Privacy Policy

1. Information We Collect

1.1 Information You Provide

• Account information: Name, email address, handle, and password when you create an artist account.
• Fan information: Name and email address when you submit a song request, tip, or opt in to notifications.
• Payment information: Payment details (such as card numbers) are collected and processed directly by Stripe. We do not store your full payment card details on our servers.
• Profile information: Optional city/state or city/province you provide in your fan profile for location-based features.
• Content: Song requests, dedications, chord charts, setlists, and other content you submit to the Service.
• Communications: Messages or requests you send to our support team.

1.2 Information Collected Automatically

• Usage data: Pages visited, features used, session activity, and timestamps.
• Device data: Browser type, operating system, and device type.
• IP addresses: IP addresses may be collected or processed for security, fraud prevention, operations, and approximate location inference. We do not retain raw IP addresses longer than necessary for these purposes.

1.3 Location Data

Approximate (IP-based) location: We may infer your approximate location — typically at the city, state/province, or country level — from your IP address or network activity. This inference is coarse and may be inaccurate. We do not request or use your device's GPS or browser geolocation permissions for this purpose. This inferred location is distinct from precise GPS location.

Profile-provided location: If you voluntarily enter your city and state or province in your fan profile, that information may be used as your preferred location for relevant notifications and experience personalization.

We use location data (approximate or profile-provided) for: relevant live session and show notifications; local or regional event relevance; improving your experience; security and fraud prevention; and analytics and platform operations.

Location Data Disclosure: OnRequest infers your approximate location (city/region) from your IP address. This is not precise GPS data. You may also optionally provide your city/state in your fan profile. This data helps us send you relevant show notifications and improve the Service. You can view and update your profile location at any time in your fan profile settings.

1.4 Google Account and Google API Data

Artists may optionally connect Google Calendar or Google Drive. If you do, OnRequest processes Google information only to provide the Google features you select:

• Google account and authorization data: For Drive, OnRequest requests basic profile and email access and uses the email address returned by Google to identify the connected account in settings. We store Google access and refresh tokens and their expiration information in the artist account's settings so we can maintain and refresh the connection, and remove them when the connection is disconnected. A short-lived Drive access token is also provided to your signed-in browser when needed to make the Drive requests you initiate. Calendar event synchronization uses your Google authorization tokens but does not retrieve your Google account email.
• Google Calendar: For confirmed upcoming shows, OnRequest sends the show title, start and end date/time, time zone, available venue/location details, and links to the artist's OnRequest page and public show page to your primary Google Calendar. For accepted gig offers, the event may also contain the booking artist and venue, offer times, expected pay, shared revenue or profit, rider information, location, and the OnRequest show page link. We create or update the corresponding events and retain their Google event identifiers to update or remove those specific events. For some existing gig offers, we search for a matching OnRequest show-page link to avoid creating a duplicate; we do not use this connection to read unrelated calendar events.
• Google Drive: The Drive permission requested by OnRequest includes drive.readonly, which technically permits reading and downloading files across the connected Drive, as well as drive.file for files created or opened with the app. The app's Drive features use Drive access to display folder names and identifiers in the folder picker, display file names, identifiers, and types in the selected folder, and download a chart file you choose to import. The selected chart is then imported into your OnRequest library. OnRequest also uploads files to Google Drive: these include individual chart exports (for example, text, ChordPro, or OnSong files), ZIP bundles of selected charts, full-library backup files, and audience-data exports (in the available export format). For these uploads, OnRequest creates or uses the Drive destination folder you choose and sends the selected file or backup-queue files to that folder.

OAuth permissions requested: https://www.googleapis.com/auth/calendar.events, https://www.googleapis.com/auth/drive.file, https://www.googleapis.com/auth/drive.readonly, email, and profile.

Google API data is used to operate, maintain, secure, and support these user-facing Google features. We do not sell Google user data or use it for advertising. We do not use Google API data for purposes unrelated to the feature you request.

Google authorization tokens and the connected Drive email are retained in the artist account settings while the connection is active and are removed when the artist disconnects it in OnRequest. Disconnecting stops future access by OnRequest but does not delete Calendar events already created, files already uploaded to Drive, or charts already imported into OnRequest. Those items must be deleted separately in Google or OnRequest, as applicable. You may also revoke OnRequest's access in your Google Account.

OnRequest's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve the Service
• Process payments and tips
• Send transactional communications (payment confirmations, request status updates)
• Send show and notification alerts to fans who have opted in
• Enable artist-fan engagement features (requests, upvotes, tokens)
• Detect and prevent fraud, abuse, and unauthorized access
• Analyze usage patterns to improve the Service
• Comply with legal obligations

3. Sharing and Disclosure

We do not sell your personal information. We may share your information in the following circumstances:

3.1 With Artists

Fan names, email addresses, and request/tip information may be visible to the artist for whom you submitted a request or tip. Artists use this information to manage their shows and communicate with fans who have opted in to notifications.

3.2 Service Providers

We share information with third-party service providers that help us operate the Service, including:

• Stripe: Payment processing. Stripe has its own privacy policy and handles payment data pursuant to it.
• Resend: Transactional and notification email delivery.
• Neon / PostgreSQL hosting provider: Database storage.
• Google: Calendar event synchronization and artist-requested Drive folder browsing, chart imports, backups, and exports. Google processes the information sent to its APIs under its own terms and privacy policy.

3.3 Legal Requirements

We may disclose your information if required to do so by law or in response to a valid legal request (such as a court order or subpoena), or when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.

3.4 Business Transfers

If OnRequest is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will provide notice of any such change and any choices you may have.

4. Cookies and Analytics

We use cookies and similar technologies to maintain your session, remember your preferences, and analyze usage of the Service. Session cookies are essential for the Service to function. We may use analytics tools to understand how the Service is used in aggregate.

You can control cookie behavior through your browser settings. Disabling cookies may affect the functionality of the Service.

5. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. We retain fan interaction data (requests, tips, notification preferences) for analytics and artist reporting purposes for a reasonable period. You may request deletion of your data as described below.

Raw IP addresses, if collected, are not retained longer than necessary for security and operational purposes.

6. Security

We implement reasonable technical and organizational measures to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include encrypted connections (HTTPS), hashed credentials, and access controls.

No method of electronic transmission or storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security.

7. Your Choices and Controls

7.1 Notification Preferences

Fans can opt in or out of show notifications (scheduled, one-hour reminders, live-now alerts) through their fan profile. Artists can view and manage fan notification opt-in status in their dashboard. Unsubscribe links are included in all notification emails.

7.2 Profile Location

You can update or remove your profile location (city/state or city/province) in your fan profile settings at any time. Removing your profile location means location-based notifications will fall back to approximate IP-based inference, or you may opt out of location-based notifications entirely.

7.3 Account Deletion

Artist account holders may request account deletion by contacting us at support@onrequest.app.

Fans can self-service delete their personal data directly from their fan profile using the "Delete My Data" option. This permanently removes your name, email address, location, and any saved payment method links from our servers. Anonymous analytics records (request history, tip totals) are retained to help artists understand their audiences but cannot be linked back to you after deletion.

Note that some data may be retained for legal, fraud prevention, or accounting purposes. If you previously opted into an artist's email list and they exported it to a separate system, that copy is outside our control.

7.4 Access and Correction

You may request access to or correction of personal information we hold about you by contacting us at the address below.

8. Children's Privacy

The Service is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us and we will take steps to delete such information.

9. International Users

The Service is operated from the United States. If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States, where our servers and service providers are located. Data protection laws in the United States may differ from those in your country. By using the Service, you consent to this transfer.

10. Third-Party Services

The Service integrates with third-party services such as Google (Calendar and Drive), Stripe (payments), Resend (email), and Bandsintown (artist event data). Google Calendar and Drive are optional and are used for the features described in Section 1.4. These providers have their own privacy policies and data practices. We encourage you to review the privacy policies of any third-party services you connect to or use through OnRequest.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date at the top of this page. For significant changes, we may provide additional notice such as an in-app notification. Your continued use of the Service after changes take effect constitutes your acceptance of the revised policy.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us at: