Privacy Policy — StageRage

1. Controller and contact

StageRage is the app and service name. The controller of the personal data described in this policy is Sebastjan Zavrl s.p., MGLightning, Podreča 126, 4211 Mavčiče, Slovenia. Contact us about privacy, your data, or this policy at admin@stagerage.online.

This policy describes the live product. It does not make StageRage responsible for information you choose to disclose publicly or share with other tour members, venue, coordinator, or game participants, or third-party services.

2. Data we collect

• Account and security data: email address, display name, country, selected touring role, hashed password, Google account identifier if you use Google sign-in, email-verification state, two-factor-authentication configuration (your TOTP secret is encrypted at rest), subscription, seven-day free trial, student verification, and team membership status, and security/session data. We receive limited payment identifiers and status from PayPal for Stage Operations Pro and one-time support payments — not your full card details.
• Trial eligibility: where offered from December 1, 2026, we limit a trial to one per person. For that we store keyed (HMAC) hashes of your canonical email address, of the network you used when you started the trial and, only if you agree to the optional security cookie, of a random identifier held in that cookie, together with the start and end of the trial. We do not store the address or the IP address in this record. We use it only to provide the trial and to prevent repeat use (legitimate interests: security and fraud prevention), and delete it 90 days after the trial starts.
• Age confirmation: to confirm the age requirement in our Terms (18 or older) we ask for your date of birth when you sign up, or the next time you sign in if your account is older. We check it once on our server and keep only that you confirmed it and when, never the date of birth itself. If it shows you are under 18 we do not create the account, and we close an existing account and delete its data. When you continue to sign up with Google or Discord, a 15-minute cookie holding only a signature (no date of birth) proves the check was passed.
• Profile and public contribution data: profile image, bio, skills, availability, crew tags, venue claims, reviews, ratings, comments, forum posts, map pins, votes, reports, uploaded media, and other content you submit. Reviews, comments, map pins, venue information, game leaderboards, and public-profile fields may be visible to other users and the public according to the feature and your settings.
• Touring, coordination, and planning data: tour plans, member and permission information, schedules, tour and coordinator chat text and voice messages, event details, checklists, guest-list requests, hotels, flights, equipment/carnet data, merch inventory, settlement records, calendar-feed credentials, coordinator workspace content (run-of-show, artist schedules, show-clock and transition records, classified documents, matched contact lists, and operational audit notes), and related notes. This data can contain personal data about you or people you add to a plan.
• Company workspace records: where a company workspace is used, its owner and team members and, for employees, the records they create: inventory, locations, vehicles (including a registration plate, visible to the owner and team members only), bookings, repair tickets with costs and suppliers (owner and team members only), inspections, condition checks (including the name typed as a signature and the time), close-out reports, the equipment lines chosen from a rider, ATA carnet customs data (owner and team members only) and a history of who changed what and when. A company that uses API keys also has the keys' names, scopes and last-used time, and a log of each request a key made (the key prefix, the route, the result, the calling address and the time). These records belong to the company, are visible to its members according to their role, are removed when the company is deleted, and are kept in backups as described in section 7.
• Support access to company accounts: to provide support, authorised StageRage administrators can open a company’s account summary: its name, owner, members, employees and pending invitations (names and email addresses), plan and seat use, whether the owner has accepted each optional policy, fitted vehicle units, and the company’s own history of account changes. They cannot see inventory contents, vehicle positions, load locations, street addresses or payment credentials there. An administrator can change a company’s plan by hand, transfer ownership, remove a member, revoke an invitation or deactivate a unit only by giving a written reason, and every such change is recorded in an audit log with who made it and when.
• Toolkit data: private cargo/case templates, archived load plans, loader scan sessions (flightcase and truck label tokens with verification steps), stage plots, technical and hospitality riders (including the equipment, notes, warnings and the band, crew and agency contact details that Rider Analyzer recognises in them — see section 5D), audio input/output lists, private wireless-device profiles, and RF coordination requests. RF frequency observations include city/country, device technical class, and frequency; we use them as aggregated local coordination evidence and do not expose the reporting account with the result.
• Games and leaderboard data: multiplayer game rooms with their player list, moves, and results; a short result record for each rated multiplayer game (the game, the players' account identifiers, the outcome, and the date); arcade submissions recomputed from server-side replay events; and leaderboard entries showing your display name, score or wins, and account identifier. Friend, crew, and coordinator membership can be used to offer game-invite suggestions.
• Support and communications data: messages you send to support, email replies and attachments we receive through our inbound support address, replies, account notices, verification and password-reset requests, and notification preferences.
• Technical and security data: IP address, user-agent/device and browser information, authentication and rate-limit events, audit events (including staff actions on user data), error context, and server logs. We do not include request bodies, authentication cookies, or authorization headers in Sentry error reporting. Licensed Pro tools use a random per-browser install identifier inside a signed, cached license token bound to your account; if a protected tool detects that it was copied to an unrecognised website, it sends one abuse report containing that page address and your browser type so we can enforce our licence.
• Optional analytics: only after consent, a normalized page/tool category, broad referral category (including a named search or AI discovery service where it is the referrer), sanitized campaign label, bucketed page-quality ratings for loading/interaction/visual-stability metrics (categories only — never raw timings or page addresses), and a rotating daily pseudonymous identifier. Consent-gated venue-search text may be kept as a roadmap signal; anything resembling personal data (emails, URLs) is replaced with a placeholder before storage. Event pages use an opaque server-generated event key, venue pages use a separate opaque server-generated venue key, and news articles use an opaque server-generated article key, so their creators or verified owners can see aggregate opted-in counts only. If email engagement tracking is introduced, it will be separately consent-gated and limited to aggregate delivery and engagement events; no marketing tracking is enabled without that consent. We do not put account IDs, raw event/venue/article IDs, ticket URLs, raw IP addresses, full referrers, prompts, AI answers, query strings, review text, precise coordinates, or browser fingerprints into product analytics.
• Location, audio, and device permissions: if you choose a map, route, weather, or RF-location feature, we process the location or place name needed for that request; browser geolocation is used only for map "find my location" and RF placement, and RF GPS readings are rounded before reverse geocoding with no coordinate history. If you enable friend location sharing, we store only a city and country, not a coordinate history. Push notifications are optional and store a browser push-subscription endpoint. The Instrument Tuner and dBA/dBC Sound Meter request microphone permission only when you start them; captured audio is analysed locally in your browser and is not uploaded or stored by StageRage. The Sound Meter keeps derived LAeq measurement state only in this browser's IndexedDB. If you save a calibration, we store your numeric offset and a one-way hash of the browser microphone-processing signature in your account so the same input path can be restored; we do not store raw microphone IDs, labels, audio, or measurement history. Chat voice messages are recorded in your browser when you hold "talk" and are then uploaded to private storage visible only to members of that channel. Live voice channels relay your microphone audio in real time between members of the channel you belong to while you hold talk; the microphone stays muted otherwise and StageRage does not record, transcribe, or store live-room audio. Optional Bluetooth or USB push-to-talk accessories can be paired through an explicit browser device-permission step you start. The Loader Helper label scanner opens your camera only after you start a scan; QR/barcode labels are decoded in the browser and only the label token is sent to StageRage — scan video is not uploaded or stored. The Video Phone app (a web app at stagerage.online/vm-mobile that runs in your browser or from your home screen) asks your browser for the camera and microphone only after you open its camera screen, and, to find a Video Bridge on your network, for permission to connect to devices on your local network. Its pictures and sound go directly from your phone to the Video Bridge on your own network and are not sent to StageRage servers.

3. How and why we use data

We use data to create and secure accounts; provide the platform and its planning, coordination, and gaming tools; publish and moderate community content; operate collaboration, notifications, subscriptions, customer support, exports, and integrations; prevent fraud, cheating, abuse, and security incidents; and improve the product through consent-based first-party analytics.

Our GDPR legal bases are performance of a contract (account, collaboration, paid features, and requested tools, and the HIBP password-compromise check performed at registration and password change), consent (optional analytics, push notifications, location sharing, microphone and camera features, and optional profile features), legitimate interests (security, fraud prevention, service reliability, licence protection, moderation, fair play in games, keeping the service to adults as our Terms require, defending legal claims, and the periodic email breach-monitoring checks by XposedOrNot and BreachDirectory), and legal obligation where applicable (for example, accounting records). You can withdraw from email breach monitoring at any time via Privacy Settings; this does not affect the HIBP password check, which is performed under the contract basis and cannot be disabled.

We use automated safeguards, including rate limits, malware scanning, image safety checks, text-toxicity screening, and server-side recomputation of game scores from recorded replay events. These tools help flag or block abuse; they do not replace available human review through our reporting and contact channels.

4. Who receives data

We do not sell or share personal data and we do not use it for targeted or behavioural advertising. We never will: if that ever changes we will publish a new version of this policy and tell you in the app before it takes effect. Depending on the feature you use, data is shared with these recipients or processor categories:

• Other users and the public: public profile fields and content you publish; tour and coordinator data with the owner, permitted members, and collaborators of the relevant workspace; game-room players see your display name, and leaderboards are publicly readable; and venue-related data with the relevant venue owner or administrator where the feature requires it.
• Cloudflare: security/CDN services and Cloudflare R2 object storage — a public bucket for user-facing uploads and branding assets, and a separate private bucket for tour/coordinator files and voice messages that is only served to permitted workspace members. Uploaded review media can be publicly reachable when attached to public content.
• Hetzner: EU application hosting and primary server infrastructure.
• PayPal: Stage Operations Pro checkout, subscriptions, receipts, and one-time support payments. PayPal receives the account and transaction details needed to process the payment.
• Resend: transactional email, including verification, password-reset, account notices, and inbound processing of support replies you email us. Any future email engagement tracking is disabled unless you separately consent.
• Sentry: error and limited performance monitoring. We configure Sentry not to automatically send PII and to remove request bodies, cookies, and authorization headers; session replay is disabled.
• XposedOrNot: if breach monitoring is enabled (the default), we periodically send your registered email address to XposedOrNot to check whether it appears in known public data breaches. XposedOrNot receives only your email for that check and returns a list of breach names and exposed data categories. You can disable monitoring in Privacy Settings.
• BreachDirectory (RapidAPI): as a supplementary annual check, your email may be sent to BreachDirectory via the RapidAPI platform to cross-reference additional breach databases. RapidAPI's privacy policy governs its infrastructure handling; StageRage does not intentionally send any other account data. Opt-out in Privacy Settings covers this service as well.
• Have I Been Pwned (HIBP) — Pwned Passwords: when you register or change your password, StageRage uses the k-anonymity API to check whether your password has appeared in known breach datasets. Only the first five characters of the SHA-1 hash of your password are sent; the full password or full hash is never transmitted. You can also trigger this check manually from Security Settings.
• Google: Google OAuth when you select Google sign-in; Google Translate when you choose translation; Perspective API for text moderation; and Gemini when you submit content to an AI-powered assistant (see the AI bullet below). If an administrator expressly connects Google Search Console, we store an encrypted, read-only refresh token and the selected verified property to retrieve aggregated search-performance data for the admin dashboard. This does not grant access to Google account content or alter normal Google sign-in.
• jsDelivr: The LiveKit browser SDK, the face-blur detection library and the text-recognition (OCR) engine and language data that Rider Analyzer and the coordinator rider import use for scanned riders and images load from the jsDelivr CDN when you first use those features, so jsDelivr sees your IP address and which files were requested; the face-detection models themselves are served by StageRage, and the pages, pictures and text you read with OCR are never sent to jsDelivr. The web fonts are served by StageRage itself, so loading them sends nothing to a font service.
• LiveKit (voice relay): when you tap Join on a live voice channel, your encrypted microphone audio is relayed in real time through a LiveKit server and its TURN relay to the other connected members. That server is LiveKit Cloud (LiveKit, hosted in the United States) or a LiveKit server StageRage operates; in the second case the connection set-up messages, which contain the channel name and your connection identifier, pass through Cloudflare, but the audio does not. The LiveKit server also sees your device's IP address, your StageRage display name and a connection identifier built from your account ID for as long as you stay joined. StageRage does not record or store this audio. You are left out of the channel automatically after a period of silence or in the background. Because LiveKit Cloud is in the United States, this is a transfer outside the EU/EEA; it relies on the safeguards in LiveKit’s data processing addendum (the EU-U.S. Data Privacy Framework where it applies, otherwise Standard Contractual Clauses). Talking over a venue’s own crew network uses neither LiveKit nor the internet.
• AI text providers: Google Gemini is our primary assistant model; when it is unavailable, your submitted text may instead be sent to Mistral or OpenRouter. These receive only the prompt needed to produce that single response. We also send them short extracts of public legal and regulator web pages that have changed, together with a description of what StageRage does, so that our administrators can review changes in the law; this contains no personal data.
• Eventric (Master Tour): only when you choose to connect or import Master Tour information.
• Discord: if you choose to connect a future Discord integration, Discord receives the information needed to provide that connection under its own terms and privacy policy.
• Social platforms: when you use social sharing, your browser opens the provider destination selected by StageRage. The provider receives the public URL and any information you choose to add or submit there; StageRage does not post for you.
• Maps, routing, weather and flight providers: OpenStreetMap map tiles are loaded directly by your browser (which exposes your IP to OpenStreetMap); Nominatim, Photon (Komoot), OpenRouteService (HeiGIT), and OSRM receive the place, route, or reverse-geocode query; Xweather and WeatherAPI.com receive the location needed for weather and alerts; and AirLabs, AeroDataBox, and AviationStack receive the flight number or date needed for flight status. We do not intentionally send your StageRage account email or name with those requests.

Some providers may process limited data outside the EU/EEA. Where a restricted transfer applies, we use an adequacy decision or appropriate safeguards required by applicable data-protection law.

5. Location, uploads, audio, and shared data

Location is optional. For the RF planner, GPS is rounded before reverse geocoding and is not saved as a coordinate history; the resulting city/country can be used for the coordination request. Map, search, route, and weather features send the location information required for the request to the provider named above.

Camera and microphone access are optional browser permissions. You can refuse them without losing access to unrelated parts of the service and can revoke a grant at any time in your browser or device settings. A browser permission policy allowing StageRage to request a device does not activate the device or bypass the browser's permission prompt. Chat voice messages you send become personal data visible to every member of that channel, and live-voice audio is audible to everyone connected to the channel while you hold talk — be mindful of what you record or say, and check local rules about recording conversations.

We process uploads to create supported image/PDF formats and scan them for malicious or prohibited content. Review photos have faces detected and blurred in your browser before upload, with a server-side blur applied as a safety net. Do not upload personal data about others unless you have a lawful basis and the necessary permissions. Do not put booking codes, passport data, health data, access codes, or other sensitive data into public reviews, comments, pins, or shared documents.

Tour and coordinator owners are responsible for ensuring they have an appropriate basis to add crew, guests, travel, accommodation, equipment, or other third-party information to a shared workspace.

Public venue, event, news, feature, games, and help pages may be crawled and indexed by search engines and AI services in accordance with our robots policy; when such pages are published or changed, their public URLs may be submitted to IndexNow so search and AI engines can discover them quickly. We do not make account areas, private workspaces, private files, private API responses, or authenticated user data public for crawling.

5A. Video Manager and the local Bridge

When you use Video Manager, the browser communicates with the StageRage Video Bridge desktop app over a local WebSocket connection (ws://127.0.0.1:57490). This connection is local to your machine; control messages (source lists, routing commands, clock start/stop, and network health pings) are exchanged only between your browser and the Bridge process. NDI video, audio streams, and routing data never reach StageRage servers.

The Bridge app uses the Vizrt NDI® SDK on your local machine to discover and route NDI sources. NDI source names and metadata visible in the UI are local network discovery data; they are not stored by StageRage. Network health readings (round-trip time, ping, download speed) taken through the Bridge are used only to display the current result to you and are not sent to StageRage.

The Bridge app runs as a local background process; it does not upload data to StageRage. It stores its settings, a log file, your acceptance of its licence terms, and the access key for phone and camera streams in a folder on your own computer. You can quit it at any time; Video Manager will show a disconnected state until it restarts.

5B. Video Phone (phone camera and viewer)

Video Phone lets a phone act as a camera for, or a viewer of, a Video Bridge that someone is running on the same network. The person running the Bridge decides who may join and can remove a phone at any time. Pictures and sound travel from the phone to that Bridge over your local network and are never sent to StageRage servers; they are not stored by StageRage.

StageRage serves the app's files and a small version file the app checks to see whether an update is available. In your browser the app stores a random device identifier it makes for itself, the session you joined (kept encrypted in the browser's storage, or only in memory in the "In browser" version), and your settings (picture quality, microphone choice, helpers). It does not store pictures or sound, and any clip or photo you take is saved to or shared from your phone only. You can forget a remembered Bridge in the app's Settings, or clear this site's data in your browser's settings, at any time.

Video Phone pages are part of the StageRage site, so as on every page they make the site's normal sign-in and maintenance-status checks, and are covered by the consent notice and error monitoring described in this policy. Your pictures and sound are not part of any of these.

The microphone you choose in the app can be the phone's own, a wired or USB microphone, or a Bluetooth one; Bluetooth microphones use the phone's call sound mode, so the sound is mono and of lower quality.

5C. Timecode Manager, Timecode Rooms and the Timecode Bridge

The Timecode Manager clock runs in your browser. Timecode values, frame rates and clock positions are not sent to StageRage. If you use the StageRage Timecode Bridge, the page talks to it over a local connection on your own computer (ws://127.0.0.1:57510) after you enter a pairing code that is shown only in the Bridge window. The page can start, stop, reset and move the Bridge clock; it cannot choose network addresses, ports or devices.

The Bridge is a desktop app that runs on your computer. Art-Net, MIDI Time Code, LTC audio and the offline LAN Room stay on your local network and your own devices and are never sent to StageRage. It stores its settings and a log file in a folder on your computer, and keeps the access codes of a running LAN Room in memory only. To look for an update, the Bridge asks StageRage's download server for a small version file, which, like any download, shows your network address and the app version and operating system.

Rooms across the Internet (when StageRage has switched them on) are private to the account that creates them. While a Room is open, StageRage processes your account identifier, the Room identifier, a digest of each invitation code, session tokens and the connection set-up messages between devices, and keeps them for the life of the Room (a Room lasts for as long as a clock source stays connected and for 30 minutes after the last one leaves, never more than seven days; an invitation lasts up to one hour). The clock itself is exchanged directly between the devices using WebRTC; when a direct path is not possible it passes, encrypted, through a relay server that uses short-lived credentials. An invitation can be shown as a QR code: the code sits in the part of the link after the # sign, which browsers never send to any server, and Timecode Mobile removes it from the address bar as soon as it is read. Invitation codes are never kept in browser storage or analytics.

Timecode Mobile (the phone and tablet app at /tc-mobile) is part of the StageRage site: it saves its own app files in your browser so it can open quickly and works with the site's normal sign-in, consent and error monitoring described in this policy. It does not store timecode values. If you opt in to product analytics, StageRage records only aggregate counts of actions such as starting the clock, never timecode values, device names, network addresses or invitation codes.

5D. Rider Analyzer and contact details found in riders

Rider Analyzer reads a rider you choose in your own browser. The file, the text read from it, and the result are not sent to StageRage; scanned pages and images are read by OCR on your device (the OCR engine and its language data are downloaded from jsDelivr, see section 4, but your pages are not uploaded). From a rider it recognises equipment requirements, notes, warnings and tips (shown as sentences, each labelled as a warning, note or tip by automated rules), and contact details: names, roles, telephone numbers, e-mail addresses and websites of the artist's team, crew, agency or management.

Contact details in a rider are personal data about other people. Rider Analyzer shows them only to you, includes them in a PDF or CSV you choose to create, and, so that your analysis is still there after a refresh, keeps them with the rest of the analysis in this browser's local storage until you press Clear or clear the browser's site data. We do not send them to analytics, error reports, or the optional rider-interpretation feedback, and they are kept out of the notes and equipment items that other people can read.

If a coordinator manager imports a rider into a coordinator, the recognised contacts are stored with that artist's slot for the coordinator's managers only. Other members, whatever their role, never receive them: they are left out of the shared schedule, the show-clock preview and every export. A manager can remove a contact at any time; the audit log records only that a contact was removed, not who it was. Contacts are deleted with the artist slot, the coordinator, or the account as described in section 7, and are not copied anywhere else by StageRage apart from the ordinary backups described in section 7.

One exception, and only when you ask for it: if you belong to a company workspace you can choose equipment lines from a rider and send them to match against your company's gear. Only the lines you tick (a name, quantity, unit, short specification and category for each) are sent. The file, its other text, the page or source references, the file name and every contact detail stay in your browser. The lines are stored against the tour, are visible to the company owner and team members only, are not sent to analytics or error reports, and are deleted after 12 months, when you delete them, or with the tour, the company or the account. Matches the owner confirms are stored with them.

You are responsible for using these details only to advance the show they came from, for not adding riders you are not entitled to use, and for not reusing contact details for marketing or other unrelated purposes. Recognition is automatic and can be wrong, especially for scanned documents; always confirm names, numbers and addresses before relying on them. If your own contact details appear in a rider and you want them removed from a coordinator, contact us at the address in section 9 and we will help you reach the workspace owner or remove them.

5F. Company vehicle arrival

A company can fit telematics units to the vehicles it owns so that StageRage notes when a vehicle arrives at, or leaves, a venue the company has saved. This is for company-owned vehicles only. Arrival is recorded from tracking units fitted to the vehicle; a driver’s phone is a separate option, described in 5G below.

• What is stored: the vehicle, the saved venue’s name, whether it arrived or left, and the time. If the company also turns on the vehicle map, the vehicle’s last known position is kept as well: one position per vehicle, rounded to about 10 metres, replaced about every 15 minutes and deleted after 24 hours. It is never a route or a history. Otherwise the position is compared with the saved venues when it reaches us and is then discarded. No coordinates are written to logs, no route or position history is stored, and no driver is recorded with a position.
• Controller and purpose: the company is the controller. The purpose is the company’s vehicle log and tour close-out. The company owner must have a written driver-data policy and must not use this to monitor an individual.
• Who sees it: the arrival log is visible to the company owner, members and employees who can see the vehicle. The last known position on the map is visible to the company owner and members only. Nobody outside the company.
• Retention: arrival records are deleted after 12 months; the copy in a signed tour close-out report stays with that report.

5G. Driver phones and vehicle position

If your company offers it and you agree, you can share the position of a company vehicle from your phone while you drive it. This is separate from company load location and from tracking units fitted to vehicles, and it works only in a session that you start yourself.

• What we collect: while a session runs and the page is open, your phone sends its position about once a minute, with its accuracy and the time. The accuracy is used only to discard rough readings and is not stored. We keep only the last known position of the vehicle, rounded to about 10 metres. When the session stops, that position is deleted. No route and no history is kept.
• Session record: we keep a record of the vehicle, you as the driver, the start and end time and why the session ended. It holds no position, and it is kept for 12 months.
• Why: to show the last known position of company vehicles to the company owner and members, and to keep custody records. It is not used for performance monitoring, pay, ratings or automated decisions.
• Controller and basis: your company is the controller for its drivers; StageRage acts as its processor. The company must have a lawful basis, tell you what is shared, and consult employee representatives where the law requires it. You can withdraw your consent at any time.
• Who sees it: the company owner and members see the vehicle’s position. Nobody sees your name on the map, and employees do not see positions.
• Map tiles: the map loads tiles from OpenStreetMap, which receives the tile address of the area being viewed and the viewer’s IP address. At street level that approximates where a vehicle is.
• Your choice: saying no has no effect on your job. Withdraw in Privacy settings, under “Driver vehicle location”: a running session ends at once and its position is deleted.

6. Cookies, local storage, and offline cache

We use essential browser storage to operate and secure the app. This includes a secure HttpOnly server-session cookie (up to seven days while your account session remains valid), short-lived OAuth and administrator Search Console proof cookies when you explicitly use those flows, a 15-minute age-check cookie (stagerage_age_ok, a signature with no date of birth) when you continue to sign up with Google or Discord, a sidebar display-preference cookie, a signed Pro-tool license token with its random install identifier kept in this browser's IndexedDB, and locally stored consent, language, date/time, measurement, and safety-recovery preferences. Authentication and security storage are required to keep a requested account session and security controls working and cannot be disabled while using them.

If you agree when you start a free trial, we set a security cookie (sr_trial_device, HttpOnly, up to 400 days) holding a random identifier that only prevents one browser from taking a second free trial. It is optional: the trial works without it, and it is set only after you tick the box on the trial.

If you consent to product analytics, we store stagerage_analytics_id, stagerage_analytics_consent, stagerage_cookie_consent, and a consent-version marker in browser storage. The identifier is converted to a different server-side pseudonym each UTC day. Event and venue audience analytics use that same rotating pseudonym plus opaque server HMACs, as does news audience analytics; creators and verified venue owners can see aggregate counts only, never a visitor list. Refusing or withdrawing consent removes the analytics identifier and stops future analytics events. A previously stored choice is not treated as consent when we add a new analytics purpose; we ask again. StageRage has no advertising, marketing-cookie, or third-party analytics category. You can change this choice at any time through the Cookie Settings control in the footer or in Privacy Settings.

Our service worker caches application files and limited public venue data for offline use. It does not cache authenticated API responses. After an authorised user opens a Tour Plan or Coordinator while online, StageRage may automatically keep an encrypted, account-scoped, read-only browser replica of the operational data and private files that user is permitted to access, subject to device storage limits. This replica contains no password, session cookie, API key, request header, or queued action; it is used only after a genuine network failure and is cleared on logout or when a different account is verified in that browser. Offline loader scans queue only label tokens on the device until they can be verified. On a shared device, always log out and clear StageRage site data/browser storage when you finish. Google Translate may set googtrans only after you choose a non-English translation.

Global Privacy Control and Do Not Track. StageRage does not sell or share personal data and does not use it for targeted advertising, so there is no such use for a browser signal to opt you out of, and we do not act on Global Privacy Control or Do Not Track signals. Optional analytics stays off until you turn it on, whatever your browser sends.

7. Retention and account deletion

• Account and private workspace data are retained while the account remains active or as needed to provide the service.
• When you delete an account, we delete the account and connected sessions, notifications, friendships, owned tours, map pins, and certain account records; public reviews and messages are de-identified where they need to remain as community or tour history. Review media attached to your account is cleared and R2 deletion is attempted. Game data follows its own schedule: a finished multiplayer game (its players, moves, and result) is deleted 90 days after it ends, and a room that was cancelled or abandoned is deleted 7 days after it was last used. For each rated multiplayer game we keep a short result record (the game, the players' account identifiers, the outcome, and the date) so wins stay on the leaderboard after the room is gone; it is kept until you delete your account. When you delete your account, within 10 minutes we remove your account identifier and display name from game rooms, move histories, result records, scores, and leaderboards; a game you played keeps its outcome for the other player, with your seat shown as "Deleted user".
• Forum posts. When you delete your account, the forum threads and replies you wrote stay visible as community discussion. Your name is replaced with "Deleted user", and the text of your posts stays so the discussion still makes sense. Files attached to a forum post are hidden as soon as the post is removed, and they are permanently deleted 30 days later. A moderator can restore a removed thread, with its files, within those 30 days.
• Contact details recognised in a rider stay in the browser analysis of Rider Analyzer until you press Clear or clear the browser's site data, and in a coordinator they stay with the artist slot until a manager removes them or the artist slot, coordinator or account is deleted; they are not kept anywhere else apart from ordinary backups.
• Company workspace records are kept while the company exists. Equipment lines taken from a rider are deleted after 12 months. A signed condition check, a signed close-out report and a recorded carnet export are kept as part of the company's record; the history of an asset is never edited, and when an account is deleted the person's name in it is replaced by a neutral label.
• Company API access: the API only reads and writes the company's own records and never returns information about people (no names, rosters, riders, signatures, notes or who did what). The history it returns shows only whether a change was made by a member, the system or an API key. A count recorded through a key is attributed to the key. Each request a key makes is logged for 30 days and then deleted. When the account of the person who created the keys is deleted, the keys are revoked and their secrets removed.
• Chat voice messages are kept with their channel history until deleted in the app or removed with the workspace; live-voice audio is never stored at all (only a transient 12-second talk-floor lock exists in server memory).
• Flight records are configured to expire after arrival and hotel records 14 days after checkout. Consent-based analytics events expire after 90 days; event, venue, news, and general daily pseudonymous analytics counts expire after 24 months. Event, venue, and news lifetime totals contain no visitor identifier and are removed when their event, venue, or article is deleted.
• Payment, tax, security, audit, error, dispute, and backup records may be retained for longer where reasonably necessary for security, legal obligations, accounting, or the establishment, exercise, or defence of legal claims. Database backups are not edited individually; they are deleted when their rotation ends: copies on our server are kept for 10 days, copies in the off-site encrypted bucket for 3 days, and the optional mirror keeps its 20 most recent copies. An erased account can therefore remain in a backup until then, and is not restored from one except to recover the service. Copies of uploaded files are kept as a mirror of the live files: a file stays in the backup for as long as the item or workspace it was uploaded to exists. After you delete it, the next backup removes it from the mirror and moves it to a history folder that is kept for 3 days off-site and 10 days on our server.
• Age confirmation: we keep only that you confirmed you are 18 or older and when, for as long as the account exists. An existing account that has not confirmed by the closing date shown in the app is deleted as described above.
• Free-trial eligibility, student-verification status, and team-membership records are retained only as needed to provide the relevant feature, prevent repeat abuse, resolve disputes, or meet accounting and legal obligations. Trial records are deleted 90 days after the trial starts. Trial-abuse safeguards use technical security signals and do not use them for advertising or analytics.

You can delete or withdraw private drafts, tool records, and uploads where the relevant feature provides a delete control. For any data you cannot remove yourself, contact us using the address below.

8. Your rights, wherever you live

These rights apply to everyone who uses StageRage, whichever country you are in. You can ask us to give you access to your personal data and a copy in a portable format; correct it; erase it; restrict or object to how we use it; and you can withdraw consent at any time for analytics, location sharing, notifications and optional profile features (this does not affect processing already carried out).

• Access and copy: use Download my data in Privacy Settings. It gives you a file with your profile and the content you created. It leaves out passwords, security codes, files, other people's data and records that belong to a company. You can download once every 24 hours after signing in again, and we do not keep a copy of the file.
• Erasure: delete your account in your profile security settings (see section 7).
• Consent choices: Privacy Settings and the cookie banner.
• Anything else, or if a button does not do what you need: email admin@stagerage.online.

We answer a request within 30 days. If a request is complex we tell you why we need longer, within the same period, where the law allows. We may ask you to confirm it is you, and we do not treat you differently for using a right. You may use an authorised agent; we will ask for proof that you gave them permission.

If we say no: we explain why. You can ask us to reconsider by replying to our answer, and you can complain to your data-protection authority whether or not you did.

No sale, sharing or targeted advertising. We do not sell or share personal data and do not use it for targeted advertising (section 4), so there is nothing for you to opt out of.

Where you can complain. In Slovenia the authority is the Information Commissioner (Informacijski pooblaščenec): ip-rs.si. You may also contact the authority where you live or work, for example your national data-protection authority in the EU or EEA (list of members), the Information Commissioner's Office in the United Kingdom (ico.org.uk), the California Privacy Protection Agency (cppa.ca.gov) or your state attorney general in the United States, the Office of the Privacy Commissioner of Canada (priv.gc.ca), the Office of the Australian Information Commissioner (oaic.gov.au), the Office of the Privacy Commissioner in New Zealand (privacy.org.nz), the Autoridade Nacional de Proteção de Dados in Brazil (gov.br/anpd), the Personal Information Protection Commission in Japan (ppc.go.jp) or the Information Regulator in South Africa (inforegulator.org.za).

8A. Additional information for residents of US states and similar laws

Some laws, such as those of California and other US states, ask for specific statements. In the last twelve months we collected the categories of personal data in section 2 (identifiers and account data, content you submit, location you choose to share, technical and security data, and, only with your consent, analytics), for the purposes in section 3, and disclosed them only to the recipients in section 4 for the features you use. We do not sell or share personal data, we do not use it for targeted advertising, and we do not knowingly collect data about people under 18 (section 2, age confirmation). We keep data for the periods in section 7. You can ask to know, access, correct, delete or take a copy of your data, and to appeal our decision, as described in section 8, and we will not discriminate against you for doing so. We do not use or disclose sensitive personal data to infer characteristics about you.

9. Changes and contact

We may update this policy when the product or applicable law changes. The date above shows the latest version. When we make a material change we also tell signed-in users with a notice in the app. For privacy questions, requests, or concerns, contact Sebastjan Zavrl s.p., MGLightning, Podreča 126, 4211 Mavčiče, Slovenia, at admin@stagerage.online.