Privacy

Who is responsible

Goodraves is run by Pedro Jorge and Maarten van den Hoven, who are jointly responsible (joint data controllers) for the personal data described here. Questions, requests and complaints can go to either of us:

• Pedro Jorge: pedro.simao10@hotmail.com
• Maarten van den Hoven: info@maartenvandenhoven.com

What we store

• Account: your username, your password (only as a one-way bcrypt hash, never readable) and when you signed up. We don't ask for your email, real name or phone number.
• Profile, if you fill it in: your home city and favourite genres.
• What you do on the site: festivals you're going to or went to, your festival and set ratings, notes, comments, artists you follow or want to see, friends and friend requests, and festivals you add yourself.
• Technical data: your IP address, used to stop password guessing and abuse. We keep it for at most a day. Our hosting provider also keeps short-lived request logs that include IP addresses.

Why, and on what legal basis

• Your account, profile and activity are needed to run the service you signed up for (performance of a contract, GDPR art. 6(1)(b)).
• IP addresses and logs keep the site secure and working (legitimate interest, GDPR art. 6(1)(f)).

We don't use your data for advertising, profiling by third parties or automated decisions about you.

Who can see what

• Other users can find you by username to send a friend request.
• Friends you've accepted see your festivals, set ratings, comments and the artists you follow.
• Only you see your personal notes, home city and genres.
• The two of us running Goodraves can access the database to keep it working and to answer your requests.

Services we use

• Vercel hosts the site, running in Frankfurt (EU).
• Neon hosts the database, in Frankfurt (EU).

Both are US companies acting as our processors. Where data could reach the US, it's covered by the EU–US Data Privacy Framework and the European Commission's standard contractual clauses.

Some features load content straight from other sites, which then see your IP address:

• The map loads its tiles from OpenStreetMap.
• Some festival and artist images load from where they're published, such as Resident Advisor, Partyflock, FestivalFans, Spotify, Last.fm and Wikimedia.
• The Spotify player on a festival page only loads when you press “Load Spotify player”. Spotify can then set its own cookies under Spotify's privacy policy.

Cookies and storage

Goodraves sets one cookie: your login session, which is strictly necessary and expires after 7 days. Your theme choice is saved in your browser's local storage. There are no analytics, advertising or tracking cookies, which is why there's no cookie banner.

How long we keep it

Your data stays until you delete your account. Deleting it removes your account and everything linked to it straight away. The database provider keeps short-term backups for disaster recovery, which roll over within days. IP addresses used for abuse protection are deleted within a day.

Your rights

Under the GDPR you can:

• see the data we hold about you, or get a copy you can take elsewhere;
• correct it;
• have it deleted, which you can do yourself under Profile → Delete account;
• object to or ask us to limit how we use it.

For anything you can't do in the app, email pedro.simao10@hotmail.com and you'll get an answer within a month. You can also complain to your data protection authority. In the Netherlands that's the Autoriteit Persoonsgegevens.

Age

Goodraves is for people aged 16 and over. If you're younger, please don't create an account.

Changes

If this policy changes, the date at the top changes too. Big changes will also be announced on the site.