What we hold, and why
Privacy policy
How we get information from you, what we do with it, and the choices you have about it. Two things worth knowing before you read the rest: everything you post is public, and we do not sell any of it.
Last updated 1 November 2026
Who is responsible
Who we are
loudmemories.com is run by Simon Kojc, a private individual, based in Ptuj, Slovenia, in the European Union. He is responsible for the site and for how it handles your personal data, which makes him the controller of your personal data under the EU General Data Protection Regulation (GDPR). Wherever this policy says “we”, it means him.
To reach him about anything in this policy, write to support@loudmemories.com or use the support page. The same details are in the imprint.
Where it comes from
Information we collect
When you register, an account is created for you and everything you do on loudmemories.com is tied to it. Depending on how you use the site, this is what we may hold about you and how we came by it.
| What we collect | How we collect it |
|---|---|
| Email address | Required when you create an account. It is where the confirmation link and any password reset go. |
| Nickname | Required when you create an account. It is the name shown beside everything you post. |
| Password | Required when you create an account. It is stored as a hash, not as the password you typed. |
| IP address | The address your internet provider gives the device you are using. Our host’s server logs record it, with the time and the pages you visited, whenever you use the site. We record it with each sign-in and each failed attempt, and with each change to which emails you get. We also count it for a short while against repeated attempts to sign in, reset a password, post a review without an account or write to support. How long we keep it says for how long. |
| Name | Optional. You may put a name on your account; the site works the same without one. |
| City and country | Optional. You may put either on your account; neither is needed to use the site. |
| Profile picture | Optional. You may upload one; the site works the same without it. |
| What you do here | Reviews, ratings, photographs, and your journal: the concerts and festivals you log, who you went with, the artists you follow, the nights you mark as favorites, your bucket list, and your answers about venues and festivals. While you are signed in, these are recorded against your account. Who you went with can be another member, or a name you type for someone without an account. A typed name is kept with that night and shown wherever your journal is shown, so use one that person would be happy to see there. |
| Social account details | Only if you choose to sign in with one, and it is never required. We ask the provider for two things and nothing else: the email address on that account, and the display name it shows. The address becomes the address of your account here. The display name is used once, to fill in the nickname box on the sign-up form - what we save is the nickname you confirm, and you are free to type over it first. We do not ask for or keep your real name, your profile picture, your contacts, your posts, or anything else held there. |
| setlist.fm username | Only if you ask us to bring your setlist.fm concerts into your journal, and only for that. We send the name you type to setlist.fm once, to ask for the public list of concerts marked as attended under it, and we do not store the name on your account. The list itself is kept on our server for up to an hour while you choose what to import, and deleted when you do or when the hour is up. What you import is then recorded like any other concert you log. |
| Photo dates and places | Only in the app, only if you ask it to look for concerts in photos you pick, and only for that. The pictures never leave your phone. The app reads the day each one was taken and, when the photo carries it, roughly where (rounded to about a kilometer), and sends us just those, once, to find the concerts that match. We do not store them. A concert you then add is recorded like any other concert you log. |
| Ticket text | Only in the app, only if you ask it to read a ticket, and only for that. The picture of the ticket never leaves your phone: the app reads the text on it there, with Google’s ML Kit (see the services involved), and sends us that text, once, to find the concert it names. We do not store it. A concert you then add is recorded like any other concert you log. |
| Cookies | We and our providers use cookies and similar technologies to keep you logged in, remember your settings and understand how the site is used. Every one we set, and those of the analytics and advertising services, is listed in the cookies policy, along with how to refuse the ones that are not essential. That includes the ones the Stay22 accommodation map sets inside our pages (see the services involved). |
You need to be 16 or older to open an account. We do not knowingly keep an account for anyone younger, and if you believe we do, write to support and we will close it.
What it is for
How we use it
The GDPR lets us use personal data only on one of a few grounds, and each purpose below names the one it rests on. Where it is our legitimate interest, you can object to it; where it is your consent, you can withdraw it. Your rights says how.
| Purpose | In practice | Legal ground |
|---|---|---|
| Your account and your journal |
|
Our agreement with you: the house rules you accept when you join (Article 6(1)(b) GDPR). |
| A review written without an account |
|
Our legitimate interest in publishing what visitors send us to publish (Article 6(1)(f)). |
| Keeping the site and your account safe |
|
Our legitimate interest in keeping the site running and the accounts on it out of the wrong hands (Article 6(1)(f)). |
| Reports |
|
Our legal obligations as a hosting service under the EU Digital Services Act (Article 6(1)(c)), and our agreement with you (Article 6(1)(b)). |
| Answering you |
|
Our agreement with you, where it is about your account (Article 6(1)(b)); a legal obligation, where you are using one of your rights (Article 6(1)(c)); otherwise our legitimate interest in answering what we are asked (Article 6(1)(f)). |
| A closed account |
|
Our legitimate interest in being able to answer for an account that is no longer there (Article 6(1)(f)). |
| The police |
|
A legal obligation, where the law requires it (Article 6(1)(c)); protecting someone’s life, where a post threatens it (Article 6(1)(d)). |
| The emails you switched on |
|
Your consent (Article 6(1)(a)), which you withdraw under Settings or with the link at the foot of each email. Keeping each change you make, so that we follow the latest and can show what you chose, is a legal obligation (Article 6(1)(c)). |
| Asking about cookies |
|
A legal obligation: we have to ask before anything that is not essential is stored in your browser, and be able to show what you answered (Article 6(1)(c)). |
| Counting how the site is used |
|
Your consent (Article 6(1)(a)). |
| Advertising |
|
Your consent, for personalized adverts and what they store in your browser (Article 6(1)(a)). Our legitimate interest in paying for the site, for adverts that are not personalized (Article 6(1)(f)). |
Who else sees it
What is public
On loudmemories.com
Your reviews, ratings and photographs are public, under your nickname. Your journal, with the concerts you log and who you went with, is public at your profile page unless you set it to private under Settings. A private profile page shows your name and nothing else, and your reviews stay public either way. We do not check who members are. Write accordingly.
Photographs you upload are saved again on our server, which removes the camera details and any location the file carried.
With the police
Where the law requires it, or a post threatens someone’s life or safety, a member’s details may be given to the police.
On a social account you sign in with
Nothing. A social account is a way in and nothing more: it signs you in, or it starts your registration, and that is the whole of it. We never post to it, we never read your friends or anything you have written there, and nothing you do on loudmemories.com is sent back to that provider.
When you share a page yourself
The sharing links on a concert or festival page are ordinary links. Following one opens that site with the address of the page you were reading, and from that point what happens is covered by their privacy policy rather than ours. The button that offers the memory card hands the picture to your own device instead, and your device asks you where it should go. Either way nothing leaves loudmemories.com until you choose it.
Who handles it for us
The services involved
We run loudmemories.com ourselves, but not every part of it on our own machine. These are the outside services that receive something about you or your browser, what they get, and when.
| Service | What it gets, and when |
|---|---|
| Resend | Sends our email. When you confirm your address it is added to our list at Resend, with a note of which kinds of email you have turned off, so that Resend can honor that too. Each message we send you passes through it, content included: the confirmation and password links, the receipt for a report you send us, and the notifications you have left switched on. |
| Google reCAPTCHA | On the registration form only, and only once you start filling it in: until then your browser loads nothing from Google for it. It checks that the form is being filled in by a person, using what Google’s script reads from your browser, and Google may set a cookie of its own for it. We are sent back a score and keep nothing of it. |
| Google, Spotify, X | Only if you choose to sign in with one of them. As described above: we ask for your email address and display name and nothing else, and the provider learns that you signed in to loudmemories.com. |
| Google ML Kit | In the app only, when you read a ticket. The text is read on your phone, and neither the picture nor the text is sent to Google. ML Kit does send Google its own usage figures: the phone’s make, model and system version, the app’s name and version, how long the reading took and whether it failed, under an identifier for that installation of the app rather than for you. |
| setlist.fm | The setlist on a concert’s page: when the page is opened, our server asks for it with the artist and the date or the city, and nothing about you. And only if you import your concerts from there: the username you type, once, as described above. |
| bunny.net | Delivers the site’s pictures, stylesheets and scripts, members’ photographs included, from a server near you. Like any web server it sees your IP address and the files your browser asks for, on every page. It also delivers the maps on the pages that have one (artists, concerts, venues, festivals, the archive and your journal): they are drawn from our own copy of OpenStreetMap, so it sees which part of the world a map is showing. Outside your journal, a map is drawn only when you scroll near it, so a visit that never reaches the map loads none of it. |
| Stay22 | The accommodation map on concert, venue and festival pages. It is Stay22’s own page shown in a frame, under our Stay22 account, and your browser loads it from them when you press “Show places to stay”, or by itself once you have allowed advertising in our cookie banner. Where Google’s consent message asked you instead, it waits for the button. We earn a commission on bookings made through it. The cookies it sets are listed in the cookies policy; what happens inside the frame is covered by Stay22’s privacy policy. |
| OpenWeatherMap | The forecast on a concert or festival that has not happened yet. Our server asks for it with the venue’s position and nothing about you, and the weather icons are our own copies, so your browser loads nothing from them. |
| Analytics and ads | Google Analytics and Google AdSense, and only once you have agreed to them. In the European Economic Area, the United Kingdom and Switzerland, visitors who are not signed in are asked by Google’s own consent message instead. Your browser loads it from Google before you answer, so Google sees your IP address. AdSense is never loaded while you are signed in. What each one collects, and how to change your answer, is in the cookies policy. |
| Public catalogs | MusicBrainz, Wikidata, Wikimedia Commons and OpenStreetMap, where our server looks up public facts - an artist’s details and picture, where a venue is. The pictures are our own copies, so your browser loads nothing from them. Nothing about you is sent. |
The site itself, its database and the server logs described above sit with NEOSERV (Avant.Si d.o.o.), the company in Slovenia that hosts our server. We sell nothing to any of these services, and each gets only what it needs for the one job listed.
Outside the European Union
Where each of these companies is, and what makes it lawful for what it receives about you to leave the European Union:
- NEOSERV, our host, and bunny.net (BunnyWay d.o.o.): Slovenia. Nothing leaves the European Union.
- Spotify (Spotify AB): Sweden. Nothing leaves the European Union.
- Resend (Plus Five Five, Inc.): United States. It is certified under the EU-U.S. Data Privacy Framework, and its data processing agreement adds the standard contractual clauses approved by the European Commission.
- Google, for reCAPTCHA, sign-in, Analytics, AdSense and its consent message: Google Ireland Limited, with Google LLC in the United States, which is certified under the Data Privacy Framework.
- X: its Irish company for users in Europe, with X Corp. in the United States, which is certified under the Data Privacy Framework.
- OpenWeatherMap (OpenWeather Ltd): United Kingdom. It receives a venue’s position and nothing about you.
- Stay22 (Stay22 Technologies Inc.): Canada, which the European Commission has decided protects personal data adequately when it is held by a business.
- setlist.fm (Live Nation Entertainment, Inc.): United States. It is not certified under the Data Privacy Framework, and we have no contract with it, so your username is sent only when you ask for the import, and only to carry it out, which Article 49(1)(b) of the GDPR allows as a transfer needed to provide what you asked for.
- MusicBrainz, Wikidata, Wikimedia Commons and OpenStreetMap receive nothing about you, so nothing is transferred.
Whether a company is certified can be checked on the Data Privacy Framework list. Where a transfer relies on the standard contractual clauses, their text is published by the European Commission.
And then it is gone
How long we keep it
| What | How long |
|---|---|
| Your account | Your address, nickname, password and profile, for as long as you keep the account. Closing it removes them at once, as Your choices describes. |
| What you post | Reviews, ratings, photographs and your journal stay until you delete them or close your account. When you close it, you choose whether your reviews and ratings stay with no name on them. |
| Staying signed in | In the app, a year from when you sign in, or until you sign out of it, whichever comes first. On the website, as the cookies policy lists. |
| Sign-in records | The IP address, email address and time of each sign-in and each failed attempt, for 12 months, after which they are deleted. Closing your account removes your email address from them at once. |
| Email settings | Each change to which emails you get is kept while you have the account, because the latest one is what we follow. The IP address recorded with a change is removed after 12 months. |
| Messages to support | What you wrote and the address you wrote from, for 24 months, after which they are deleted. Closing your account removes your address from them at once. |
| Server logs | Kept by the company that hosts our server for 60 days, then deleted. |
| Google Analytics | Only if you allowed analytics: what it records about your visits is kept by Google for 2 months, then deleted. After that only totals remain, with nothing in them that points to you. |
| Your address at Resend | From when you confirm it until you close your account, when it is removed from our list there. |
| Counters against repeated attempts | Between fifteen minutes and a day. |
| The note that an account closed | The member number and nickname, and which answer was given about reviews and ratings, for 12 months, after which it is deleted. |
| Your setlist.fm list | Up to an hour, while you choose what to import. |
What you can change
Your choices
Your privacy settings and the emails you get from us are under Settings in your profile, and you can change them whenever you like. Your journal is yours to take from the same page at any time, as a PDF or as a spreadsheet.
Closing your account is there too, and it is not a request you have to wait on, it happens as you press the button. You are asked one question first, which is what should become of your reviews and ratings. Leave them and they stay where they are with no name on them, your ratings still counting toward the scores. Take them with you and both go, and the concert scores are worked out again without you.
Your photographs are not part of that question. They are removed whichever answer you give, off the server as well as out of the galleries, because a photograph is as often of you and whoever you went with as it is of the stage and taking a name off a row does not anonymize a face. The account itself, your address, your password and your journal go either way as well. The one thing that remains is a note to the site’s owner saying that your member number and nickname closed, and which of the two answers you gave - so that a closed account is not a mystery. Your address is not in it, and the note is deleted after 12 months.
If you want something the settings page does not offer - a copy of everything we hold about you, say - write to support and a person will answer within a month.
Permissions you gave loudmemories.com through a social account are changed in that account’s own settings.
What the law gives you
Your rights
Under the GDPR you have the right to:
- know what we hold about you, and have a copy of it;
- have anything wrong in it corrected;
- have it erased;
- have its use restricted while a question about it is being settled;
- receive what you gave us in a format a machine can read, so you can take it elsewhere - the spreadsheet export under Settings is one way;
- object to anything we do on the strength of our legitimate interest, as listed under How we use it;
- withdraw a consent you have given, at any time, without affecting what was done before you did. For cookies, the cookies policy has a button that reopens your choice.
Much of this you can do yourself, as Your choices describes. For the rest, write to support@loudmemories.com. The law gives us a month to answer, and we may ask you to show that the account is yours before we act on a request.
If you think we have handled your data wrongly, you can complain to the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec, Dunajska cesta 22, 1000 Ljubljana, ip-rs.si), or to the data protection authority of the country where you live or work. We would rather hear from you first, but you do not have to write to us before you complain.
Who it is for
Age
loudmemories.com and its app are meant for people aged 16 and over, and the app is listed on Google Play for that age. Nothing here is made for children, and we do not knowingly keep an account, a review or a photograph from anyone younger. Sixteen is also the highest age any EU country sets for agreeing to things online without a parent, such as cookies, so a member old enough for us is old enough for that wherever they live.
If you are a parent or guardian and you believe a child under 16 has made an account or posted here, write to support@loudmemories.com with the nickname or a link to what they posted. We will close the account and remove what they posted, photographs included. You do not need an account of your own, or your child’s password, to ask.
If this policy is ever rewritten
When this policy changes
- A real change is told first. If we start using your data for a new purpose, pass it to a service not listed under The services involved, or keep it longer than How long we keep it says, we email the address on each account with what changed, at least 30 days before it takes effect.
- You do not have to do anything. This policy tells you what we do with your data; it is not something you sign, so there is nothing to accept. Anything new that needs your consent, such as a new kind of cookie, is asked for on its own, and you can refuse it.
- If you do not want the change, you can object to it or have your data erased, as Your rights describes, or close your account before the date the email names.
- Corrections are announced, not mailed. Fixing a typo, making a sentence clearer without changing its meaning, or updating a link or contact detail moves the date at the top of this page, and we note such edits on the news page.
The rest of the small print
Also worth reading
- House rules What you agree to when you register: argue about the gig, not the person, and what happens if somebody ignores that.
- Cookies policy Every cookie this site sets, what it's for, and how long it lasts.
- Imprint Who runs the site, and how to reach him.
- Support Anything these pages don't answer - ask a person.