Privacy Notice

1. Who is responsible

Deadnorth LLC, [TO BE FILED — Deadnorth LLC mailing address], operates Still On Tour and is the controller of the data described here. Privacy questions and requests: [email protected]. A person reads it. We have not appointed a data protection officer; the site is well under every threshold that would require one.

2. If you only read

No account, no tracking. Your colour scheme and rail state live in two small cookies in your own browser (see Cookies). Cloudflare, in front of the site, and our server keep ordinary web logs — address, page, timestamp — used to keep the site up and to stop abuse, and deleted on the schedule below.

3. If you have an account: what, why, how long, who

One row per feature. “Contract” means the data is needed to give you the feature you asked for (GDPR Art. 6(1)(b), for those keeping score); “legitimate interest” means we keep it to run a safe service (6(1)(f)); “legal obligation” means a law says so (6(1)(c)).

We do not collect precise location. Home region is text you type. Ride origins are shown as a metro to everyone but the rider you accept. There are no photos or file uploads anywhere on the site. There are no direct messages. There are no payments.

4. Retention schedule

Everything has a clock. Most of them are enforced by a nightly job, not by good intentions.

Backups lag: content you delete today can persist in an encrypted backup for up to 35 days before the last copy is gone. That is the honest number, and it is why the content licence in the Terms ends then and not sooner.

5. Who else touches the data

Nobody sees your data to sell you anything. These companies see it to run the service, under a data processing agreement, and only for that purpose. Where data leaves the country of the person it belongs to, the transfer mechanism is listed.

We may disclose data when a law compels it or to protect someone’s life; the Law enforcement page describes exactly how, and how little there is.

6. What we do not do

• We do not sell personal information, and we do not share it for cross-context behavioural advertising. Not now, not as a future line item.
• We run no advertising, no analytics vendor, no tracking pixels, no fingerprinting, no third-party scripts that see you.
• Because of that, there is nothing for a Global Privacy Control or Do Not Track signal to switch off. We honour the intent by having nothing to opt out of; the signal is not processed.
• We do not profile you, score you, or make automated decisions with legal or similar effect. Trust chips are counts of shows you said you attended, computed the same way for everyone.
• We do not market to anyone, and specifically not to minors.

7. Minors

• The site is 16+. Under-16s are refused at registration and nothing about them is stored. If we learn an account belongs to someone under 13 it is deleted with all its content, on actual knowledge, without a parental-consent step.
• Members aged 16 and 17 get protective defaults: profile private, future attendance not public, no search indexing, service notifications only, no digests, no engagement nudges, reverse-chronological feeds. Road features are closed. These are the “strictly necessary” posture: nothing about a known minor is used for anything but giving them the features they asked for.
• An “under 16” report is handled within a day. On confirmation the account is closed and erased in full, posts included.

8. Your rights

These are available to every member, wherever they are. Nothing costs anything.

Access and export

Self-serve from your account page: a ZIP with a machine-readable data.json and a readable index.html, covering every table above, with the sections that are not portable (moderation, bans, reports about you) marked. Or email us; we answer within 30 days.

Correction

Profile fields you edit yourself. Catalog facts you propose to the Committee. Anything else, email.

Deletion

Self-serve, three steps, 14-day cooling-off, your choice whether posts go too. Details in Your data and in section 9 below. Or email with the address on the account.

Portability

The export is JSON. That is the portable format; there is no direct-transfer API.

Objection and restriction

Where we rely on legitimate interest — blocks, reports, moderation, bans, logs — you can object by email. We will stop unless we have grounds that override yours, and we will say which.

Complaint

To us first: [email protected]. If you are in a place with a data-protection authority, to it. If US state law gives you an appeal right and we refuse a request, the refusal will say how to appeal and how to reach your Attorney General.

We verify requests using the email address on the account (or, for non-members, the address the request comes from plus something only the person could know). We do not ask for identity documents.

9. What stays after you leave

Erasure is real, and it is not total. When your account is erased:

• Your account, email, password hash, sessions, consent records, notifications, blocks you placed, follows, bookmarks, reactions, RSVPs, requests, prefs, feedback and export files are deleted.
• Your posts, comments, crew posts, event posts, missed connections and similar are deleted if you chose that (the default), or left in place unattributed if you did not.
• Setlist, attendance and correction contributions stay, credited to “a former member”; your rationale, citations and comments on them are blanked.
• Blocks other people placed on you become opaque rows with no identity — they cannot be linked back to you and they no longer stop anyone.
• Reports about you, with their snapshot, stay for 12 months after resolution (36 for legal notices) so an appeal or a legal question can still be answered.
• Preservation holds keep a copy for their basis — up to a year for abuse-material reports — and then blank it. If a hold is on your content when you ask to leave, the erasure runs when the hold lapses; until then the account is hidden and masked.
• Strikes stay for their 12-month term with your account number zeroed. The moderation ledger keeps its rows with your account number zeroed.
• Your handle is reserved for 12 months so nobody can pass as you.
• If you were banned, a keyed hash of your email stays until the ban is lifted, and a keyed hash of your IP for 30 days.
• Encrypted backups can hold a copy for up to 35 days.
• An erasure log row is written — a date and a basis, no identity.

10. Security and breaches

Passwords are hashed. Traffic is encrypted. The origin server accepts connections only from Cloudflare. Administrator accounts use a second factor. Backups are encrypted at rest. If a breach exposes your data we will tell you by email and by a notice on the site as soon as we understand what happened, and within whatever period the law where you live sets — we keep the runbook, and the register of anything that happens, whether or not it meets a reporting threshold.

11. Where the service is offered

Still On Tour is not offered to persons located in the EU, the EEA or the UK; registration and posting are closed from those places and nothing is directed there. We have not appointed EU or UK representatives. Every right in section 8 is available to everyone anyway. If that changes, this section and the Contact and representatives page will be updated first.

12. Changes

Material changes re-prompt your acceptance before your next post and are listed in the changelog on the Moderation and transparency page. The version string at the top of this page is the one your acceptance is recorded against.

Change log

• 2026-08-17 — Rewritten: per-surface table, retention schedule, sub-processors, minors, what stays, availability statement.
• 2026-08-16 — First published.