Rail.fm Privacy Policy (DRAFT)

Status: draft written 2026-08-21 by the build assistant. Not reviewed by a lawyer. Review before public launch; replace the placeholders. The plan calls for real legal review once the product has revenue.

Last updated: [DATE]

Rail.fm ("we") helps you find concerts worth going to. This policy explains what we collect and why, in plain language.

What we collect

• Account basics. Your email address and a password (stored only as a secure hash), your city or location you give us, and your travel radius.
• Your music taste. When you connect a music service (such as Last.fm or Apple Music) or upload a listening-data export, we store which artists you listen to and roughly how much. We use it to match you with concerts. We do not receive your service password.
• What you do on Rail.fm. Artists you follow, events you save, your Interested / Going / Not interested choices and the reasons you give, which recommendations we showed you, and which ticket links you click. This is the core of how recommendations improve.
• Technical basics. Standard web logs (IP address, browser type) and product analytics tied to your account.

What we do NOT do

• We do not sell your personal information.
• We do not share your individual listening data or attendance with anyone.
• We do not post anywhere on your behalf.

How we use it

To recommend concerts, alert you when artists you follow announce nearby shows, improve the recommendation system, and understand aggregate usage. Ticket links may include a referral code; if you buy a ticket, the ticket seller may pay us a commission. Commissions never change which events we recommend or how they score.

Sharing

Service providers that run our infrastructure (hosting, email delivery, analytics) process data on our instructions. Aggregate, de-identified statistics (for example, "1,200 Rail.fm users follow artists playing this venue next month") may be shared with venues and promoters; these never identify you.

Your controls

You can disconnect a music source, delete individual data, or delete your account entirely from settings; deletion removes your personal data within 30 days except records we must keep by law. Email privacy@rail.fm for any data request.

The boring but important parts

Data is stored in the United States. We use industry-standard safeguards. We are not directed at children under 13. If we materially change this policy we will email account holders first. Questions: contact@rail.fm.