Privacy policy

1. What we collect and why

Your account

• A username and password, so you can sign in. You do not need an email address to use Olaroo.
• If you add them: an email address (to sign in with a link and get back into your account), a profile photo, a festival photo shown on the map and a short bio.
• Contact details you choose to store, such as Instagram, Snapchat or a phone number. A connection only sees one after they ask for it and you say yes.
• Your connections, the people you mark as crew and the groups you make.
• Your settings, such as who can see you and which notifications you want.

Anyone who taps your picture in a festival chat or a group chat sees a small profile: your name, photo, bio and when you joined. Profile and festival photos are stored so that anyone with a photo's web link can open it. People can find you by searching your exact username unless you turn off Findable by username.

Your location

Olaroo uses your phone's location during the festivals you are going to, from shortly before they start until shortly after they end. It shows you on the map, works out which area of the site you are in and keeps your Footprints.

• Who sees you. You choose, for each festival: Off (nobody), Just me, Crew (the people you mark as crew), Custom (groups and people you pick) or Everyone (all your connections). Sharing starts off.
• How precisely. You choose whether they see only the area you are in or your exact spot. Your exact spot never goes to Everyone: when you share with Everyone, only your crew see your exact spot.
• What comes with it. People who can see you also see how long ago your position was taken, whether you are at camp or off site, and your phone's battery level. At your camp they see "At camp", not your exact spot. Your crew get an alert when your battery runs low. Turn off Show my battery level on the Me screen and nobody sees your battery level or gets the alert.
• Alerts when you move. The people who can see you at a festival get an alert when you arrive at a stage. They also get one when you arrive at or leave the festival. They get one when you get back to or leave camp too. Nobody else gets these alerts. Turn each kind off on the Me screen under Notifications.
• Footprints. Footprints is your own record of where you went at a festival. Only you can see it. If you share your location with other people, it also helps build the organiser's anonymous heat map, described under What organisers see. It records while you are at the festival. Off-site tracking, which is on unless you turn it off, keeps it recording when you leave the site, until a day after the festival ends. Off site, it pauses once you have stayed in one place for a couple of hours. Setting sharing to Off does not stop Footprints on its own: turn off Off-site tracking as well, or open Me > My location > I want to… and choose Go completely dark.
• The journey home. If you share your exact spot, have set a camp and have Off-site tracking on (Me > My location, set for each festival), your crew can watch you head back to camp after you leave the site. It stops when you reach camp, and 6 hours after you leave at the latest. Off-site tracking is on unless you turn it off. Turning it off stops the journey home and your Footprints off site.
• Short shares. Some features share your exact spot for a short time: a beacon your crew send (3 minutes, and you can turn beacons off), an SOS flare you send to your crew and a "where are you?" answer you choose to give.
• Which country you are in. When you open the map in Explore, your phone looks up which country you are in, so the map opens there. It sends its position to Google on Android, or to Apple on iPhone, to find out. It only does this if Olaroo already has your location, and the answer stays on your phone.
• Technical details. With each position we store your phone type, its system version, the app version and details of the location fix, such as its accuracy, its speed and whether your phone was still or moving. We use them to find and fix location problems.

Your steps

• On Android, Olaroo reads your daily step count from Health Connect, if you allow it.
• On Android, if you allow Physical activity, Olaroo uses the phone's motion sensor to tell when your phone is still, so a jumpy GPS reading does not move you on the map.
• On iPhone, Olaroo reads your step count from the iPhone's own step counter (Motion & Fitness), if you allow it. It also uses the motion sensor to notice when you are standing still, so it can ease off GPS and save battery. Olaroo does not use Apple Health.
• We keep your daily totals with your account, so you can see your best day. Other people only see them if you join a festival's step leaderboard.

Your plans and opinions

• The festivals you save, the sets you plan to see, the artists and stalls you follow and the festivals you have been to.
• Your ratings of sets and stalls and your answers in Help the app know you. They shape what the app suggests to you.
• Your crew can see your plan unless you turn off Share my plan. A note you add to a set rating is private: only you ever see it.
• Your festival history appears on your public profile, or in Crossed paths, only if you turn those on.

Messages and chat

• Direct and group messages are encrypted on your phone before they are sent, so our database and its backups only hold scrambled text. Only the people in a conversation can open it in the app. We hold the key that unscrambles them, so we could read them, although nothing we run does. Their notifications show who a message is from, never what it says. We delete messages after 400 days.
• Festival chat, announcements and artist fan rooms are not encrypted. This lets the festival's moderators and our team remove posts and deal with abuse. Your posts there show your name and photo. Fan room posts are deleted after 180 days.
• If a festival chat post is removed, by a moderator or by you, we keep a copy with your name so moderators have a record of it.
• If you report a message or a person, we keep the report.

Photos you add

Your profile and festival photos are covered above. Pictures you post in a festival chat are stored privately and shown only to people who can read that chat.

Five a Day photos

• You can add up to five photos a day at a festival, with stickers, text, drawing, a caption and tags. Each photo is stored privately. Only you can see a new photo until you choose who else can: your crew at that festival, all your connections or people you pick. People you tag can always see it.
• Before a photo leaves your phone, Olaroo takes its exact position and other hidden details out of the file. Your phone uses the position once, to name the stage or area the photo was taken in. It never names a campsite, a spot near the camping or your camp, and it names nothing if you turn off Show where my photos were taken. The position itself is never sent to us.
• Your connections can tag you in their photos unless you turn off Connections can tag me in photos. A tag shows everyone who can see the photo that you were at that festival at that time. You are told, and you can remove it.
• People who can see a photo can like it and comment on it, unless its owner turns that off. Comments are not encrypted, so they can be moderated. If you report a photo or a comment, we keep the report.

Bug reports and crashes

• When you send a bug report, it includes a screenshot taken just before the report form opened, the app version, your phone type, the screen you were on, the festival and a short technical log. Screenshots are stored privately and only our team can open them.
• If the app hits an error and crashes, it sends us the error details and a short technical log the next time it opens.

Usage analytics

Olaroo counts which screens and features get used, so we know what to improve. Each record holds only simple values, such as which feature was used and how many times. It never holds message text, positions, status text or names. It stays in our own database and we do not share it. You can turn it off on each phone in Me > Settings > Privacy > Share usage analytics.

Notifications

To send you notifications we store a push token for your phone. Each notification passes through Expo's push service and then Apple or Google to reach your phone.

If you use the organiser portal

We collect your email address and password, the details you give when you apply (your organisation, a contact name and email, your event and its website) and everything you build. We email you about your account and your events. A bot check runs when you sign up and when you apply.

Visits to olaroo.com

When you open the home page of olaroo.com or a festival's page there, or see a festival's line-up that Olaroo shows on the festival's own website, we count the visit in our own database. We keep the time, which page or festival it was, the country your internet connection is in, the website that sent you (for a line-up on a festival's website, that website), the label on the link if it has one (our emails, pictures shared from the app and festivals' websites add one), whether you were signed in to the portal and whether the visit looks like a search engine or other robot. We do not keep your internet address or set a cookie, so a visit does not say who you are.

2. What organisers see

Organisers pay for Olaroo's crowd tools. What they get is counts, and no count ever says who is in it.

Only people who share their location with others (Crew, Custom or Everyone) are counted. If your sharing is Off or Just me, you are never counted.

• How busy each area is. The number of people in each zone, in 5-minute snapshots. A zone with fewer than 3 people shows no number.
• A heat map. Squares about 20 m across, in 5-minute snapshots. A square only appears when 5 or more different people were in it. It is built from the Footprints of people who share their location with others.
• These snapshots never store who anyone is. We keep them for 400 days.
• Their event overview. How many people have saved the festival, how many have made a plan and how many have built a crew there. For each set, how many people are going and its average rating, shown only once 3 or more people have picked or rated it.
• Stall ratings and issue reports. Organisers see a stall's average rating, never who gave it. Issue reports you send, such as a broken toilet, reach them without your name.
• Messages to an area. An organiser can send a message, such as a safety warning, to everyone on site or to the people in chosen stages or areas. Olaroo works out who gets it from the area your phone reported in the last 45 minutes, inside our own database. The organiser sees only how many people it reached, never who. A message they mark as Safety reaches you even if you turned that festival's announcements off.
• Festival news. If you save a festival, its organiser can send you news, such as tickets or next year's first acts, through Olaroo. They never get your name or email, only how many people get their news and how many opened each message. Turn it off on the festival's page in the app or with Stop this news in any news message. You can also turn it on for a festival you have not saved.

Organisers do see your name in three places: when you post in their festival chat (with your photo and your post), when you ask to join one of their closed chats (with your photo, shown to the people who run that chat) and when you ask to join a private festival.

3. Who else handles your data

We use these companies to run Olaroo:

• Supabase runs our database, sign-in, file storage and server functions. Everything in this policy is stored there.
• Expo delivers notifications and app updates. Apple and Google carry notifications to your phone.
• Google Firebase Cloud Messaging wakes an Android phone when its owner's crew ask where they are.
• Google Maps (on Android) and Apple Maps (on iPhone) draw the map in the app. They receive what they need to draw it, such as the area on screen.
• On Android, Google's Maps and Firebase software keeps its own identifiers for your phone, which Google uses to run those services.
• Google (on Android) and Apple (on iPhone) tell your phone which country it is in, from its position, when you open the map in Explore.
• Vercel hosts olaroo.com.
• Resend sends our emails, from hello@olaroo.com: password resets, email address confirmations and the portal's emails.
• Cloudflare Turnstile runs the bot check on portal sign-up and applications.
• MET Norway (the Norwegian Meteorological Institute) provides the weather. Our server asks it for the forecast at the festival's location, so the weather in the app tells MET Norway nothing about you. If you tap Full forecast on Yr, MET Norway's Yr site opens in your browser and sees your internet address, like any website.
• Map pictures in the portal come from CARTO and Esri. Music previews come from Apple, and artist photos load from the sites that host them. These see only your internet address.

Some of these companies process data outside the Isle of Man and the UK. Olaroo has no advertising and no third-party tracking tools, in the app or on olaroo.com.

4. How long we keep it

• Your account, profile, plans, ratings, step totals and festival chat posts: until you delete them or your account.
• Five a Day photos, their tags, likes and comments: until you delete them or your account.
• Footprints: until you delete them or your account.
• Direct and group messages: 400 days.
• Artist fan room posts: 180 days.
• Usage analytics: 365 days.
• Visits to olaroo.com: 365 days.
• Bug reports and crash reports: we delete each one, with its screenshot, once we have dealt with it and it is 365 days old.
• Your phone's push token: 180 days after Olaroo last opened on your phone. Signing out removes it sooner.
• Crowd snapshots for organisers: 400 days. They hold no names or ids.
• Technical records: each position you share, 14 days. Changes to your sharing settings, 90 days. The list in Me > Settings > Your activity, 365 days.

5. Your choices and rights

• Change who sees you at any time, on the map or on the Me screen under My location. Enter the shadows hides you from everyone's map for a while. To stop sharing and recording, open Me > My location > I want to… and choose Go completely dark.
• Managed for me, on the Me screen under My location, sets up every festival you save for you: while you are on site your crew see your exact spot and can refresh it, and your Footprints are kept, off site too. Nobody else sees you. While it is on, the sharing choices on this page are greyed out, Go completely dark included, so turn Managed for me off first. Turning it off leaves each festival as it is until you change it. Enter the shadows still works while it is on.
• Stop Olaroo using location by setting Location accuracy to Off on the Me screen, or by turning location off for Olaroo in your phone's settings.
• Turn things off on the Me screen: Off-site tracking (your journey home and your Footprints off site), beacons, Findable by username, Share my plan, Show my battery level, alerts when you move, Crossed paths, where your photos were taken, tagging in photos and usage analytics.
• Delete your Footprints for a festival: open your Footprints on the Me screen and choose Delete trail.
• Delete your account in Me > Settings > Account > Delete account. This deletes your account and the data we hold about you, including your profile, photos, connections, messages, plans, Footprints and step totals. Festivals and other content you made for others stay, without your name. Copies of removed festival chat posts stay for moderators. No longer have the app? Sign in at olaroo.com/delete-account and delete your account there.
• Get a copy of your data, or ask us to correct it, by emailing hello@olaroo.com. The app does not have a download button for this yet.

The Isle of Man's GDPR and LED Implementing Regulations 2018 apply to PC Mann Limited, the company that runs Olaroo. They give you the right to see the personal data we hold about you, to have it corrected or deleted, to object to how we use it and to take a copy with you. If you live in the UK, the UK GDPR gives you the same rights.

If you are unhappy with how we handle your data, please tell us at hello@olaroo.com. You can also complain to the Isle of Man Information Commissioner at inforights.im.

6. Keeping your data safe

Rules in our database decide who can read each record, so other people see only what you have chosen to share. Direct and group messages are encrypted on your phone, with a key we hold. Bug report screenshots are stored privately.

7. Children

Olaroo is for people aged 16 and over. It does not ask your age when you sign up. Crossed paths and showing your festival history on your public profile are only for people aged 18 or over, and the app asks you to confirm your age before you turn them on.

If you think a child has given us personal data, email hello@olaroo.com and we will delete it.

8. Changes to this policy

When we change this policy we update the date at the top of this page. If a change affects how we use your data, we will also tell you in the app.

9. Who we are

Olaroo is run by PC Mann Limited, a company registered in the Isle of Man (company number 111937C). Our address is 52 Buttermere Drive, Lakeside Gardens, Onchan, Isle of Man IM3 2EA.

PC Mann Limited decides how your personal data is used, so we are responsible for it. The law calls this the data controller.

This policy covers the Olaroo app for iPhone and Android and the organiser portal at olaroo.com. If you have a question about it, email hello@olaroo.com.