Privacy Policy

Effective November 2, 2026. Applies to findeveryshow.com, the Roaring Fork Valley Digest email, and our calendar, API and MCP endpoints (together, "FindEveryShow", "we", "us"). FindEveryShow is operated by [TODO: LEGAL ENTITY NAME].

1. What we collect

Information	When	Why
Email address	You sign up, follow a venue or artist, or subscribe to a household list alert	To send the digest and alerts you asked for
Mobile phone number and SMS opt-in	Only if you type it into a follow form	To send show alerts by text, if and when we offer them
Instagram or X handle	Optional field at signup	To personalize recommendations and recognize you if you message us
Preferences: towns, genres, music sub-genres, muted and pinned venues, preferred music app and calendar app, the venue or artist page you signed up from	Signup and calendar settings	To build your digest and calendar
Household ticket list (list name, shows you mark, optional seat notes)	Only if you use the "My Household Shows" list	To show and export your own ticket list
Location: the zip code, town or coordinates you enter for "near me" search, plus the approximate city that Cloudflare derives from your IP address	When you search near you	To answer that search. We do not save it to your profile and we do not store your IP address in our database
Spotify data (optional, see section 3)	Only if you click Connect Spotify	To match shows to your music taste

We do not collect payment details. We do not buy data about you from anyone.

2. How we use it and who we share it with

We use your information only to run FindEveryShow: building and sending your digest and alerts, showing your calendar and ticket list, fixing bugs and keeping the service secure. We do not sell your personal information and we do not share it with advertisers, venues or sponsors.

Service providers that process data for us:

Cloudflare, Inc. hosts the site and stores our database (Cloudflare Workers and D1). Cloudflare also keeps short-lived request logs (which include IP addresses) for security and debugging.
Beehiiv is the email platform we use to send the newsletter. We give Beehiiv your email address and the digest preferences needed to send it. We never give Beehiiv any Spotify data.

Sponsored spotlights: the newsletter may include sponsored spotlights for artists, venues or events. Sponsors never receive your personal information. Spotlights are placed by region, venue, date or the genres you picked yourself. They are never targeted, selected or measured using Spotify data.

We may also disclose information if the law requires it, to protect people's safety, or as part of a sale or reorganization of the service (in which case this policy, including the Spotify rules below, keeps applying to that data).

3. Spotify data

What we read: when you choose Connect Spotify, we ask Spotify only for the permissions user-top-read and user-follow-read. From those we read your top artists, the artists you follow, and those artists' genres, plus your Spotify user id and display name so we can show "Connected as ...". We never request your Spotify email address, password, playlists, listening history beyond top artists, or payment details.

Why: only to match valley shows to your taste and highlight them in your own digest and calendar.

What we keep: a short list of artist names, genres and your Spotify user id. Your Spotify login token is used once to fetch that list and then discarded. We never store it.

What we never do: we never sell Spotify data, share or transfer it to advertisers, ad networks, sponsors, data brokers, Beehiiv or any other third party, use it to target or measure ads or sponsored spotlights, or use it to train or feed AI or machine-learning models. It is never published in our public API, MCP server, /llms.txt files or structured data.

Retention: the browser connection lasts up to 7 days. The copy saved with your signup is refreshed each time you reconnect and is deleted automatically 90 days after your last connection.

Disconnect and delete: visit Disconnect Spotify (also linked next to the Connect Spotify button and in the site footer). It deletes your Spotify data from our database immediately. You can also remove our access from your Spotify account at spotify.com/account/apps.

FindEveryShow is not affiliated with, sponsored by or endorsed by Spotify. Spotify is a third-party beneficiary of this Privacy Policy and our Terms and may enforce them.

4. Cookies and browser storage

We use no advertising or analytics cookies and we do not load third-party trackers. We set only these:

Name	Type	Purpose	Lasts
`rfv_spotify_pkce`	Cookie (first party, HttpOnly)	Security check during Spotify connect	10 minutes
`rfv_spotify_session`	Cookie (first party, HttpOnly)	Remembers that this browser connected Spotify	7 days, or until you disconnect
`rfv_user_email`, `rfv_music_service`, `rfv_music_service_chosen`, `rfv_list_key`, `rfv_tickets_`, `rfv_pinned_venues`, `rfv_unpinned_venues`, `rfv_hv_dismissed_`	localStorage (stays on your device)	Remember your email, music app, ticket list and venue pins so you do not retype them	Until you clear site data
`rfv-form`	sessionStorage	Keeps your half-finished signup form if you leave to connect Spotify	Until you close the tab

Third-party cookies: we do not place any. Listen, ticket and calendar links take you to other sites (for example Spotify, Apple Music, YouTube, venue box offices, Google Calendar). Those sites set their own cookies under their own policies once you visit them.

Managing them: you can delete these cookies and storage at any time in your browser settings (for example "Clear site data" for findeveryshow.com) or block cookies for our site. The site still works without them; you will just need to re-enter your preferences, and Spotify matching will not stay connected.

5. How long we keep data

Signup email and preferences: while you are subscribed. After you unsubscribe or ask us to delete your account, we delete them within 30 days (backups roll off within a further 30 days).
Spotify data: as described in section 3 (7 days for the browser connection, 90 days after your last connection for the saved copy, immediately on disconnect).
Household ticket lists: until you remove the shows or ask us to delete the list.
Cloudflare request logs: a few days, under Cloudflare's own retention.

6. Your choices and deletion requests

Unsubscribe with the link at the bottom of any digest.
Change your picks anytime by signing up again with the same email.
Disconnect Spotify at /spotify/disconnect.
Ask us for a copy of your data, a correction, or full deletion by contacting us (section 8). We respond within 30 days. Depending on where you live (for example California or the EU/UK), you may have additional rights, which we honor for everyone.

7. Children

FindEveryShow is not directed to children under 13 and we do not knowingly collect their information. If you believe a child has signed up, contact us and we will delete it.

8. Contact

Privacy questions and deletion requests: [TODO: CONTACT EMAIL, e.g. a privacy@ address Bryan chooses]. Postal address: [TODO: BUSINESS MAILING ADDRESS].

9. Changes

If we change this policy we will update the effective date above, and for material changes we will tell subscribers in the digest before the change applies.