Privacy Policy

When you browse without signing in, we don't create a profile of you. Our servers keep standard technical logs (page or API path, status code, time) to keep the service running.

When you sign in with Google, we receive your name, email address, profile photo and Google account ID. We never see your Google password.

When you use Lightstick, we store the artists you follow, the events you set reminders on, and a log of account actions (such as signing in, following an artist or connecting Telegram) with the time they happened.

When you comment, we store what you write, when, the event it's on, your 💜 reactions and any reports you make. Your comments are public; signed-in members also see your name and Google profile photo next to them, while signed-out visitors see only your name with a coloured initial. Your email is never shown.

When you share a photo, we store a resized copy, your caption, the event and when you uploaded it. Location and camera details (EXIF) are removed before the photo is saved. Approved photos are public and show your name, never your email or profile photo. You can delete your photos at any time.

When you use our Telegram bot, we store your Telegram chat ID, username and first name, your follows and reminders, whether alerts are muted, and the commands you send.

• to sign you in and keep you signed in;
• to send the alerts you asked for: new shows, ticket sale reminders, on-sale alerts and show-day countdowns;
• to show your comments and photos and keep the community safe (spam and scam filters, photo review, reports, moderation);
• to keep the service secure, fix problems and prevent abuse;
• to understand overall usage (for example, how many people follow an artist) so we can improve Lightstick.

We use one essential cookie, ls_session, to keep you signed in. It is httpOnly (not readable by scripts) and expires after 30 days or when you sign out. Google's sign-in button may set its own cookies when you use it. We use Google Analytics, which sets _ga cookies to count visits and see which pages are used (pages viewed, approximate location, device and browser). It doesn't receive your name or email. You can opt out with Google's Analytics opt-out add-on or by blocking cookies. We don't use advertising cookies.

We don't sell or rent your personal data. We only rely on these services to run Lightstick:

• Google for sign-in and Google Analytics (visit statistics);
• Telegram to deliver alerts to your chat;
• Google Gemini to read public event pages. It processes public web content only, never your personal data;
• our hosting and database providers, who store data on our behalf.

We may disclose information if the law requires it or to protect users and the service.

• Account data, follows and reminders: until you delete your account.
• Comments: until you or a moderator delete them, or you delete your account.
• Activity logs: 30 days, then deleted automatically.
• Telegram data: until you ask us to delete it. Disconnecting Telegram on the website mutes all alerts to that chat.

• Unfollow artists or remove reminders at any time on the website or with the bot.
• Pause alerts with /mute, or disconnect Telegram from your account page.
• Ask for a copy of your data, a correction, or deletion of your account and Telegram data.

To make a request, Message us through our Telegram bot. We aim to respond within 30 days.

We use HTTPS, keep session tokens out of browser scripts, and limit admin access. No system is perfectly secure, but we work to protect your data and will notify you of any breach that affects you.

Lightstick is not intended for children under 13. If you believe a child has created an account, contact us and we will delete it.

If we change how we handle your data, we will update this page and the date at the top, and tell you on the website or through the bot for significant changes.