Privacy policy

• We store what you give us (your sign-in details from Google or GitHub, your profile, and what you post) on our own server in the United States, and keep encrypted backups with Cloudflare.
• Your public name is the display name you choose, or your username if you haven’t chosen one. The name Google or GitHub gives us is never shown publicly, and your email address is never shown to anyone else.
• You choose who sees each memory.
• We use no AI. Our own code runs no analytics. Cloudflare, which carries the site, adds its cookieless Web Analytics to our pages, and Mapbox reports usage from the map page. On selling data, see “We don’t sell your data” below.
• Deleted data is gone from the live site at once, but can stay in our encrypted backups for up to 365 days (see “How long we keep it”). A log of who did what is kept indefinitely.

Bandcestry (bandcestry.cc) is run by Broad Strokes Lab LLC. In this policy, “we” means them. Questions about privacy, and requests about your data: [email protected].

When you sign in. You sign in with Google or GitHub. They send us your name (GitHub sends your username if you haven’t set a name), your email address, a link to your profile picture, and an account number. With GitHub, if your email isn’t public, we ask GitHub for your account’s emails and keep the primary one. We also store the sign-in tokens they issue. We use those only to sign you in, and we ask only for basic profile access (Google: “openid profile email”; GitHub: “read:user user:email”). The name they send is kept on your account and is never shown publicly; our moderators can see it.

Your profile. A username (set once), a display name if you choose one (you can change or clear it), your home scene, your default visibility, and when you joined and finished onboarding.

What you add. Your memories and what they link to (bands, venues, people, shows, scenes), “I was there” and other responses, claims (“this is me”, “I was in this band”, “I was at this show”), disputes and votes (with any reasoning you write), sources you cite, and edits you make to shared records, with who made them. When you add a source link, we also record your browser’s user-agent string (its name and version).

Your settings. Who and what you follow, and which bands, venues, people or scenes you mute. Muting, blocking and reporting other users are not available yet.

What we make for you. Your notifications and your home feed.

A log of who did what. Our internal event log records each action with the account that took it: following and unfollowing (who and what), muting and unmuting, responding to a memory, and editing a shared record. It is kept indefinitely as an audit trail, and is not removed when an account is deleted.

What we don’t store. Our code doesn’t store your IP address, your location, payment details, your contacts or analytics events. Rate limits on search suggestions are counted in memory for a minute and never written down. An older behaviour log from a removed AI feature still exists but nothing writes to it.

Photos and files. Uploading is not live yet. When it is, we’ll accept images only, re-encode every one, and strip its embedded data (EXIF), including location, by default.

• Our server. The site and its database run on a server we operate, in the United States. The database is our own and password-protected. The server is shared with another company’s services.
• Unencrypted copies on the server. Each night the server writes a copy of the database to its own disk, unencrypted. It keeps the newest 14, deleting older ones only after a night’s upload succeeds, so if uploads fail, copies pile up until they work again.
• Encrypted backups. Each nightly copy is also encrypted on our server, so only we can read it, and stored with Cloudflare R2 in western North America.
• Photos, when uploading goes live. None are stored yet. They’ll be kept in Cloudflare R2, in a private bucket, with a nightly mirror in a second bucket. We’ll add where those buckets are located before uploading opens.
• Your browser. The cookies and storage described under “Cookies”.

Your name. Your memories, responses and the sources you add show your public name: the display name you choose, or your username if you haven’t chosen one. You can change or clear your display name at any time. The name your sign-in provider gave us (for most people, their real name) is never shown publicly; our moderators can see it.

Your profile. Anyone can see your username, your display name if you’ve set one, your public memories, and your approved claims (including the shows you’ve said you were at). Your email address and join date are never shown to anyone else; you see your email on your own page. Your role isn’t shown, with one exception: a claim you approved yourself is labelled “self-approved”, which only a moderator can do.

Each memory has its own visibility. When you post one, you pick public, followers or private, starting from your default:

• Public: Anyone, signed in or not, and search engines.
• Followers: People signed in who follow you.
• Circle: Members of a group you choose. It exists in our system, but you can’t pick it yet.
• Collaborators: People with an approved “this is me”, member or owner claim on any band, venue, person or other record the post is linked to (witness and historian claims don’t count). It exists in our system, but you can’t pick it yet.
• Private: Only you.

Whatever the visibility, you can always see your own posts, and so can our moderators and administrators, who need to for safety reviews. A memory you haven’t published yet is visible only to you (and them).

Your responses (“I was there”, corroborations) show your public name on the memory, to anyone who can read that memory.

Dispute votes. Anyone can see the totals for each side of a dispute. Who voted, how they voted, the reasoning they wrote and each vote’s weight are seen only by our moderators. (A vote’s weight reflects how much the site trusts the voter, and whether they hold an approved claim on the record in dispute.)

Sources you cite are public with their title and link, and with your public name and username as the person who added them.

Private to you: who and what you follow (no follower counts or lists are shown), your mutes, your notifications, your feed, and your pending claims.

Edits to shared records (a band’s or venue’s details) are kept as history, with who made them; moderators can see that history.

We keep your account and what you add until you delete it or ask us to. Nothing is deleted on a timer. A sign-in session stops working after 30 days without use, but its record is removed only when it is next presented, or when your account is deleted. The log of who did what is kept indefinitely, including after an account is deleted.

Backups. Deleting something removes it from the live site, but copies made before that stay in our backups until they expire:

• the server’s own unencrypted copies: the newest 14 nights (longer if uploads are failing);
• daily encrypted copies: 14 days;
• weekly encrypted copies: 56 days;
• monthly encrypted copies: 365 days.

Each encrypted copy is deleted the day after its period ends, and Cloudflare can take up to a day more to carry that out. So deleted data can remain in our encrypted backups until they expire: up to 365 days for the monthly copies, plus those two days. The backups are locked on purpose: our server’s credentials cannot delete them early, so an attacker on the server or a mistake can’t destroy them either. A backup is never restored except to recover from a disaster. If a backup is ever restored, deletions are applied again.

Older copies. Until 4 October 2026 our database ran on a database server shared with another company. Two sets of copies from that time last longer:

• an encrypted archive of that old database, made on 26 October 2026, kept until about 27 October 2027. Data that existed on 4 October 2026 can therefore survive in it for about 387 days;
• that earlier hosting arrangement’s own backups, which held Bandcestry’s data until 4 October 2026. They expire by early November 2026.

There’s no delete button for your account, a memory or a comment yet. Until there is, ask us at [email protected] and we’ll do it. You can already remove a follow, a mute of a band, venue, person or scene, and your own response to a memory.

Photos (when uploading goes live) are stored twice: once in a private bucket, and once in a mirror copied every night. The mirror copies deletions too, so a deleted photo leaves the mirror at the next nightly run: within about 24 hours, plus the time the copy takes to run. There’s deliberately no permanent lock on photos, so takedowns and account deletion really remove them.

When your account is deleted, your memories and photos are deleted. Your contributions to shared records (that a show happened, who was in a band, “I was there”) stay, shown as “a former member”, so the history stays whole. Edits to shared records (a band’s or venue’s details) are part of the record and stay too. The edit history drops the link to a deleted account, but the log of who did what keeps the account’s id against every action it recorded, with no expiry.

We share data with other companies only where the site can’t work without it:

• Google and GitHub, when you sign in with them. When a page shows your profile picture, your browser loads it from them, so they see that request.
• Cloudflare carries every visit to the site, so it sees your IP address and the pages you request, and it stores our encrypted backups. On the way through, Cloudflare adds two things to our pages. Cloudflare Web Analytics, Cloudflare’s page-view analytics: your browser loads its script from Cloudflare and reports the page view to Cloudflare. It doesn’t set cookies. And Network Error Logging, which asks your browser to report failed connections to the site back to Cloudflare. Cloudflare’s own privacy policy covers what it keeps.
• Mapbox. When you type an address into a venue form, our server sends that text to Mapbox to find it on the map; Mapbox sees our server, not you. When you open the map page, your browser loads the map directly from Mapbox, so Mapbox sees your IP address and browser. Mapbox’s map software on that page can also send Mapbox usage events (an active-user ping, map loads, sign-in of the map key, and performance data), and it keeps an anonymous identifier in your browser’s storage that it renews after 24 hours.
• MusicBrainz, the open music encyclopedia. When you type a band or person’s name into a create form, our server sends that name to MusicBrainz to suggest a match. Nothing about you is sent.
• Healthchecks receives a nightly “the backup ran” signal with its result code. No personal data.
• YouTube (not live yet). Memory and show pages will be able to play YouTube videos, from youtube-nocookie.com, YouTube’s privacy-enhanced mode. YouTube says this mode doesn’t store information about you unless you play the video. Once you press play, YouTube (Google) may set cookies and similar storage, and Google’s privacy policy applies to that video. Bandcamp and the Internet Archive will be links that open their own sites, not players on ours.

Our fonts are served from our own server.

No AI. Bandcestry uses no AI: nothing you write is sent to an AI service.

Our code sets only cookies that make signing in work.

• __Secure-authjs.session-token: keeps you signed in. It lasts until you sign out, or 30 days without use.
• __Host-authjs.csrf-token: protects the sign-in and sign-out forms from other sites. Deleted when you close the browser.
• __Secure-authjs.callback-url: the page to return to after you sign in. Deleted when you close the browser.
• __Secure-authjs.pkce.code_verifier: a one-time security check during a Google or GitHub sign-in, for up to 15 minutes.
• bandcestry-theme (browser storage, not a cookie): your light or dark choice. It never leaves your browser.

The map page also lets Mapbox keep its anonymous identifier in your browser’s storage (see above). When we checked our public pages in October 2026, Cloudflare set no cookies on them, and its Web Analytics doesn’t use cookies.

We don’t sell personal information, and we don’t use third-party advertising trackers. If that ever changes, we’ll update this policy and tell you before it takes effect.

You can ask us for a copy of the data we hold about you, to correct it, or to delete it. Email [email protected] from the address you sign in with. We’ll answer within 30 days.

If you live where privacy law gives you rights (e.g. the EU, UK or California), contact us and we’ll honour them.

Bandcestry isn’t for children. You must be at least 18 to make an account.

If Broad Strokes Lab LLC is sold, merges or transfers Bandcestry, your information may transfer to the new owner, who will be bound by this policy or will tell you of changes before they apply.

This policy describes what we do from its effective date. If we change what we store or who we share it with, we’ll update this page and its date first. Our terms of use cover how you may use the site.