Plain-English summary
Fanlore powers artist-branded fan apps like Mystic Methods and Ninth Key. This policy explains what we collect, why, and who sees it.
The most important point: when you join an artist's community on Fanlore, the artist and their authorized team can see your profile, your points, the actions you've taken to earn them (like which shows you checked into and what you bought), and the requests you send them (like ShoutOut prompts). That is what the product is for; the artist owns their fan relationship. If you are not comfortable with that, do not create an account.
We do not sell your personal information. We do not run third-party ad networks against it. We use it to run the app you signed up for.
Who we are
"Fanlore" means Fanlore, Inc. [ENTITY NAME/STATE — confirm at incorporation], the company that builds and operates the Service. We're the "controller" of your information under most privacy laws.
The artist whose community you join (for example, Mystic Methods or Ninth Key) is a separate business. When you're inside an Artist App, they're an independent controller of the information they see about you. Their own decisions about how to use that information — for example, whether to email you about a tour — are theirs to make and are governed by their own practices.
What we collect
Account information you give us. Name (first, last, display name), email, phone (if you give one), avatar image, city, state, country, and, if you connect it, your Instagram handle. If you sign in with Apple or Google, we get a stable identifier (Apple's "user identifier" or Google's "sub") plus the email you choose to share, and nothing else about your Apple or Google account.
Connected accounts. If you link Spotify, YouTube, or X (Twitter) to earn points:
- Spotify. We ask for permission to see your email and to follow the artist on your behalf (scopes:
user-read-email user-follow-modify user-library-modify). We use the access token to try to add the artist to your library or following list, and then we discard it. We don't read your listening history, playlists, or saved tracks. - YouTube / Google. We ask for permission to see your account and to subscribe to the artist's channel (scope:
youtube.force-ssl). We use the access token to try to subscribe you, then discard it. We don't read your watch history or other subscriptions. - X (Twitter). We ask for permission to read your basic profile and to follow the artist on your behalf (scopes:
users.read follows.read follows.write). We use the token to attempt the follow and to verify it, then discard it. We don't read your DMs, tweets, or followers list.
Where a follow can't be verified through the API (for example, when the platform's API tier restricts it), we record that you completed the authorization and award points on that basis.
Location. If you opt in, we use your device's location to check whether you're inside the geofence of a live show for a check-in reward. Location is captured at the moment of check-in and turned into a yes/no decision plus a record of which show you checked into. We don't background-track your location, and you can revoke location permission in iOS Settings at any time (you just won't be able to earn show check-in points).
Activity in the app. Points earned and spent, tier, game scores, quiz answers, poll and setlist votes, chat messages you post (in artist and community channels), ShoutOut prompts you submit, merch swipes and favorites, and the actions that earned each point (following on Spotify, buying merch, checking into a show, etc.).
Purchases. When you buy through Apple in-app purchase, Apple handles the payment. We receive the Apple transaction ID, the product purchased, and (where applicable) subscription and refund events, plus a link between your Fanlore account and your Apple originalTransactionId so we can honor entitlements and refunds. We don't receive or store your credit card number. When you buy merch from the artist's Shopify store, Shopify handles the checkout and shares back the customer ID and purchase history so we can attribute points; the artist (and Shopify) have your shipping and billing details from that order.
Device information and push tokens. Push notification tokens from Apple (APNs) so we can send you push notifications, plus basic device information (iOS version, model class) for support and diagnostics.
Communications and support. If you email us, we keep your message and reply so we can help.
Automatic technical information. IP address, timestamps, error reports, and API request logs. We use these to keep the Service running, prevent abuse, and debug problems.
Where it comes from
Most of what we hold comes directly from you — you type it in when you sign up, when you connect an account, or when you use a feature. Some comes from Apple and Google when you sign in. Some comes from Spotify, YouTube, and X when you connect them. Purchase history comes from Apple's App Store and from Shopify. Location comes from your device when you tap "check in" at a show.
Why we use it
- Run the app. Sign you in, keep track of your points and tier, deliver Chest content and ShoutOuts, run games and votes.
- Verify actions. Confirm you actually did the thing you're claiming points for.
- Deliver purchases. Grant entitlements, fulfill ShoutOut requests, hand back refunds when they're due.
- Send push notifications. Announcements from the artist, ShoutOut delivery, guest-list alerts, Chest drops.
- Show the artist their fanbase. Let the artist and their team see who their community members are, what they're doing, and where they are (city / state / country, not precise location).
- Keep the Service safe. Detect fraud, catch cheating (bots, GPS spoofing, multi-account abuse), and moderate community content.
- Support you. Respond to your emails and questions.
- Improve the Service. Understand what's working and fix what isn't.
- Comply with the law. Meet our legal obligations and enforce our Terms.
Who we share it with
The artist and their authorized team. This is the important one. When you join an artist's community on Fanlore, you're joining that artist's fanbase, and the artist and their authorized team (managers, marketing, tour staff — whoever they add) can see your profile (name, email, city / state / country, avatar, phone if you gave one, Instagram handle if you connected it), your points balance and history, the actions you've taken in the app, your tier, your merch purchases from their Shopify store, the shows you've checked into, your chat messages in their community, the ShoutOut prompts you sent them, and other information that helps them run their fan program. The artist may export their fan list from their admin dashboard. The artist decides how to use that information within their own privacy practices.
Service providers who help us run the platform. We use trusted vendors to operate the Service. Each of them only receives what they need to do their job:
- Cloudflare — website and app content delivery, DDoS protection, and object storage (R2) for images and videos.
- Fly.io — our backend servers, hosted in the United States.
- Apple — Sign in with Apple, in-app purchase, and push notifications (APNs).
- Google — Sign in with Google.
- Shopify — merch checkout and order linkage.
- Sentry — error and crash reporting (we scrub personal data from error payloads on a best-effort basis).
- Spotify, YouTube, and X (Twitter) — only when you choose to link one of these accounts, and only for the limited purposes described above.
- An SMS or email delivery provider if and when we add those channels; we'll update this policy before we do.
Legal and safety. We may share information when we're required to by law, subpoena, or court order; to enforce our Terms; to investigate fraud or abuse; or to protect the rights, safety, or property of Fanlore, our users, or the public.
Business transfers. If Fanlore is acquired or reorganized, information may transfer as part of that deal. If it does, we'll require the acquirer to honor commitments in this policy or give you notice and a chance to object where the law requires it.
What we do not do. We do not sell your personal information for money. We do not run third-party advertising networks that profile you. We do not share your information with data brokers.
Push notifications
If you allow push notifications, the artist can send announcements straight to your lock screen. You can turn push off any time in iOS Settings > Notifications, or by tapping the app's notification settings.
How long we keep it
We keep account information for as long as your account is active. When you delete your account, we delete or de-identify your personal information within a reasonable period, except where we need to keep some of it to comply with the law (tax and financial records around purchases, for example), resolve disputes, or enforce our Terms. Aggregated or de-identified information that no longer identifies you may be kept longer.
Note that content you posted in artist or community chat may remain visible to the artist and other fans in the chat history after your account is deleted, in a form that no longer identifies you as the poster (for example, "deleted user").
How we protect it
We use industry-standard measures — TLS in transit, access controls, secret management, minimum-necessary access for our team, and error monitoring — to protect the Service. Nothing on the internet is 100% secure. We can't guarantee that a determined attacker won't succeed, and we can't be responsible for what other users do with information the app shows them (like your display name in the leaderboard). Use a strong, unique password and don't share your login.
Your privacy rights
Depending on where you live, you may have rights over your personal information. In the United States, laws like the California Consumer Privacy Act ("CCPA") as amended by the CPRA and similar laws in other states give you the following rights:
- Know. Ask what personal information we hold about you, where it came from, why we have it, and who we share it with.
- Access. Get a copy of the personal information we have about you.
- Delete. Ask us to delete your personal information.
- Correct. Ask us to fix inaccurate information.
- Opt out of "sale" or "sharing". We don't sell or share your personal information for cross-context behavioral advertising, so there's nothing to opt out of.
- Limit the use of sensitive personal information. We use sensitive information only for the purposes described in this policy.
- Non-discrimination. We won't discriminate against you for using any of these rights.
To make a request, email support@fanlore.io [confirm] from the email address on your Fanlore account. We may need to verify your identity before we can act on your request. You can authorize an agent to make a request on your behalf; we'll ask them to confirm you gave them written permission and to verify their own identity.
If we deny your request, you can appeal by replying to our denial email and telling us you're appealing.
Deleting your account
To delete your account today, email support@fanlore.io [confirm] from the email address on your Fanlore account and ask us to delete it. We'll confirm and process the deletion within a reasonable period, typically within 30 days. An in-app deletion option is on our roadmap; when it ships we'll update this policy.
Deleting your account removes your profile and personal information from the Fanlore backend as described under "How long we keep it." Content you posted in community chat may remain visible with your identity removed. Information already exported by the artist to their own systems (for example, an email you're on a mailing list for) is under the artist's control after export; you'll need to contact the artist to have them delete it.
Age requirement
The Service is for adults 18 and older. We do not knowingly collect personal information from anyone under 18. If we learn an account belongs to someone under 18, we will terminate it and delete the associated data. The apps are rated for adults on the Apple App Store.
International users
Fanlore is based in the United States and our servers are in the United States. If you use the Service from outside the United States, you understand that your information is transferred to and processed in the United States, which may have different privacy protections than your home country. By using the Service, you consent to that transfer.
Changes to this policy
We'll update this policy from time to time. If we make a material change, we'll give you notice inside the app or by email before it takes effect. The "Last updated" date at the top of this page always shows the current version.
Contact us
Questions, requests, or complaints about privacy? Email support@fanlore.io [confirm].
Fanlore, Inc. [ENTITY NAME/STATE — confirm at incorporation]