Privacy

Show Match is operated by PRMetrics, LLC, a Delaware limited liability company. This page says what the app stores today. TODO for Harry: the company address and the contact email for privacy requests. Do not invent them.

An account

Signing in with Google stores the email, name, and subject Google sends us, and a row that ties that identity to your account. The session cookie holds a random token. We store a hash of that token, not the token itself.

Sign-in by email code is switched off unless it is explicitly enabled. When it is on, we store the email, a hash of the code and of the magic link, the page you were trying to open, how many attempts were made, and the IP address of the request. Codes expire and are single use.

Facebook, Apple, and Outlook sign-in are not switched on. If they are enabled later, they would store the same kind of identity (email, name, provider subject) we store for Google. We do not store them now.

Calendar

Google Calendar access is free/busy only. We store an encrypted refresh token and the busy intervals Google returns. A busy block is labelled "Google Calendar". We do not receive event titles. You can also type your own busy note. That note is stored as you wrote it.

Apple and Outlook calendars are not connected. We do not store those tokens.

What you do in the app

A swipe is a yes, a pass, or a “really want”. It is stored with your account email, or with the anonymous device until you sign in on that device. A yes can also say you are bringing one or two other people. We do not store star ratings. Thumbs after a show are down, up, or double-up. Bookings record that you already have a ticket for a showing. Group membership, the group name, and the invite token are stored so a private link can be redeemed. Notes you type on a busy block are stored.

When you create a group we store an email address so we can tell you the group has matched on a couple of shows, or that a poll closed, or that it is time to rate the show you picked. That address is not shown on the invite page, in link previews, or to other members. Sending those notes stays off until email is switched on. Until then they are only queued.

Joining a group without an account asks for a display name. That name is what the others in the group see next to your vote. It is not an email address.

People you have shared a group with are your friends. There is no follower list and no way to message them. “Show my likes to friends” is on unless you turn it off in your profile. While it is on, those friends can see the shows you recently said yes to, and how you rated upcoming shows you went to together. Turning it off removes you from that list.

A show page can say how many people said yes in the last 30 days, once at least three remain. Those faces are blurred and the page does not publish their names. “Hide me from who’s going” takes you out of that count entirely. A friend who left their likes visible can appear there with their name, and only to you.

Push subscriptions are not switched on. We do not store push endpoints.

A Monday email of upcoming shows stays off unless email sending is configured and the digest flag is on. Even then it stays off for an account until that person opts in on their profile. Opting in stores the choice and the time. Each send is logged with the account, the address it went to, the week, and which shows were included. The unsubscribe link in the email clears the choice. While the flag is off, nothing is sent and the choice is not collected.

City

On the public site, Cloudflare may tell the worker the city, country, and approximate coordinates of the request. We use that only to choose a city hub for the redirect. We do not write that lookup down. If you open a city hub, the page sets a cookie (sm_city) and saves the same slug in local storage so the next visit can start there.

Asking for a city we don't have yet adds one to a counter for that city name. A cookie (sm_asked) stops the same browser counting twice. We do not store your email or IP with that request.

Avatar

The browser may request a Gravatar image from gravatar.com using a hash of your email. We store that hash so the page can build the image URL. The picture itself stays at Gravatar.

Analytics

Show Match records first-party usage analytics (which buttons are used, and on which page) so the operator, PRMetrics, LLC, can see what is working. That stays in our own database. There is no analytics SDK and no third-party tracker. The host is Cloudflare, which processes the request as part of serving the site.

Who else handles data

Cloudflare hosts the app and the database. Google handles sign-in and, if you connect it, calendar free/busy. If email sign-in or the Monday digest is turned on, those messages go through Cloudflare Email. Resend is not used to turn either one on. TODO for Harry: the region those processors store data in, and any transfer terms you want named.

How long, and your rights

Account data stays until you ask for it to be deleted or the account is removed. Sessions last up to 30 days. Email login codes are short-lived. You can disconnect Google Calendar from your profile, which drops the stored refresh token.

If you are in the EU, including Bulgaria, you can ask for access, correction, deletion, or a copy of the account data we hold, and you can object to a use described above. TODO for Harry: the email those requests should use. You can also complain to the Bulgarian Commission for Personal Data Protection, cpdp.bg.