Gigcore
What we keep,
and what we don't.
Gigcore holds the gig history you write into it. There is no analytics, no advertising and no tracking anywhere in it — this page says exactly what that means.
UPDATED 5 SEPTEMBER 2026
Gigcore is a diary for live music. It holds what you write into it — the shows you went to, what you scored them, the photos you took that night — and it does not go looking for anything else.
- No analytics, no advertising, no tracking or attribution SDKs of any kind.
- No location, no contacts, no advertising identifier, no device fingerprint.
- Reminders are scheduled on your phone by your phone. Nothing about them is sent to us.
- Your profile page at gigcore.app/u/your-name is public. Your photos and clips are not on it.
- Nothing is sold, and nothing is shared with anyone for advertising.
- You can delete the account and everything on it yourself, and it goes immediately.
The rest of this page is the same thing said precisely, because the law and the Play Store both need it said precisely.
Gigcore is operated by Grzegorz Brzozowski, based in Poland. For anything in this policy — a question, a request, a complaint — write to dolidius@gmail.com. That address reaches the person who runs the service, not a queue.
Under the GDPR, Grzegorz Brzozowski is the controller of the personal data described below.
Your account
A username, and — if you registered rather than staying a guest — an email address and a password. The password is stored only as a bcrypt hash and can never be read back. Alongside that: your bio, your avatar image, and the date you joined. A guest account has no email and no password at all.
The shows you log
The artist, the date and start time, the venue, the city and country, the stage, your score out of ten, what the ticket cost, your notes, where you stood or sat, the names you type in for who you went with, and the festival a set belongs to.
Photos and clips
The files you attach to a show, any caption you give them, and — for video — a poster frame your phone generates so a list of shows loads thumbnails instead of megabytes.
Who you follow
The accounts you follow, the accounts that follow you, and the accounts you have blocked.
Reports you send
What you reported, the reason you picked, any note you wrote, and when. A report is tied to your account so the same thing cannot be reported repeatedly, and so a queue cannot be flooded.
Staying signed in
A session token, stored on our side only as a hash, with an expiry and a record of when it was revoked. Signing up and resetting a password create short-lived records holding the email address, the username, the password hash and a hashed one-time code; they delete themselves when they expire.
Server logs and abuse limits
Your IP address is used to count requests against a rate limit, held in memory for the length of a fifteen-minute window and never written to the database. Errors on the server are logged so they can be fixed.
- Your location. The app does not ask for the permission and cannot read it — a city or country on a show is text you typed.
- Your contacts, your calendar, your call or message history.
- Your advertising ID, or any other identifier used to profile or track you.
- Analytics of any kind. There is no analytics, crash-reporting, attribution or advertising SDK in the app, so no behavioural data is generated in the first place.
- Push tokens. Reminders are local notifications scheduled by the app on your device; the server neither sends them nor knows they exist.
- Payment details. The app is free and has no purchases in it.
📱
Permissions the app asks for
Photos and media
Asked for only when you attach a photo or clip to a show, and used only for the files you pick. The app does not read your library otherwise.
Notifications
Asked for once, so the app can remind you about a show you have a ticket for and ask how the last one was. Refusing costs you nothing else, and you can change it later in the app's settings or your phone's.
Both are optional. The app works without either, and you can withdraw them at any time in Android settings.
Running the service
Keeping your shows, showing your profile, building your feed, letting people follow each other. Legal basis: performance of the contract you enter into by using the app (GDPR Art. 6(1)(b)).
Signing you in
Authenticating you, verifying your email address, and letting you reset a password. Legal basis: performance of the contract, and our legitimate interest in keeping accounts secure (Art. 6(1)(f)).
Safety and moderation
Reviewing what is reported, removing content that breaks the rules, suspending accounts that repeat it, and enforcing blocks. Legal basis: our legitimate interest in a service that is safe to use, and compliance with our legal obligations (Art. 6(1)(f) and 6(1)(c)).
Keeping it standing up
Rate limits, abuse prevention, and fixing errors. Legal basis: legitimate interest (Art. 6(1)(f)).
Optional extras
Photo access and notifications run on your consent, given through the Android permission prompt and withdrawable at any time (Art. 6(1)(a)).
Nothing is used for advertising, profiling or automated decision-making. There is no such processing here to opt out of.
A handful of companies process data on our behalf, each under a contract that limits them to doing so on our instructions. They are:
Cloudflare R2
Stores the photos and clips you attach. Files are written and read through short-lived signed links, so the storage bucket is never public.
Resend
Delivers the two emails the service sends: your verification code and your password reset code. It receives your email address and the code, and nothing else.
Spotify
When you search for an artist, the search text is sent to Spotify's API from our server so the artist name and picture can come back. The request carries no account of yours and nothing that identifies you; Spotify does not learn who searched.
Our hosting provider
Runs the server and the database the service depends on.
Google Play
Distributes the app. What Google collects as the store is covered by Google's own privacy policy, not this one.
Beyond that, data is disclosed only where the law requires it — a valid order from a court or an authority — or where a child-safety report has to be passed on. It is never sold, never rented, and never handed to a data broker or an ad network.
Every account has a web page at gigcore.app/u/your-name. Anyone with the link can open it without installing anything or signing in, and search engines may index it.
That page shows your username, your bio, your avatar, your follower and following counts, how many shows you have kept, your average score, your best year, and the artists, venues and scores of your most recent and upcoming shows.
It does not show your email address, and it does not show any photo or clip you have uploaded. Those stay inside the app. Deleting your account removes the page immediately.
- Your account and everything on it: until you delete it. There is no inactivity clock running against you.
- Deleting the account removes your profile, every show and festival, your photos and clips, your ratings and your follows — permanently, and at once. It is not a soft delete and there is no recovery window.
- Session tokens expire on their own and are cleared when you sign out.
- Half-finished sign-ups and password resets delete themselves when they expire, within a day.
- A photo removed by moderation is deleted from storage and cannot be brought back; the row that recorded it stays, without the file, so the report it belongs to still points at something.
- Reports are kept while the account they concern exists, so a pattern of behaviour can be seen. They go with the account.
The server, the database and the file storage are hosted in the European Union. Two of the processors above — Cloudflare and Resend — are US companies and may process data outside the EEA.
Those transfers rely on the European Commission's Standard Contractual Clauses, and in Resend's case additionally on the EU–US Data Privacy Framework. A copy of the safeguards is available on request.
- Everything travels over HTTPS.
- Passwords are hashed with bcrypt. Session tokens, verification codes and reset codes are stored only as hashes, so a copy of the database yields none of them.
- Photos and clips sit in private storage and are reachable only through links that expire.
- Sign-in, sign-up, password resets, uploads and reports are all rate limited.
- The moderation tools are behind a separate secret that no user account, however privileged, can reach.
No service can promise it will never be breached. If one happens and it puts your rights at risk, you will be told, and so will the supervisory authority, within the deadlines the GDPR sets.
If the GDPR applies to you, you have the right to ask for a copy of your data, to correct it, to have it erased, to restrict or object to how it is used, and to receive it in a portable form. Where processing rests on consent, you can withdraw that consent without affecting what came before.
Most of it you can do yourself and immediately: edit your profile in the app, and delete your account either in the app or on this site. For anything else, write to dolidius@gmail.com and you will have an answer within one month.
If you think your data is being handled wrongly, you can complain to your local data protection authority. In Poland that is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa).
Gigcore is not designed for or directed at children. You must be at least 13 to have an account, and older where your country sets a higher age for consenting to online services on your own — 16 in several EU member states.
If you believe a child below that age has an account here, write to dolidius@gmail.com and it will be removed, along with everything on it.
This policy will change when the service does. The date at the top says when it last did. A change that materially affects how your data is handled will be announced in the app before it takes effect, not slipped in.
dolidius@gmail.com — for privacy questions, data requests, or anything on this page you think is wrong.