Privacy Notice

1. Who is responsible

Dead North LLC, 2688 Rice St #1060, Saint Paul, MN 55119, operates Still On Tour and is the controller of the data described here. Privacy questions and requests: [email protected]. A person reads it. We have not appointed a data protection officer; the site is well under every threshold that would require one.

2. If you only read

No account, no tracking. Your colour scheme and rail state live in two small cookies in your own browser (see Cookies). Cloudflare, in front of the site, and our server keep ordinary web logs — address, page, timestamp — used to keep the site up and to stop abuse, and deleted on the schedule below.

3. If you have an account: what, why, how long, who

One row per feature. “Contract” means the data is needed to give you the feature you asked for (GDPR Art. 6(1)(b), for those keeping score); “legitimate interest” means we keep it to run a safe service (6(1)(f)); “legal obligation” means a law says so (6(1)(c)).

We do not collect precise location, ever — not from your browser, not from your phone, not from an IP lookup. Your town is one you pick from a list of real places, and what is stored is which town you picked. Ride origins are shown as a metro to everyone but the rider you accept. There are no payments, and no money passes through this site.

Pictures. You can upload a profile photo, a banner, a gallery, pictures on a post or a lot listing, and pictures in a message. Two things happen to every one of them on the way in: the EXIF block is discarded, so the GPS coordinates of the room you were standing in and your camera’s serial number never reach our disk; and the image is re-encoded, so nothing that was hidden inside the original file survives. We keep the picture, its size, and a fingerprint of its pixels — that fingerprint is what lets us find identical copies when somebody asks for an image of them to come down.

Messages. Direct messages are private between the people in them and are not end-to-end encrypted: they sit in our database, and a moderator can read a specific conversation if it is reported to them. Nobody reads them otherwise, there is no scanning, and they are never used to decide what you see anywhere else on the site. One thing to be clear-eyed about: a picture you send in a message is stored under a long, unguessable web address rather than behind a per-message permission check. The address is the protection — anyone the link is handed to can open the image, so if it leaves the conversation the picture can be seen without an account, and that copy is beyond the reach of a later deletion. Treat a picture you send as something you have shown someone, not something you can take back.

4. Retention schedule

Everything has a clock. Most of them are enforced by a nightly job, not by good intentions.

Backups lag: content you delete today can persist in an encrypted backup for up to 35 days before the last copy is gone. That is the honest number, and it is why the content licence in the Terms ends then and not sooner.

5. Who else touches the data

Nobody sees your data to sell you anything. These companies see it to run the service, under a data processing agreement, and only for that purpose. Where data leaves the country of the person it belongs to, the transfer mechanism is listed.

We may disclose data when a law compels it or to protect someone’s life; the Law enforcement page describes exactly how, and how little there is.

6. What we do not do

• We do not sell personal information, and we do not share it for cross-context behavioural advertising. Not now, not as a future line item.
• We run no tracking pixels, no fingerprinting, and no third-party script that can identify you. The one analytics tool we use, Cloudflare Web Analytics, is cookieless and stateless: it counts page views and cannot tell whether two of them are the same person. See the Cookie Notice for exactly what it records.
• We do not build profiles, and nothing measured is ever joined to your account.
• If any of that ever changes, this page changes first, and the date at the top changes with it.
• Because of that, there is nothing for a Global Privacy Control or Do Not Track signal to switch off. We honour the intent by having nothing to opt out of; the signal is not processed.
• Your record shelf — which official releases you own, seek, or have heard, with any note you attach — is kept while your account exists, is private by default, is included in your data export, and is deleted with your account. Awards computed from it live and die the same way.
• We do not profile you, score you, or make automated decisions with legal or similar effect. Trust chips are counts of shows you said you attended, computed the same way for everyone.
• We do not market to anyone, and specifically not to minors.

7. Minors

• The site is 18+. Under-18s are refused at registration and nothing about them is stored. If we learn an account belongs to someone under 13 it is deleted with all its content, on actual knowledge, without a parental-consent step.
• The account floor is 18. Registration asks for a birth year and refuses one that could belong to someone younger, so there is no population of under-18 members to apply protective defaults to. The archive itself stays open to read without an account.
• An “under 18” report is handled within a day. On confirmation the account is closed and erased in full, posts included. If we learn a member is under 13 we delete without waiting to be asked, which is what the law requires of us whatever our own floor says.

8. Your rights

These are available to every member, wherever they are. Nothing costs anything.

Access and export

Self-serve from your account page: a ZIP with a machine-readable data.json and a readable index.html, covering every table above, with the sections that are not portable (moderation, bans, reports about you) marked. Or email us; we answer within 30 days.

Correction

Profile fields you edit yourself. Catalog facts you propose to the Committee. Anything else, email.

Deletion

Self-serve, three steps, 14-day cooling-off, your choice whether posts go too. Details in Your data and in section 9 below. Or email with the address on the account.

Portability

The export is JSON. That is the portable format; there is no direct-transfer API.

Objection and restriction

Where we rely on legitimate interest — blocks, reports, moderation, bans, logs — you can object by email. We will stop unless we have grounds that override yours, and we will say which.

Complaint

To us first: [email protected]. If you are in a place with a data-protection authority, to it. If US state law gives you an appeal right and we refuse a request, the refusal will say how to appeal and how to reach your Attorney General.

We verify requests using the email address on the account (or, for non-members, the address the request comes from plus something only the person could know). We do not ask for identity documents.

9. What stays after you leave

Erasure is real, and it is not total. When your account is erased:

• Your account, email, password hash, sessions, consent records, notifications, blocks you placed, follows, bookmarks, reactions, RSVPs, requests, prefs, feedback and export files are deleted.
• Your posts, comments, crew posts, event posts, missed connections and similar are deleted if you chose that (the default), or left in place unattributed if you did not.
• Setlist, attendance and correction contributions stay, credited to “a former member”; your rationale, citations and comments on them are blanked.
• Blocks other people placed on you become opaque rows with no identity — they cannot be linked back to you and they no longer stop anyone.
• Reports about you, with their snapshot, stay for 12 months after resolution (36 for legal notices) so an appeal or a legal question can still be answered.
• Preservation holds keep a copy for their basis — up to a year for abuse-material reports — and then blank it. If a hold is on your content when you ask to leave, the erasure runs when the hold lapses; until then the account is hidden and masked.
• Strikes stay for their 12-month term with your account number zeroed. The moderation ledger keeps its rows with your account number zeroed.
• Your handle is reserved for 12 months so nobody can pass as you.
• If you were banned, a keyed hash of your email stays until the ban is lifted, and a keyed hash of your IP for 30 days.
• Encrypted backups can hold a copy for up to 35 days.
• An erasure log row is written — a date and a basis, no identity.

10. Security and breaches

Passwords are hashed. Traffic is encrypted. The origin server accepts connections only from Cloudflare. Administrator accounts use a second factor. Backups are encrypted at rest. If a breach exposes your data we will tell you by email and by a notice on the site as soon as we understand what happened, and within whatever period the law where you live sets — we keep the runbook, and the register of anything that happens, whether or not it meets a reporting threshold.

11. Where the service is offered

Still On Tour is not offered to persons located in the EU, the EEA or the UK; creating an account is refused from those places and nothing is directed there. We have not appointed EU or UK representatives. Every right in section 8 is available to everyone anyway. If that changes, this section and the Contact and representatives page will be updated first.

12. Changes

Material changes re-prompt your acceptance before your next post and are listed in the changelog on the Moderation and transparency page. The version string at the top of this page is the one your acceptance is recorded against.

Change log

• 2026-08-17 — Rewritten: per-surface table, retention schedule, sub-processors, minors, what stays, availability statement.
• 2026-08-16 — First published.