Privacy Policy — My Concert Buddy
Last updated: 12 October 2026
English · Български · Čeština · Dansk · Deutsch · Ελληνικά · Español · Français · Magyar · Italiano · 日本語 · 한국어 · Norsk bokmål · Nederlands · Polski · Português · Română · Svenska
My Concert Buddy is published by Heppsu Consulting Ltd. This policy explains what the app does with your data. It is written to be read, not to be survived.
The short version
The app works without an account and without the internet. Your tickets, your concert memories, their photos and every signal screen live on your phone and are never sent anywhere. You only need an account for My Concert Buddy Plus, for the optional cloud copy and for submitting an event to the public catalogue.
What we store, and why
Account (only if you create one). Your email address, a one-way hash of your password, an optional display name, and the times you confirmed your email and accepted the Terms. We need these to sign you in and to attach a subscription to someone. Sessions are kept as a short identifier per sign-in so that signing out really ends that session.
Confirmation codes. A hash of the code we email you, and its expiry. We store the hash, not the code.
Subscription. When you buy Plus, Apple or Google confirms the purchase to our server. We keep the store's transaction reference (for Google, a hash of the purchase token, never the token itself), the platform, the environment and the moment we verified it. This is what lets us tell you why a purchase did or did not unlock Plus, and it stops one receipt from unlocking ten accounts. Your card details never reach us — the store handles payment.
Plus access. Whether your subscription is active is held by Heppsu Subscriptions, our own subscription service, keyed by your account identifier.
Events you submit. If you send us a concert for the catalogue, we keep what you typed, and that it was you who sent it, so we can review it and answer you. Published events are public.
Problem reports. If you use “Report a problem”, the subject, the text, the app version, the platform, your interface language and — if you give it — your email address go to our internal ticketing system so we can reply.
Crash reports (only if you turn them on). If you turn on “Crash reports” in Info and the app crashes, on the next launch we send the kind of error, the lines of code where it happened, the app version, the major version of your phone’s system and the time to the minute. The error text goes through a filter that removes email addresses, quoted text, long numbers and file paths; your tickets, notes and photos are never sent. Reports go to our internal system and are deleted after 30 days. If you turn the setting off, any reports not yet sent are deleted from the phone.
Location. Location sharing happens on your phone. The app reads your position once, builds a map link and hands it to your own share sheet; you choose who receives it and through which app. The point is not sent to our server and we do not track you. The link expires at the time shown in the app, but a message you already sent cannot be taken back.
Concert venue. If you search for a venue, what you type goes to the map service built into your phone so it can find the place — we don’t receive it. The venue’s coordinates stay on your phone together with the concert. “Open in Maps” opens the maps app you use.
Contacts. If you use the button next to “Who are you going with” to pick people from your contacts, the choice is made in your phone’s own contact picker. The app does not get access to your address book: it receives only the contacts you tap and keeps only their names, inside the concert record on your phone. We do not receive them.
Colour group invitations. When you share a colour code, you can add your name and a short note to it. They become part of the link you send through the app you choose — they do not reach us. The page that the link opens for people without the app reads this data in their own browser and does not send it to our server. We do not store groups, names or notes.
Concert reminders. If you turn on concert reminders, the app asks your phone for permission to show notifications and sets the reminders on your phone, shortly before each concert you have saved. The phone itself schedules and shows them. The concert details used for the reminders stay on your phone and do not reach us. You can turn reminders off in the app or in your phone's settings at any time. Invitations you receive from friends are listed in the notifications screen of the app, on your phone only; we do not store them.
Photos. Ticket photos and concert photos are copied into the app's own storage on your phone. They are not uploaded, unless you turn on the cloud copy that comes with Plus — and then only the photos you have saved.
We do not use advertising networks, we do not profile you, and we do not sell anything about you to anyone.
Permissions the app asks for
- Location — only while you are sharing your position, and only for that.
- Photos / camera — only when you add a picture to a ticket or a memory.
- Notifications — only if you turn them on.
You can refuse all of them and keep using the app; the parts that need them simply say so.
How long we keep it
Account data lives as long as your account does. Delete your account inside the app (Info → Account → Delete account) and it goes, together with your sessions, your codes and your purchase records; the subscription is cancelled in our subscription service at the same time. Cancelling the payment itself happens in the store on your platform — only the store can stop taking money. Problem reports and published events stay, because a conversation and a public catalogue entry cannot be rewritten after the fact; we remove your email address from a report on request.
Who else sees it
- Apple / Google — they run the payment and tell our server whether a subscription is alive.
- Our own infrastructure — servers we rent and operate in the European Union.
- Email delivery — Google Workspace, for confirmation codes.
That is the whole list. No analytics SDK, no advertising SDK, no data broker.
Your rights
You can ask us for a copy of your data, ask us to correct it, or ask us to delete it — the last one you can also do yourself, in the app, without asking. Write to info@heppsu.com. If you think we have handled your data badly you can complain to your national data protection authority.
Children
The app is not intended for children under 13 and we do not knowingly create accounts for them.
Changes
If this policy changes in a way that matters, the app will tell you before the change takes effect.
Heppsu Consulting Ltd · info@heppsu.com