Privacy policy

If you just browse, we don't store anything about you. To pick a sensible starting area for the map, our server looks up the rough city your IP address belongs to (see "Who we share it with"). The answer is kept in memory for up to a day so repeat visits are quick, and is never saved to our database.

If you create an account, we store:

• your email address and a securely hashed password, or your Google account's name and email if you sign in with Google
• the display name you choose, if any
• your account type (enthusiast, venue or artist)
• your home suburb, if you set one, as a place from Google's address suggestions with its map coordinates
• the gigs and venues you save, and the gig filters you choose to save

If you claim a venue, artist or gig page, we store what you send with the request: your name, your role, a contact email, a phone number and an official website or social link if you give them, and your message. We also note your account's email address, whether it's been verified, and how you sign in, so we can tell whether the request is genuine.

Our hosting provider also keeps standard server logs (such as IP address, browser type and the pages requested) for a limited time to keep the service secure and working.

• to sign you in and keep you signed in
• to show your saved gigs and venues, start the map near your home, and remember your filters
• to check page claims: our team reviews each one by hand and may contact you, or the venue or artist through their public details, to confirm it
• to protect the service from abuse and fix problems

We don't use your information for marketing, and we don't send you marketing email. If you claim a page, we email your account's address (once it's verified) to confirm we've received the request and to tell you the outcome.

We use only what's needed for the site to work, so there's no cookie banner:

• Sign-in: Firebase Authentication keeps your session in your browser's storage so you stay signed in. It's removed when you log out.
• Saved filters: if you save your gig filters, a savedFilters cookie holds them so the home page can open on them straight away. It lasts a year and is removed when you forget the filters or log out.
• Current filters: the filters you're using on a page are kept in your browser's session storage, so reloading the page doesn't lose them. They stay on your device and go when you close the tab.

The Google services below may set their own cookies under Google's policies.

We don't sell or rent personal information. We use these providers to run the service:

• Google Firebase and Google Cloud host the site, store account data and claim requests (Firebase Authentication and Cloud Firestore), and send our emails. Event and artist images are served from Firebase Storage, so your browser fetches them from Google, which receives your IP address.
• Google Maps Platform draws the maps and suggests places when you type your home suburb. Your browser contacts Google directly, so Google receives your IP address and what you type in that field.
• Google Fonts serves the site's typeface, so your browser requests it from Google.
• ipinfo.io receives your IP address from our server to estimate your city. We don't send anything else.

These providers may store or process information outside Australia, including in the United States. Their own privacy policies apply: Google and ipinfo. We may also disclose information if the law requires it.

Gig listings come from public sources such as ticketing sites and gig guides. They name venues and performing artists, which is business rather than personal information. If you're an artist or venue and something about you is wrong or shouldn't be listed, email privacy@undertow.au and we'll fix or remove it. You can also claim your page with the "Claim this page" link on it. Claim requests are only seen by our team.

Account information is kept until you ask us to delete your account. A claim request is kept while the claim stands; ones that are turned down or withdrawn are deleted after 12 months. Saved gigs, venues and filters can be removed at any time from the site. Server logs are deleted automatically by our hosting provider.

• You can change your name, account type and home suburb on your account page, and unsave gigs, venues and filters whenever you like.
• To get a copy of the information we hold about you, correct it, or delete your account and everything linked to it (including any claim requests), email privacy@undertow.au from the address on your account. We'll respond within 30 days.

Data is sent over HTTPS and stored with Google, which encrypts it at rest. Passwords are handled by Firebase Authentication and never seen or stored by us. Database access rules only let you read and change your own account data. No system is perfectly secure, but we'll tell you promptly if a breach is likely to affect you.

undertow.au isn't aimed at children under 13, and we don't knowingly collect their information.

If we change what we collect or how we use it, we'll update this page and the date at the top. For significant changes we'll let account holders know by email.

Email privacy@undertow.au with any questions or concerns. If you're not happy with our response, you can complain to the Office of the Australian Information Commissioner.