Privacy Policy

1. Who we are

gemlist (“gemlist,” “we,” “us”) provides a mobile app and website for saving live music memories as collectible Gems. This policy explains what we collect, why we collect it, and the choices you have. Questions or requests: contact@thegemlist.com.

2. What we collect

Account. Email address, display name, username, and credentials. Passwords are stored only as secure hashes. Passkeys are handled by your device; Apple and Google handle sign-in if you choose those options, without sharing your Apple or Google password with us. Account providers may supply a profile photo URL; you can also add a profile photo yourself.

Your collection. The memories you save: artists, venues, events, dates, notes, facet ratings, moods, tagged friends, and any photos, video clips, or voice memos you attach. Your collection is private by default.

Photos and camera. We receive only the photos you explicitly select. If you start a memory from a photo, we use its date and location metadata to help identify the event and pre-fill the memory. Selected photos and relevant date, location, and event details may be sent to our AI providers for event matching; imported metadata may be saved with the memory. The camera is active only while you scan a Gemcode; scan frames are processed on-device and never stored. gemlist does not request your live device location.

Device and technical. Security and operations logs (such as IP address and request timestamps, retained briefly by our infrastructure providers), your preferences (theme, app icon, notifications), a local session token so you stay signed in, and a push token if you enable notifications.

App analytics. We collect usage events, such as which screens and features are used, to improve the app. In the native app, usage analytics are on by default and sent to our own analytics endpoint. You can turn them off using “Share usage analytics” in Settings. In the browser version of the app, PostHog analytics run only after you accept them in the consent banner; choosing “Necessary Only” keeps them off. You can change these choices without losing access to the app.

Website analytics and maps. Our public website uses Vercel Web Analytics for aggregate statistics such as pages viewed, referrers, approximate region, and browser or device type. It does not use analytics cookies. We also use Vercel Speed Insights to measure page loading, responsiveness, and visual stability on public pages, using performance metrics, page URLs, and technical information such as browser, device, connection type, and country. When the website's map loads, your browser requests map tiles from OpenStreetMap, which receives your IP address and request details. The feature tour uses sample memories; it does not connect to your private collection.

Safety reports. If you report another collector, we keep the report — who filed it, who it concerns, the reason, and any details you add — so our moderation team can review it, act on it, and keep a record of the outcome.

Google account data and sign-in

Google sign-in is optional. When you choose it, Google and our authentication provider, Supabase, provide gemlist with your Google account identifier, email address and its verification status, and basic profile information such as your name and profile photo URL, when available. These are the basic identity permissions (openid, email, and profile). We never receive your Google password.

We use this information to authenticate you, associate your Google identity with your gemlist account, populate account information, and help secure your account. Your gemlist session lets you access and sync your collection. We do not request permission to read Gmail, Google Drive, Calendar, Contacts, or Google Photos. Photos you choose to upload to a memory are separate from Google sign-in.

Google account information is processed and stored with your account by Supabase on our behalf. Access is limited to operating, supporting, and securing gemlist, subject to the disclosures in this policy. We do not sell Google account data, use it for advertising, or use it to train AI models. We do not send Google sign-in information to our AI event-matching providers. gemlist's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Google account identifiers and basic profile information are retained with your gemlist account until you delete that account, subject to the retention exceptions below. You can revoke gemlist's Google access through your Google Account connections. Revoking access stops future Google authorization but does not delete information already stored in gemlist or your gemlist account. To delete it, use Delete Account in gemlist Settings or contact contact@thegemlist.com.

3. How we use your data

To operate your Treasure Chest, Taste Profile, Aura Bloom, maps, recaps, and badges; to sync your collection across your devices; to send the notifications you enable; to secure the service and prevent abuse; to review and act on safety reports so the community stays safe; and to understand which features need improvement, subject to the analytics choices described above. Where laws such as the GDPR apply, our legal bases are performance of our contract with you, your consent where required, and our legitimate interest in keeping the service secure.

4. What we never do

We do not sell or rent your personal data. We do not show ads or share data with advertisers or data brokers. We do not post anywhere on your behalf. We do not scan your camera roll. Your private memories are not used to train AI models.

5. Who we share with

We use Supabase for the database, authentication, file storage, and native app analytics; Apple for sign-in, push notifications, and App Store services; Google for sign-in; Cloudflare for bot protection at sign-up; and PostHog for browser app analytics when you consent. Optional online poster scans send selected images to Google Gemini after your permission. Profile photos are also checked by Google Gemini before publication when you approve the upload. AI-assisted event matching uses Lovable's AI gateway and Google's Gemini models to process the selected photos and context described above. Each receives only what its function requires.

Vercel hosts the public website and provides its analytics, as described in Vercel's analytics privacy information. Performance monitoring is described in Vercel's Speed Insights privacy information. OpenStreetMap provides the website's map tiles under the OpenStreetMap Foundation Privacy Policy. Sign-in and other third-party services may also process data under their own privacy policies.

Beyond that, we disclose personal data only where the law requires it, to protect the rights and safety of you, us, or others, or in connection with a merger or acquisition — in which case this policy continues to apply to your data.

Social features are opt-in. Other collectors see your profile and gems only according to the visibility settings you choose, and you can block or report anyone.

6. Storage and security

For deleted Apple-linked accounts, a server-only credential may be retained to retry disconnecting Apple and is removed after successful revocation. Your data is hosted on Supabase infrastructure in the United States and encrypted in transit and at rest. Database row-level security restricts ordinary user access to private collections; authorized service operations and support access are limited to their purpose. No online service can guarantee perfect security, but if a breach affects your personal data we will notify you without undue delay.

7. Retention, export, and deletion

We keep your account and collection data only while your account exists. To request a copy of your data, email contact@thegemlist.com. Deleting your account in Settings permanently removes your gems, media, taste profile, achievements, social connections, and profile from production systems, including the authentication record associated with Google sign-in. Residual copies may remain in backups until they expire under our infrastructure provider’s backup schedule. Limited information may be retained where required by law or necessary for security, fraud prevention, or resolving disputes; it is not used to restore an active account or for advertising.

8. Your rights

Wherever you live, we extend the same rights: access and export your data, correct it, delete it, object to or restrict processing, and withdraw consent where you have given it. You can change your app analytics choices as described above without losing access to the app. Email contact@thegemlist.com and we will respond within 30 days. If you are in the EEA or UK, you may also lodge a complaint with your supervisory authority.

9. Children

gemlist is not directed to children under 16, and we do not knowingly collect personal data from anyone under 16. If you believe a child under 16 has an account, contact us and we will delete it.

10. Changes to this policy

If we make a material change, we will notify you in the app before it takes effect. The effective date above always reflects the current version, and prior versions are available on request.