Privacy Policy

This Privacy Policy explains how underpass ("underpass," "we," "us") collects, uses, shares and protects personal information through underpass.live, the underpass iOS app, our emails, and related services (together, the "Service"). It applies together with our Terms of Service. For the purposes of privacy laws that use the term, underpass is the "controller" or "business" responsible for your information.

We collect this information from you directly, from your device as you use the Service, and from our service providers as they run it for us. We do not buy personal information, and we do not combine your information with data from data brokers or social networks.

Some features run entirely on your device. We never receive this information:

• Location. If you allow it, your browser or phone uses your location to center the map and show how far away a venue is. The coordinates stay on the device. On iPhone we ask only for "While Using the App" access. You can turn it off any time in your browser or iOS settings.
• Reminders. Show-day and weekend reminders in the iOS app are scheduled on your phone. We don't use push notification servers and never receive a device token.
• Offline copy. The iOS app keeps a recent copy of listings on your phone so it opens without a signal.
• Guest saves. If you save shows before signing in, they live on the device. They are copied to your account when you sign in.
• Small settings such as a card you dismissed, whether a preview was playing, or a prompt you've already seen.

Cookies. The website sets cookies only when you sign in, to keep you signed in. They are strictly necessary for the account to work, are secure and HTTP-only, and are removed when you sign out or the session ends. The iOS app keeps its session in the phone's secure storage instead.

Browser storage. The website uses your browser's local and session storage for the on-device items listed above and for the random tab ID used in page views. This data stays in your browser; you can clear it in your browser settings at any time.

Analytics. Our hosting provider's analytics measure page traffic and load speed without cookies, without device fingerprinting, and without following you to other sites.

What we don't use. No advertising cookies, ad pixels, social media pixels, session recording, cross-site tracking, or the iOS advertising identifier. Because we don't track you across sites or apps, the iOS app never shows Apple's "Allow tracking" prompt.

Browser signals. We treat Global Privacy Control and Do Not Track as a request to opt out of sale, sharing and targeted advertising. We already don't do any of those, so nothing about the Service changes when your browser sends them.

We use personal information to:

• provide the Service: accounts, saved shows, Match, the map and your profile;
• rank shows in For You using the preferences you set and the shows you save and skip;
• send account emails you need, such as confirming your address or resetting your password;
• answer your messages and handle partner requests;
• keep the Service secure and stop abuse, fraud and automated sign-ups;
• understand how the Service is used and fix what isn't working; and
• meet legal obligations and enforce our Terms.

We don't send marketing email. If we ever offer it, it will be opt-in. We don't make decisions about you by automated means that have legal or similarly significant effects; For You is a sorted list of shows, and you can ignore it. We don't sell, license or hand your personal information to anyone to train AI models.

Legal bases (for laws that require them): performing our agreement with you (your account and its features), your consent (optional profile details and location, which you can withdraw at any time), legitimate interests (security, abuse prevention, understanding usage, which we balance against your rights), and legal obligation.

The Service shows promoted placements from venues, artists, promoters and other live-music businesses. Each one is labeled "Featured" or "Sponsored" on the artwork. Which placement you see depends only on where you are in the Service (Discover, the map or Match) and the dates you are browsing. Your profile, saves, location and history are not used to pick ads.

We count how many times each placement is shown, per day and per position. Those counts are not linked to you or your device, and they are the only performance figures partners receive. We don't use ad networks, and no advertiser can place code, pixels or trackers on the Service.

If you tap through to an advertiser's site or ticket page, that site's own privacy policy applies from there.

We disclose personal information only to:

• Service providers that run parts of the Service for us: website hosting and traffic analytics, the database and sign-in system, account email delivery, our email inbox, and bot protection. They may use the information only to provide their service to us, under written terms that require them to protect it. We'll name any of them on request.
• Legal and safety recipients, when we believe in good faith that the law requires it (for example, a valid subpoena or court order) or that it is needed to protect someone's safety, investigate fraud or abuse, or enforce our Terms. Where the law allows, we tell you first.
• A successor, if underpass is merged, acquired or its assets are transferred. This Policy will keep applying to your information unless you are told otherwise and given a chance to delete your account.
• Anyone else you ask us to share with.

We do not sell personal information, share it for cross-context behavioral advertising, rent it or trade it, and we have not done so in the past 12 months. We don't give partners, advertisers, venues or ticket sellers any individual user's information. Our own staff see only what they need; internal reporting on how people use underpass is aggregate.

Some content on the Service loads straight from other companies' servers to your browser or phone: event artwork from venue and ticketing sites, map tiles from our map provider (Apple Maps in the iOS app), and short song previews from Apple's music preview service. Like any web request, those servers receive your IP address and basic browser or device details. We send them nothing about your account.

Ticket links, venue links and "Listen" links to Spotify or Apple Music take you to sites we don't control. Anything you do there, including buying a ticket, is covered by their terms and privacy policies, not this one.

We may keep specific information longer when the law requires it, to resolve a dispute, or to prevent fraud or a repeat of abuse, and only for as long as that reason lasts.

• Edit your details and preferences any time in Profile, on the web or in the app.
• Delete your account in Profile, on the web or in the app. It takes effect immediately.
• Reset Match in Profile to clear the shows you've skipped.
• Location can be switched off in your browser or iOS settings without losing anything else.

You can also ask us to give you a copy of your personal information (in a portable format), tell you what we hold and how we use it, correct it, delete it, or restrict or object to how we use it. Email hello@underpass.live from the address on your account. We may ask you to confirm it's you before acting, and we'll respond within 30 days (45 days where state law allows, extended once if we tell you why). Requests are free. You can use an authorized agent; we'll ask for proof that they act for you.

If we turn down a request, we'll say why. Where your state gives you a right to appeal, reply to our decision with "Appeal" in the subject and we'll answer within the time your state's law sets. If you're still not satisfied, you can contact your state attorney general or data protection authority. We will never treat you differently, charge you more, or offer you less for using any of these rights.

California. This Policy is our notice at collection under the California Consumer Privacy Act, as amended. In the past 12 months we collected these categories: identifiers (name, email, phone, account ID, IP address); personal records (name and contact details); characteristics of protected classifications (age, via date of birth); internet or network activity (page views, saves, skips); and inferences limited to the show rankings in For You. The sources, purposes, recipients and retention periods for each are described above. We disclosed these categories only to service providers for business purposes. We do not sell or share personal information, have no actual knowledge of selling or sharing information of anyone under 16, offer no financial incentives for personal information, and do not use sensitive personal information to infer characteristics about you, so the right to limit its use does not apply. Under California's "Shine the Light" law, we do not disclose personal information to third parties for their own direct marketing.

Other U.S. states. Residents of states with consumer privacy laws (including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia) have the rights in "Your rights and choices," including the right to appeal. We don't sell personal data, use it for targeted advertising, or profile people in ways that produce legal or similarly significant effects, so there is nothing to opt out of. Our only processing of sensitive data is your date of birth, used to confirm age, which you provide with your consent at sign-up.

Outside the United States. underpass is built for people going out in New York City and is run from the United States. If you use it from elsewhere, your information is processed in the United States. If the GDPR or UK GDPR applies to you, you have the rights listed above plus the right to complain to your local data protection authority, and where we transfer your information internationally we rely on Standard Contractual Clauses or another lawful mechanism.

You must be 18 or older to create an account, and we check your date of birth at sign-up. The Service is not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has given us personal information, email hello@underpass.live and we will delete it.

We use reasonable administrative, technical and physical safeguards, including encryption in transit (HTTPS) and at rest, row-level access rules that keep each account's data separate, two-factor authentication and logging for administrative access, and least-privilege access for staff and providers. No system is perfectly secure, so please use a password you don't use anywhere else.

If a breach affects your personal information, we will notify you and the authorities as the law requires, including under New York's SHIELD Act, without unreasonable delay.

We'll post any update here with a new effective date. If a change is material, for example a new kind of data or a new use for it, we'll tell signed-up users by email or in the Service before it takes effect. We will not use information we already hold in a materially different way without your consent.

Privacy questions and requests: hello@underpass.live. Copyright notices: dmca@underpass.live. Other ways to reach us are on the contact page.