Privacy notice

CatchWorm helps you find gigs, track your favourite artists, plan with friends and keep memories from the night. This notice explains what we use and who can see it.

Juan Huang, a UK sole trader trading as CatchWorm, is the controller responsible for your personal information. Email hello@catchworm.com for a question or data request. You can also use our Contact page.

Journey analytics

With your consent, we use Cloudflare Workers Analytics Engine to understand visits and where journeys stop. We record page categories and public artist/event paths, time on visible pages, click positions and button actions, submitted artist searches and search outcomes, artists clicked in announcements, alert setup and device size. We also record referring website domains and campaign/post tags, share-menu handoffs, copied links and visits through random tagged share links. A handoff does not tell us who received a share or how many friends saw it.

A random session ID connects your journey. A random browser ID lasts up to 90 days to recognise returning browsers. When you’re signed in, we link events to your internal account ID. These records are pseudonymous, not anonymous, and cannot reliably count unique people. We don’t include your account email, full referrer URLs or geographical coordinates in analytics events. Click positions describe points on the page, not your location. We filter obvious emails, URLs and phone numbers from search terms, but this cannot remove every personal detail. Please keep artist searches free of personal information.

The dashboard is restricted to the CatchWorm administrator. Cloudflare retains analytics events for three months. Use Analytics preferences in the footer to withdraw consent: this stops new tracking and clears your browser and journey IDs. It does not erase earlier events or affect the lawfulness of use before withdrawal. Contact us for access or deletion. Our current analytics store does not provide an individual event-deletion control; we’ll assess your request and explain the action we can take. Your data rights still apply.

Your account and alerts

We store your email address, account name, optional profile picture, artists you track and alert preferences. If SMS sign-in is available and you use it, we also store your mobile number.

Email sign-in uses a six-digit verification code, not a password or magic link. We send the code through Cloudflare and check the code you enter. We store hashed codes and request identifiers, session records and hashed email/IP request records to limit misuse.

You can choose new tour dates, tickets going on sale, tickets becoming available again and new announcements, with tour and ticket preferences set to Worldwide or your country. Manage these on the artist page. We use your choices to send email updates when we detect new dates, confirmed ticket changes or newly dated announcements in our feed. Each alert includes links to stop alerts for that artist or all artists. You can also turn off all email alerts from Alert settings under Your account. The Email alerts switch pauses or resumes delivery without changing your saved artist preferences. We record when and where you change this setting so we can honour your choice. Sign-in code emails are separate. Availability checks are periodic, not instant.

Feedback and ideas

Feedback is private to you and the CatchWorm team. We store your account identifier, message, category and submission date so we can review it. Feature ideas are reviewed before publication. Published titles and descriptions are public, but we don’t show the author’s name or email. We link votes to accounts to count one vote per account per idea. Avoid including personal details in an idea you want published. You can remove your vote. For removal of a submission, contact us through theContact page.

Shows and plans with friends

My shows, saved event details and some planning information are kept in your browser on this device. Shared plans and attendance responses can also be stored on our server, including the event, participant names and Going, Maybe or Not going responses. A guest identifier helps us recognise responses.

People with a shared plan link may see its details and participant names. Only send links to people you want to include. Sharing an event through your device’s share menu or Copy link sends the details you choose to another app; that app handles them under its own policy.

Private moments

Moments are private in the current version; public posting is disabled. Where private invitations are available, keep links within your group: someone you send one to can join after signing in and may contribute. Invited people can copy content they can see, so share thoughtfully.

Where sharing is available, photos and videos are uploaded to Cloudflare storage. We keep the file, filename, type, upload date, account identifier, descriptions, video captions and sharing audience, alongside invitation, membership and report records. You can delete your own shared uploads. Some older media is stored only in your browser. Shared photo and video storage isn’t enabled in the current live version, so uploading may be unavailable.

Uploaded files may retain information recorded by your device, such as the date or location a photo was taken. Check the file before sharing it before sharing with anyone.

Location and other services

Cloudflare supplies an approximate country and, where available, city from your IP address. We use this for country filters and travel starting points. You can enter a different city without sharing precise location. City searches may be sent to OpenStreetMap’s Nominatim service and Komoot’s Photon service to find places.

If you choose Enable location and allow access in your browser, we use precise device coordinates for travel estimates. They are sent to our Cloudflare-hosted travel planner and the Project OSRM routing service with the destination coordinates. We do not save these device coordinates in your account database or analytics events. Your selected city can be remembered in browser storage. Choose a city instead or close the event page to stop using the device location there; you can revoke the site’s location permission in browser settings.

Cloudflare hosts the app, database and email service. Twilio handles SMS codes when SMS sign-in is enabled. Google Fonts and Esri map tiles receive technical request information, such as your IP address, when they load. Event and travel information comes from external providers, including Ticketmaster and Skiddle. Artist searches are sent to these providers to find matching artists and events. Externally hosted artist/event images also receive technical request information when displayed. Booking, sharing and other external websites have their own privacy notices.

Processing outside the UK

Our suppliers operate internationally, so information may be processed outside the UK. This includes hosting, email, SMS, maps, fonts and routing services. Contact us for information about processing locations and the transfer arrangements for your data. We are reviewing the applicable supplier arrangements; this notice does not claim that all processing stays in the UK.

Why we use your information

We use account and shared-plan information to provide the features you request, under our agreement with you. This includes sign-in, saved alert preferences and private invitations. Analytics and optional precise location use are based on your consent. Email alerts are sent when you request them and can be switched off separately from sign-in messages. Accepting our terms does not opt you into analytics or unrelated marketing.

Our legitimate interests are protecting the service from misuse, responding to feedback and support, reviewing feature ideas and counting votes, finding artists and events you search for, and using approximate location to suggest relevant filters and starting cities. We may also use information where needed to comply with a legal obligation. We don’t sell your account information or use it for advertising profiling. You can browse without an account, but signing in is needed to manage alerts and contribute to shared memories.

How long we keep it

Email codes expire after 15 minutes, SMS sign-up tickets after 10 minutes and account sessions after 30 days. Email request-limit records older than 24 hours and expired email codes are cleaned up when new codes are requested. Other expired records may remain until removed.

Account, shared-plan, membership, alert preference and report records are kept while needed to provide the service, manage access or resolve a concern. Contact us to request deletion; any information we must retain for a legal obligation or unresolved issue will be explained. Browser data stays until you remove it or your browser clears it. Keep your own copies of important photos and videos.

If you email us, we use your address and message to respond. Our admin email tool keeps sent-message content, recipient addresses, attachment names and delivery status for 30 days, with older records removed when another message is sent. Inbox and supplier-held copies can have separate retention periods.

Your choices and rights

You can edit your profile, manage or switch off artist alerts, and delete your own shared uploads where available. Signing out doesn’t delete your account or clear all browser data. See Cookies & storage for device storage.

To ask for access, correction, deletion, restriction or a portable copy of your personal information, or to object to its use, contact us. Which rights apply depends on the information and why we use it.

We respond to data rights requests without undue delay, normally within one calendar month. If the law allows an extension, or we need reasonable identity checks or clarification, we’ll explain this. We do not use these records to make automated decisions with legal or similarly significant effects on you.

Privacy requests and complaints

For a data request or a concern about how we use your personal information, see Privacy requests and complaints on our Contact page. We’ll acknowledge privacy complaints within 30 days, investigate without undue delay, keep you informed and tell you the outcome. This acknowledgement period is separate from the deadlines for handling data rights requests.

You can also complain to the Information Commissioner’s Office.