Privacy Policy

This Privacy Policy describes what Weflyn collects, how we use it, and the choices you have. Weflyn is a website for local music, built first for the Utah launch scene, and may expand to other areas later. You do not need an account to read this policy.

People can post Clips. A Clip is a posted video that may run from a brief moment to a full song, or a still photo.

This is a working draft for counsel review — not finished legal advice. The Utah Consumer Privacy Act (UCPA) and similar laws may not apply to early Weflyn depending on revenue and volume thresholds. We still explain our practices plainly and will update this notice if coverage or practices change.

This policy applies to the Weflyn website, apps, and related services we operate. It does not apply to third-party sites, venues, ticket sellers, or hosts you reach through links or listings.

Account and identity. Email; password (handled by our authentication provider); Username, meaning how a person appears; @, meaning the unique public name used in links; date of birth (for age eligibility — date of birth is never shown publicly); Terms acceptance timestamp and version; optional profile photo and About text.

Scene and content. Area or city you choose; Artist pages, meaning public musician pages, and band pages you manage; venue pages if that part of the service is offered; Clips (posted videos that may run from a brief moment to a full song, or still photos), plus tracks, photos, comments, flyers, and other media; follows; I'm going, meaning a mark that you plan to attend a night (I'm going stays off your public page until you turn it on in Account settings); friendships; band memberships; DIY nights and other show details; likes; and preferences you set in Account settings, including an optional private-account setting.

Communications. Direct messages, meaning private text after both people are friends (text only); band chat, meaning private text among confirmed lineup members; band notes called Board and open needs called Asks; Feedback, meaning product notes to staff; and safety reports you send. These may include text and metadata (timestamps, participants, thread IDs).

Safety and abuse signals. Reports you file or receive; blocks; moderation actions; and related account context staff need to review harm.

Technical and security. Logs needed to operate and secure the service — for example sign-in events, device or browser basics, IP-related security signals, error reports, and rate-limit/abuse indicators. We are not building a surveillance product or selling ad profiles from your private messages.

We use information to: create and secure accounts; display profiles and discovery; deliver messages and notifications you expect; list and show nights; enforce age, Terms, and safety rules; review Feedback and safety reports; prevent abuse and fraud; improve reliability; and comply with law.

We do not sell your personal information for money. We do not use your private messages or Clips to sell targeted advertising in the current product.

Where privacy laws require a legal basis, we rely on: performance of our agreement with you (providing the service); legitimate interests (security, abuse prevention, improving the product) balanced against your rights; compliance with legal obligations; and consent where required (for example optional features or certain marketing if we add it later).

Public by design. Published profiles, band and Artist pages, Clips, comments on public media, and published nights are visible to others and may be copied, indexed by search engines, or shared off-site by people who see them.

People you connect with. Friends, direct messages, band chat, and co-manager tools share what those features require with the intended recipients.

Service providers. We use infrastructure providers for hosting, database, authentication, storage, email, and similar operations. They process data for us under contract — not to build their own marketing profiles from your scene activity.

Staff moderation. Authorized staff may access Feedback, safety reports, and related context to investigate harm and enforce rules.

Legal and safety. We may disclose information if required by law, valid legal process, or when we believe disclosure is necessary to protect someone from serious harm, investigate abuse, or respond to emergencies.

Business transfers. If Weflyn is involved in a merger, acquisition, or asset sale, information may transfer subject to this policy or successor notice.

If you publish a profile, clip, or night, you should assume it is public. Privacy toggles hide parts of your profile but do not make the entire service private. I'm going stays off your profile until you turn it on in Account settings. Search engines and other users may retain copies outside our control.

Messages are stored so threads work across devices and so we can review abuse reports. Direct messages are friends-only and text only. Band chat may use server-side encryption with per-recipient storage; that protects data at rest on our systems but is not end-to-end encryption. Band notes (Board) and open needs (Asks) are stored so members can read them later. Operators and staff may access messages when permitted by law or needed for safety review.

Do not send highly sensitive secrets through Weflyn. For emergencies, contact local emergency services.

We use cookies and similar storage for sign-in sessions, preferences, and basic site function. We are not running a large third-party advertising network on the website today. If that changes, we will update this notice and request consent where required.

Vercel Web Analytics counts page views on our host without advertising cookies. It is for operating the site, not for selling a marketing profile of you.

We may use automated tools to filter text, scan images when that service is configured, detect abuse signals, or prioritize reports. Automated decisions may affect whether content is blocked or flagged for staff. You can report mistakes through Feedback or safety tools where available.

We keep account and content data while your account is active and as needed to operate the service. After deletion requests, we aim to remove or de-identify personal data within a reasonable time, except where we must retain records for security, abuse prevention, legal claims, backups, or law (including preserving evidence of serious illegal content). Backups may lag briefly.

We use reasonable administrative, technical, and organizational measures appropriate to a launch-stage product — access controls, encrypted transport to providers, role limits for staff, and similar safeguards. No online service is perfectly secure.

If we become aware of a data breach that affects your personal information and requires notice under applicable law, we will notify you and regulators as required. Tell us through Feedback if you suspect unauthorized access to your account.

Privacy toggles in Account settings control parts of your profile. About, area, bands you are in, and following default to shown until you turn them off. I'm going stays off your profile until you turn it on. You can also choose a private account (an advanced setting). You can block people, leave bands, and delete content you manage where the product allows.

You may request access to, correction of, or deletion of personal information we hold about you by contacting us via Feedback marked “Privacy.” We may need to verify your identity. We may decline or limit requests where the law allows (for example fraud prevention, another person’s privacy, or legal retention duties).

If UCPA, CCPA/CPRA, or other privacy laws apply to us, we will honor the rights those statutes require for covered residents.

Residents of California and other states with privacy laws may have additional rights — such as knowing categories collected, accessing specific pieces, deleting, correcting, or opting out of certain processing. Weflyn does not sell personal information for money as defined by the CCPA/CPRA today.

To exercise rights, contact us via Feedback marked “Privacy.” We will not discriminate against you for exercising rights where prohibited. Authorized agents may submit requests with proof of authority where required by law.

Weflyn is operated from the United States. If you use the service from outside the U.S., you understand that information may be processed in the U.S. and other countries where our providers operate, which may have different privacy laws than your home country.

Weflyn accounts require you to be at least 13. We do not knowingly collect personal information from children under 13 (COPPA). If we learn we have data from a child under 13, we will delete it as required.

Going and hosting features require 16+. Band lineup membership requires 13+. Date of birth is never shown publicly. Teens 13–17 should use extra caution online and offline and involve a parent or trusted adult in offline plans.

We may update this Privacy Policy. Material changes may require a new Terms/Privacy acceptance in the product. Prior versions remain in the version archive for reference.

Privacy questions and requests: use in-app Feedback marked “Privacy.” Counsel should add a stable privacy contact email and operator entity name before treating this as final.