop working. Notifications stop, and your emergency card link and calendar links stop working. If you used Sign in with Apple, we ask Apple to revoke Festmate’s access. We email you a copy of your account details and crew memberships.
- Within 24 hours: your email address, name, bio and avatar are erased. You leave every crew, which deletes your location, battery level, arrival times, lodging spot, tickets, documents and outfit posts. Your emergency card, payment details, starred acts, notifications, calendar links and Google or Apple sign-in links are deleted too.
- What stays: the messages and photos you posted in crew chats, and the expenses and settlements you were part of, stay with the crew under “Deleted user”. That way conversations and balances still make sense for everyone else. Delete your messages first if you want them gone, or ask us to do it.
Our database backups are kept for 30 days, so deleted data is gone from them 30 days later at most.
If you change your mind, write to us within 24 hours and we can restore your account.
7. Your rights
Under the GDPR you have the right to:
- access your personal data and get a copy of it;
- have it corrected (you can edit most of it in the app);
- have it deleted;
- restrict or object to its processing, including processing based on our legitimate interests;
- receive it in a portable format;
- withdraw your consent at any time, by turning sharing off, emptying your emergency card or revoking a permission. This doesn’t affect the processing that happened before;
- lodge a complaint with a data protection authority, in particular the one in the EU country where you live (in France, the CNIL).
To use any of these rights, write to hello@festmate.app. We answer within one month. We may ask you to write from your account’s email address, to check that the request comes from you.
8. Security
Everything between the apps and our servers travels over HTTPS. Our servers are in France and only the operator can access them. On your phone, your sign-in token is kept in the iOS Keychain or protected by the Android Keystore, and signing out removes Festmate’s data from the device. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data.
9. Children
Festmate is not meant for anyone under 16, and we don’t knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.
10. Changes to this policy
When we update this policy, we change the date at the top of this page. For significant changes, we tell you in the app or by email before they take effect.
11. Contact
Questions about this policy or your data: hello@festmate.app.