TOURSTACK
Home

TourStack

Privacy Policy

Last updated: June 30, 2026

This Privacy Policy describes how TourStack("we", "us", or "our") collects, uses, and shares information when you use our website at https://tour-stack.com (the "Service").

1. Data controller

TourStack is operated by an individual developer. For GDPR purposes, the data controller is Mor Tzhory, based in Israel, and reachable at mortz12345@gmail.com. See our Imprint for operator details.

2. Information we collect

Information you provide

  • Account information: If you sign in with Google, we receive your email address, display name, and profile picture from Google. This information is stored in our authentication provider (Supabase) and in your user profile.
  • Saved content: Artists you favourite and lineup watches you save. When signed in, this data is stored in your account. When signed out, it is stored locally in your browser only.
  • Google Calendar (optional): If you connect Google Calendar from the Tour calendar (or sign in with Calendar access), we request read-only access to your calendar events so we can show them beside concert dates. We store a Google refresh token on our servers so Calendar stays connected without asking again each hour; we do not store your calendar event contents. You can disconnect at any time in the Tour calendar or revoke access in your Google Account permissions.

Information collected automatically

  • Hosting data: Our hosting provider (Vercel) may process basic technical information such as IP address, browser type, and request logs for security and delivery of the Service.
  • Analytics (with consent): If you accept analytics cookies, we use Vercel Analytics to collect aggregated page-view and performance metrics. You can reject or withdraw this at any time via the cookie banner or Cookie settings in the footer.
  • Local storage: When you are not signed in, favourites, watches, onboarding state, and cookie preferences may be stored in your browser. See our Cookie Policy for details.
  • Cookies: We use cookies to maintain your sign-in session when you use Google authentication and to remember your cookie choices.

Information from third parties

  • Concert data: We fetch public tour and event information from the Ticketmaster Discovery API to power search results. We do not receive personal information about you from Ticketmaster.

3. Legal bases for processing (GDPR)

Where GDPR applies, we rely on the following legal bases:

  • Contract: Processing needed to provide the Service you request (for example, account sign-in, syncing favourites, and sending watch alerts you set up).
  • Consent: Analytics via Vercel Analytics, which loads only after you opt in through our cookie banner.
  • Legitimate interests: Operating, securing, and improving the Service, preventing abuse, and responding to support requests, where those interests are not overridden by your rights.
  • Legal obligation: Where we must retain or disclose information to comply with applicable law.

4. How we use your information

We use the information we collect to:

  • Provide, operate, and improve the Service
  • Authenticate you and sync your favourites and watches across devices
  • Send email notifications about new tour overlaps when you save a lineup watch and are signed in
  • Measure usage when you have consented to analytics
  • Respond to support requests and protect against abuse or fraud
  • Comply with legal obligations

5. How we share your information

We do not sell your personal information. We share information only with service providers that help us operate the Service:

  • Supabase — authentication, account storage, and database hosting
  • Google— sign-in (OAuth). Google's use of your data is governed by Google's Privacy Policy
  • Resend — delivery of watch notification emails to the address associated with your account
  • Vercel — website hosting, infrastructure, and (if consented) privacy-focused analytics
  • Ticketmaster — public concert and event data (we send artist identifiers and date ranges, not your personal information)

We may also disclose information if required by law or to protect the rights, safety, and security of our users or the public.

6. Cookies and similar technologies

We use cookies, local storage, and session storage as described in our Cookie Policy. Non-essential analytics are disabled until you consent.

7. Data retention

We retain account data for as long as your account is active. You can delete your account at any time from the Account page while signed in. Deletion removes your profile, favourites, lineup watch, and notification history from our systems.

If you cannot use the in-app deletion flow, contact us at mortz12345@gmail.com and we will delete or anonymize your personal data within a reasonable period, except where we must retain it for legal or security purposes.

Data stored only in your browser (when signed out) remains on your device until you clear site data or sign out, which clears local favourites and watches.

8. Your choices and rights

  • Cookie choices: Accept, reject, or change analytics preferences via the cookie banner or Cookie settings in the footer.
  • Sign out: You can sign out at any time. Local browser data for favourites and watches is cleared on sign-out.
  • Stop watching: You can remove a lineup watch in the app to stop overlap checks and email alerts for that watch.
  • Delete account: Signed-in users can permanently delete their account and associated data from the Account page.
  • Access and correction: You may request access to or correction of your personal data by contacting us at mortz12345@gmail.com.
  • Google account:You can revoke TourStack's access to your Google account at Google Account permissions.

Depending on where you live, you may have additional rights under applicable privacy laws (such as GDPR or CCPA), including the right to object to certain processing, restrict processing, or data portability. Contact us to exercise those rights.

If you are in the European Economic Area or UK, you also have the right to lodge a complaint with your local data protection authority.

9. Children's privacy

The Service is not directed to children under 13 (or the minimum age required in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us personal information, please contact us and we will delete it.

10. Security

We use reasonable technical and organizational measures to protect your information, including encrypted connections (HTTPS) and access controls on our database. No method of transmission or storage is completely secure.

11. International transfers

Mor Tzhory is based in Israel. The European Commission has recognized Israel as providing an adequate level of data protection for transfers from the European Economic Area and UK.

Your information may also be processed in other countries where our service providers operate, including the United States. When personal data is transferred outside your country, we rely on appropriate safeguards such as:

  • Supabase — Data Processing Agreement with Standard Contractual Clauses (SCCs) for database and authentication hosting
  • Vercel — Data Processing Addendum incorporated into their terms, including SCCs for hosting and (if consented) analytics
  • Resend — Data Processing Agreement with SCCs for email delivery
  • Google— Google API Services User Data Policy and, where applicable, Google's Cloud Data Processing Addendum for sign-in (OAuth)

You can request more information about these safeguards by contacting us at mortz12345@gmail.com.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised policy on this page and update the "Last updated" date. Continued use of the Service after changes constitutes acceptance of the updated policy.

13. Contact us

If you have questions about this Privacy Policy or our data practices, contact us at mortz12345@gmail.com.