The iOS app asks for add-only photo-library permission when you choose to save generated artwork. Setlist does not read your photo library through that permission. A venue or place name you enter is user content; Setlist does not request your device's location to obtain it.

• Provide, authenticate, operate, sync, and maintain Setlist across devices.
• Create and manage bands, gigs, libraries, setlists, invitations, and collaboration.
• Process the AI features you request, such as song parsing, online search, suggestions, and artwork generation.
• Store and deliver uploaded or generated images and files.
• Send service messages and push notifications you enable, including band invitation updates.
• Respond to support, feedback, beta-access, and privacy requests.
• Enroll you in the iPhone (Apple TestFlight) or Android testing program when you request beta access, and contact you about that invite.
• Measure feature use, troubleshoot errors, improve performance, and develop Setlist.
• Protect accounts and the service, prevent abuse or fraud, enforce our terms, and comply with law.

Where applicable law requires a legal basis, we process information to perform our agreement with you, for legitimate interests such as securing and improving Setlist, with your consent where requested, and to meet legal obligations. You may withdraw consent at any time, without affecting prior processing.

We share information only as needed to provide Setlist, at your direction, or for the legal and safety reasons described below. Our main categories of service providers are:

When you invoke an AI feature, the text, prompt, image, file, or other input needed to fulfill that request may be sent to the applicable AI provider. Do not submit sensitive personal information that is unnecessary for the requested feature.

If you request beta access, we share the email address you provide with the relevant app distribution platform (Apple TestFlight for iOS, or Google Play testing for Android) so it can send you a testing invitation. That email is added to the testing program by hand, and those platforms handle it under their own privacy terms. You can ask us to remove you from the testing list at any time using the contact details below.

We may also disclose information when reasonably necessary to comply with law or legal process, protect the rights and safety of users or others, investigate abuse, or complete a merger, financing, acquisition, or sale of assets. We require providers that process information for us to protect it and use it only for authorized services, consistent with this policy and applicable law.

We keep account information and service content while your account is active and for as long as reasonably needed to provide Setlist. Content you delete is removed from active product systems as part of the service's normal operation. Some information may remain for a limited period in backups, security logs, or provider systems, or longer when required for legal compliance, fraud prevention, dispute resolution, or enforcement.

You can delete individual gigs, songs, library entries, and artwork using available controls. To request deletion of your entire account and associated personal information, submit a request through our contact form. Deleting the iOS app or signing out does not by itself delete server-side account data. We may verify your identity before completing a request. For shared band workspaces, we will also account for the rights of other members and may transfer administration, delete, or de-identify content as appropriate.

Depending on where you live, you may have rights to access, correct, delete, restrict, object to processing, or receive a portable copy of your personal information, and to appeal a denied request or complain to a data protection authority. Submit a request through our contact form. We do not discriminate against anyone for exercising a privacy right.

On the web, you can limit cookies or clear local storage using browser controls, although blocking essential cookies may prevent sign-in or other features from working. Google, Mixpanel, and Hotjar also provide their own privacy and opt-out controls.

We use reasonable administrative, technical, and organizational safeguards designed to protect information, including encrypted network connections and access controls. Authentication credentials in the iOS app are stored using Apple's Keychain. No internet transmission or storage system is completely secure, so we cannot guarantee absolute security.

Setlist and its providers may process information in countries other than the one where you live. Where required, we use recognized safeguards for international transfers and require an appropriate level of data protection.

Setlist is not directed to children under 13, or a higher minimum age where local law requires it, and we do not knowingly collect personal information from children below that age. If you believe a child has provided personal information, contact us so we can review and delete it as appropriate.

We may update this policy as Setlist or legal requirements change. We will post the revised policy here and update the effective date. If a change materially affects how we use personal information, we will provide additional notice when required.