Privacy Policy.

What we collect

When you sign in with Spotify, we receive and store:

• Your Spotify display name, email address, and profile image
• An encrypted copy of your Spotify refresh token (AES-256-GCM, at rest), so we can keep your session active without asking you to sign in again on every visit

We never see or store your Spotify password, and we never collect payment or financial information — Fanpit doesn't process purchases of any kind. When you buy a ticket, you leave Fanpit entirely and complete that purchase on Ticketmaster or another third-party ticketing site.

What we access from Spotify

Signing in grants Fanpit these specific permissions, and nothing broader:

• user-read-email — your email address
• user-top-read — your top artists, by time range
• user-follow-read — the artists you follow
• user-read-recently-played — your recently played artists

This data drives your Explore feed and is never used for anything beyond building it. You can review or revoke Fanpit's access at any time from your Spotify account's connected-apps settings.

Third-party show data

We query Ticketmaster (and, where available, Bandsintown) for upcoming shows matching the artists in your feed. We send an artist name and receive event listings back — we don't send them anything that identifies you personally. Ticket links take you directly to the provider's own site, governed by their own terms and privacy policy.

Cookies and analytics

Fanpit uses a single session cookie to keep you signed in — no advertising or cross-site tracking cookies. We use Vercel Analytics for aggregate, cookie-less usage statistics (page views, not individual behavior) and Sentry for error monitoring, which may capture technical details about a crash (like the page you were on) but not your Spotify listening data.

How long we keep your data

We keep your data for as long as your account exists. Deleting your account (from Settings) permanently removes your stored data, including your encrypted refresh token, immediately.

What we don't do

We don't sell your data. We don't share it with advertisers. We don't use it for anything beyond operating Fanpit itself.

Children's privacy

Fanpit is not directed at children, and we don't knowingly collect data from anyone under the age required to hold a Spotify account in their country.

Changes to this policy

If this policy changes, we'll update the date at the top of this page. Material changes will be noted clearly here.

Contact

Questions about this policy or your data: hello@fanpit.org