Privacy Policy
Last updated: 4 October 2026
Who we are
Festable is a UK music festival directory and discovery engine. Got a question about this policy? Drop us a line at hello@festable.live.
What data we collect
You can browse Festable without signing in and we won't collect anything that identifies you. If you want to save favourites, pick artists, or subscribe to a personalised calendar feed, you'll need to sign in. You can do that with your email address or with your Google account. Once you sign in, we hold a small amount of personal data about you. The details are below.
The one exception is a Glastonbury ticket syndicate board. You don't sign in to use one, but it does hold people's names, registration numbers and postcodes. That has its own section below.
If you accept analytics cookies, we also use Google Analytics to understand how people use the site: which pages are visited, how people arrived, and a few key actions such as quiz steps and ticket link clicks. We don't record your screen, use advertising trackers, or share analytics data with anyone else.
Signing in
Authentication is handled by Supabase, our database and auth provider. You can sign in one of two ways.
Email sign-in.You enter your email address and we send you a 6-digit code to verify it. Typing the code back in signs you in. There's no password to set or remember. The only personal data we collect via this route is your email address. The code email is delivered through Supabase's transactional email service.
Google sign-in. If you sign in with Google, Google shares the following with us:
- Your email address
- Your name (as set on your Google account)
- Your Google profile picture URL
- A stable Google user ID
We don't ask Google for access to your contacts, email, calendar, or any other Google services. Just basic profile info so we know who you are when you come back.
Whichever method you use, we use the data only to: keep you signed in, show your name or email in the interface, link your favourites, artist picks and calendar token to your account, record which version of our terms you agreed to, and contact you at your sign-in email if we ever need to. We don't send marketing email.
Our lawful basis under UK GDPR for processing this data is legitimate interest, specifically running the features you've chosen to use by signing in.
What we store about you
Once you're signed in, here's everything we hold in our database that's linked to your account:
| Where | What | Why |
|---|---|---|
| auth.users | Your email, and (if you signed in with Google) your name, avatar URL, and Google user ID. Managed by Supabase. | Authentication and identifying you across visits |
| profiles | Your user ID, a flag noting whether you're an admin, the taste profile calculated from your quiz answers, and the version and date of the terms you agreed to | Tells the app whether to show the admin area, personalises matching, and records your agreement to our terms |
| user_favourites | Your user ID plus the festivals you've saved | Your shortlist, synced across devices |
| calendar_tokens | Your user ID and a random token | Lets you subscribe to a personalised calendar feed without exposing your account |
| user_artist_picks | Your user ID and the artists you've picked or ranked in the quiz or the lineup builder, plus any artists carried over from a music service you connected to Festable in the past | Powers artist-based festival matching and My Lineup |
| user_festivals_attended | Your user ID and the festivals you've told us you've been to | Improves your match results by learning from festivals you already liked |
| user_feedback | Anything you submit through the feedback button: the message, the type of report, the festival it relates to, and any festival name, location or website you suggest. Linked to your user ID if you were signed in; anonymous otherwise. | Lets us fix wrong listings and add missing festivals |
| quiz_runs | One row per quiz submission: your answers, the calculated taste profile, the matches returned, any star rating or note you leave on your results, and a hashed IP. Linked to your user ID if you were signed in; anonymous otherwise. | Lets us improve the matching algorithm and debug poor results |
Calendar subscription
You can subscribe to a personalised iCalendar feed of your saved festivals. When you do, we generate a random opaque token and store it against your user ID. The feed URL contains this token, not your user ID or email — so if you share the URL, you share your shortlist but not your identity.
The feed itself contains only festival names, dates, and links. It does not contain your name or email.
You can invalidate your token at any time by regenerating it from the favourites page, or by asking us to delete your account.
Glastonbury ticket syndicate boards
A syndicate board is a shared page for a group buying Glastonbury tickets together. There's no sign-in. Whoever creates it gives us an email address, and everyone else just uses the link.
What a board holds
- The organiser's email address
- The board's name and any instructions written on it
- For each person: their name as typed, their Glastonbury registration number and their postcode
- The order of the groups, each group's ticket status, any coach notes, and the name of whoever marked a group as having tickets
- Saved earlier versions of the board, so a mistake can be undone
Who can see it
Anyone with the board's link can see and change everything on it, much like a shared spreadsheet. The link is a long random code that can't be guessed, and board pages are hidden from search engines, but anyone you send the link to can forward it. Share it with your group and no one else.
Anyone with the link can also download or print the board. Once a copy is downloaded it's outside Festable, and we can't delete it.
If you're adding other people's details, only add people who've asked you to, or who know you're doing it.
What we use it for
Only for running the board. We use the organiser's email to send the board link, to send it again if you ask, to confirm a request to delete the board, and once, shortly before the board is deleted, to tell you when it will go. We don't send marketing email, and we never share or sell anything on a board.
Google Analytics, our only analytics tool, doesn't run on board pages, so it never receives a board's link or anything on it. Our hosting provider, Vercel, keeps standard request logs, which include the web addresses visited, for running and securing the site.
When you create a board or ask to delete one, we hold your IP address in memory for up to an hour to stop the form being abused. It isn't saved.
Our lawful basis under UK GDPR is legitimate interest: running a board that your group chose to use.
How long we keep it
Every board is permanently deleted automatically 6 days after the general ticket sale. For Glastonbury 2027 that's 10 October 2026. A board created after the sale is deleted 6 days after it was made. The organiser's email address is deleted with the board. Demo boards, which only hold made-up people, are deleted after three hours. Deleting a board deletes everything on it, including its saved earlier versions.
Removing your details sooner
- The organisercan delete the whole board at any time with "Delete this board". We email a confirmation link to the organiser's address.
- Anyone on the boardcan clear their own details from it. The board's saved earlier versions may still hold an older copy until the board is deleted. To have that removed too, email hello@festable.live with the board's link and we'll take your details off.
On your phone or computer
So a board keeps working with no signal, your browser saves a copy of it, along with any changes you've made that haven't been sent yet. That copy is removed the next time you open the link after the board has been deleted, and you can clear it at any time through your browser settings. If you open a board on a shared or borrowed device, clear the site's data afterwards. The details are in the table below.
Cookies and local storage
We use cookies and browser storage for essential functionality, quiz progress, and analytics.
| Name | Type | Purpose | Expiry |
|---|---|---|---|
| sb-*-auth-token | Cookie (essential) | Keeps you signed in after you authenticate with email or Google. Set by Supabase. | ~1 week, refreshed on use |
| festable_pending_favourite_slug | Session storage | Temporarily holds a festival you tried to favourite before signing in, so we can save it once you're back | Cleared when you close the tab |
| festable_pending_artist_fav | Session storage | Same thing for an artist you tried to follow before signing in | Cleared when you close the tab |
| festable_pending_consent_version | Session storage | Remembers which version of our terms you agreed to while you're being redirected through sign-in, so we can record it once you land back | Cleared when you close the tab |
| festable_splash_shown | Session storage | Remembers that you've already seen the opening splash screen on mobile, so it only shows once per visit | Cleared when you close the tab |
| fst_quiz | Local storage | Saves your quiz answers and match results so you can return to them | Until cleared |
| fst_cookie_consent | Local storage | Remembers whether you accepted or rejected analytics cookies | Until cleared |
| fst_syndicate_cache_* | Local storage | A copy of a syndicate board you've opened, including the names, registration numbers and postcodes on it, so the board works with no signal | Removed the next time you open the link after the board is deleted; treated as expired after 14 days |
| fst_syndicate_outbox_* | Local storage | Changes you've typed on a board that haven't reached us yet | Cleared once each change is saved, or when the board is deleted |
| fst_syndicate_member_*, fst_syndicate_held_* | Local storage | Which person on a board you are, and which group you're buying for, so a reload puts you back where you were. An ID only, with no names or numbers. | Until cleared |
| _ga, _ga_* | Cookie (analytics) | Google Analytics — loaded only after you accept analytics cookies | Up to 2 years |
You can clear these any time via your browser settings. Signing out will clear the Supabase session cookie.
Maps
The festival map, and the location step of the quiz, are powered by Mapbox. When a map loads, your browser connects directly to Mapbox to fetch map tiles, which means Mapbox receives your IP address and the area of the map you're looking at. We don't send Mapbox your name, email, or account details. Mapbox's privacy policy applies to that connection.
Festival matching quiz
When you take the festival matching quiz, your answers (favourite festivals, artists, preferences, and location) are sent to our server to calculate your matches. Here's what happens with that data:
- Your quiz answers are processed by a matching algorithm that scores festivals based on taste similarity, genre overlap, lineup matches, and proximity to your location.
- When you type in the location field, what you type is sent to the Google Places API as you type, to suggest places. When you pick one, we ask Google for its coordinates so we can score festivals by distance. We don't ask for or store your device's GPS location. Google's privacy policy applies to those requests.
- When you type an artist name, that query is sent to Deezer's public search API to find matching artists. The same happens in the lineup builder.
- Your top matches are sent to Anthropic's Claude AI to generate personalised match explanations. Anthropic's privacy policy applies to that processing. We don't send your name or any identifying information — just quiz answers and festival data.
- We log each quiz submission to our database (the
quiz_runstable described above), including your answers, the taste profile we calculated, and the matches we returned. We use this to improve the matching algorithm and debug poor results. Submissions are linked to your account if you were signed in. Anonymous submissions are tagged with a one-way hash of your IP address so we can group repeat runs from the same visitor without identifying you. Your answers are also saved locally on your device (in thefst_quizlocal storage entry described above) so you can return to your results. - If you take the quiz signed out and then sign in, the artists and festivals you picked are copied onto your account so your results aren't lost.
Analytics
We use one analytics tool, Google Analytics (GA4), to understand how the site is used. It collects which pages you visit, how long you spend on them, and how you arrived at the site, plus a handful of actions we send it ourselves: searches, quiz steps and results, and clicks on ticket links. Nothing we send it includes your name, email or account details.
Google Analytics only loads after you accept analytics cookies via the cookie banner. If you reject them, no analytics tracking runs. It never runs on syndicate board pages, whatever you choose. You can change your choice at any time by clearing your browser's local storage for this site, which will show the banner again on your next visit.
Google's privacy policy applies to Google Analytics data. You can also install Google's Analytics opt-out browser add-on to block Google tracking across all sites.
Ticket links and affiliates
We're a registered Skiddle affiliate, so some of our ticket links carry a tag that tells Skiddle the click came from us. That tag identifies Festable, not you — we don't attach your user ID, email, or any other personal data to an outbound link. Once you land on a ticketing site, their privacy policy applies, not ours. The commercial side of this is explained in our terms.
Third parties and data processors
The third parties that receive or process data on our behalf are:
- Supabase — our database and authentication host. Stores your account details, favourites, artist picks, feedback, calendar token and syndicate boards, and sends the one-time code email when you sign in with email. Data is hosted in the EU (eu-west-1). See Supabase's privacy policy.
- Google (Sign-In) — handles authentication if you choose to sign in with Google. See Google's privacy policy.
- Google Analytics — site usage data, only after you accept the cookie banner.
- Google Places API— receives what you type into the quiz's location field, to suggest places and return coordinates.
- Mapbox— serves the map tiles on the festival map and the quiz's location step, and receives your IP address when a map loads. See Mapbox's privacy policy.
- Anthropic Claude— for generating quiz match explanations. We don't send your name, email, or account info — just anonymous quiz answers and festival data. See Anthropic's privacy policy.
- Deezer— when you type an artist name into the quiz or the lineup builder, we send that query to Deezer's public search API to find matching artists. We don't send your name, email, or any account info. See Deezer's privacy policy.
- Vercel — hosts the website and serves it to your browser. Vercel processes standard request logs (IP address, user agent, URL) for operational and security purposes. See Vercel's privacy policy.
- Resend— delivers our email, including sign-in codes and syndicate board emails. It receives the recipient's email address and the message, which for a board email includes the board's link. See Resend's privacy policy.
- Skiddle — receives a click when you follow one of our tagged ticket links, along with the tag identifying Festable as the referrer. See Skiddle's privacy policy.
We don't use advertising trackers or share data with ad networks, and we don't sell your data to anyone.
Festival listings link out to organisers and ticketing sites. Once you leave Festable, their privacy policies apply, not ours.
Where your data is held
Our database and authentication are hosted in the EU (eu-west-1). Some of the processors above — Google, Anthropic, Vercel, Mapbox, Deezer and Resend — may process data outside the UK and EEA. Where they do, transfers are covered by the safeguards those providers put in place, such as the UK International Data Transfer Addendum or the EU Standard Contractual Clauses.
How long we keep your data
Your account data, favourites, artist picks, attended festivals, feedback, and quiz submissions stay until you ask us to delete them. If you haven't signed in for 24 months we may delete inactive accounts to keep things tidy. Anonymous quiz runs (with no user ID) aren't tied to you and are retained in aggregate to help us improve the matching algorithm.
Syndicate boards follow their own, much shorter schedule, set out in the syndicate section above.
When we retire a feature, we delete the data that only existed to support it.
Children
Festable isn't aimed at children, and we don't knowingly collect data from anyone under 13. If you think a child has signed in, email us and we'll remove the account.
Your rights under UK GDPR
If you've signed in (with email or Google), you have the following rights over the personal data we hold about you:
- Access — ask for a copy of the data we hold about you
- Rectification — ask us to correct anything that's wrong
- Erasure — ask us to delete your account and everything linked to it (favourites, calendar token, profile, artist picks, attended festivals, feedback, and quiz submissions)
- Portability — ask for your favourites in a machine-readable format
- Object — tell us to stop processing your data
To exercise any of these rights, email us at hello@festable.live from the address you signed in with. We'll respond within 30 days.
You have the same rights over your details on a syndicate board, even though you never signed in. Email us with the board's link so we can find them.
You can also raise a complaint with the UK Information Commissioner's Office at ico.org.uk.
Changes to this policy
If anything changes, we'll update this page and bump the date at the top.