Privacy Policy

Last updated: October 20, 2026

FANCERT is made by EKPK ("we"). This policy covers the FANCERT apps for iPhone and Android and fancert.app. The short version: your countdowns, photos and videos live on your phone; an account is optional and exists only so you can share with friends.

What stays on your device

• Countdowns, notes, reminders, artists you follow — stored on your device. On iPhone, also in your private iCloud if you enable iCloud sync or backup (Apple hosts that data, not us).
• Photos and videos you add to shows — stored only on your device and visible only to you, except the items listed under "Images you choose to share".
• Screenshot import — text recognition runs on your device. The screenshot and its contents are not sent anywhere. On Android this uses Google's ML Kit, and the ML Kit SDK itself sends Google limited diagnostic data (device and app information, performance metrics) and a per-installation identifier so Google can operate and improve that service. We do not receive that data.
• Calendar import — if you allow it, the app reads your calendar on your device to suggest shows. Calendar contents are not sent to us.
• Home Screen and Lock Screen widgets — read data stored on your device only.

What we store if you create an account

An account is optional. You sign in with Apple (iPhone) or Google (Android). We verify the sign-in token and store only the anonymous user identifier it contains. We do not store your email address or your Apple/Google password. With an account we store: a random user ID, that sign-in identifier, your chosen @handle, display name, bio, emoji, TikTok/Instagram handles you enter, birth year (used only for safety settings; if you are under 16 your venue and city are never shared), profile colour, badges and fan points, your public/private settings, who you follow, and the countdowns you explicitly set to "Friends" or "Everyone" (title, date, city, venue, artist, tour). Countdowns set to "Only me" never leave your device.

Images you choose to share

• Profile picture — uploaded and shown wherever your name appears.
• Memories grid — the up-to-12 tiles you put on your profile are uploaded as small images (for videos, only a thumbnail) and shown to people who can see your profile; public profiles also show them at fancert.app/u/yourhandle.
• Custom cover photo on a show you share with friends.
• Group album — photos you add to a group countdown are visible to every member of that group.
• Automated screening — every photo you upload (profile picture, show covers, memory grid, group albums) is checked within seconds by an image classifier running on Cloudflare Workers AI for nudity, sexual content, gore, hate symbols, drugs and weapons. The classifier receives only the image, keeps nothing and is not trained on it. A flagged photo is hidden and looked at by a human; most are cleared. Every chat message, show-room post and comment is checked the same way, by a text classifier on Cloudflare Workers AI plus a word list, before it is delivered: threats, harassment, hate, sexual content and slurs are refused and never stored except in a short log for repeat-offence detection; borderline messages are delivered and queued for a human; language that suggests someone may hurt themselves is never blocked but shows the sender a helpline link and alerts our team. The classifier receives only the text, keeps nothing and is not trained on it. No human reads your chats unless a message was flagged or reported. You can report any photo, message or profile from inside the app. We review reports within 24 hours, remove content that breaks the rules and suspend repeat accounts.

Remove any of these in the app and the copy on our servers is deleted.

Notifications

Reminders for your own shows are scheduled on your device. On iPhone and Android, if you allow notifications and have an account, we store your device's push token (Apple or Firebase Cloud Messaging) so we can tell you when someone follows you, reacts or comments, joins your group, adds photos or messages you. The token is deleted when you sign out or delete your account.

Listening stats

If you connect Apple Music (iPhone) or Spotify (iPhone and Android), the app reads your top artists and recent plays on your device, only to show your stats and suggest artists. If you turn on "Show artists I listen to", your top 10 artist names are stored with your profile so friends can see them. Tokens for those services stay in your device's secure storage and are never sent to us. Playlists you create from a setlist are created directly between your device and the music service.

Third-party services

• Apple — Sign in with Apple, iCloud, Apple Music, App Store purchases, push notifications on iPhone.
• Google — Sign in with Google, Google Play purchases and Firebase Cloud Messaging (push notifications) on Android.
• Google — Google Sign-In, Google Play purchases and ML Kit on-device text recognition on Android.
• Spotify — sign-in, listening stats and playlist creation happen directly between your device and Spotify.
• setlist.fm, Ticketmaster, Deezer — setlists, tour dates and artist pictures are looked up by artist name; no personal data is sent.
• Cloudflare — hosts our server, database and image storage.

We do not sell data, we do not show ads, and we do not use advertising trackers or analytics SDKs. To know whether the app works, it sends us two things with no identifiers: once a day, an anonymous "app opened" ping with the platform and app version; and, if the app crashes or freezes, a technical summary (app version, the kind of failure and the code locations involved) produced by the operating system's own diagnostics. Neither contains anything about you, your shows or your friends. On Android, Google's ML Kit also sends Google the diagnostic data described above.

Purchases

Purchases are handled by Apple (App Store) or Google (Google Play billing). We receive no payment details. To verify a Lifetime purchase we receive the store's transaction identifier and keep it so the purchase cannot be claimed twice.

Children

FANCERT is not for children under 13, and we do not knowingly collect their data. For users under 16, venue and city are not shared with other users.

Deleting your data

Delete your account in the app (iPhone: Profile › Edit profile, or Settings › Account; Android: Settings › Account › Delete account) or without the app as described at fancert.app/delete-account. Deletion is immediate; that page lists exactly what is deleted and the little that is kept. Get a copy of everything we hold about you in the app: Settings › Account › Export my data (one JSON file). Devices that have not opened the app for 180 days are signed out automatically, and Sign out everywhere under Settings › Account signs out every device at once. You can also email [email protected] to request deletion or a copy of your data. We answer within 30 days.

Changes

We'll post updates here and change the date above.