Privacy Policy

When you create a Tourbook account and use the service, we collect:

• Account info: email address and a hashed password (handled by our authentication provider, Supabase). We never see your password in plain text.
• Tour data: shows, dates, venues, guarantees, expenses, merch sales, personnel records, payouts, account balances, notes — everything you choose to log.
• Uploaded documents: files you upload (W9s, contracts, EPK, etc.), stored in encrypted object storage.
• Payment info: when you subscribe, we use Stripe to handle payment. We never store card numbers — Stripe handles that directly. We receive a customer ID and subscription status from Stripe.
• Email content: if you use the email-to-promoter feature, the messages you send (and any attachments) pass through our email provider, Resend.
• Standard server logs: IP address, browser type, pages visited, and error reports — used for debugging and security.

• To provide the core Tourbook service (storing your data, computing your P&L, sending emails on your behalf).
• To process subscription payments and manage billing.
• To communicate with you about your account (confirmations, payment receipts, trial notices, important service updates).
• To detect, prevent, and respond to fraud, abuse, or technical issues.

We do not sell your data. We do not use your tour data for marketing or share it with advertisers.

We share data only with the service providers that make Tourbook work:

• Supabase — authentication, database, and file storage.
• Vercel — application hosting.
• Stripe — payment processing.
• Resend — outbound email (auth confirmations, promoter messages).

Each of these providers has their own privacy practices and is contractually obligated to protect your data. We do not share data with any other third parties unless required by law.

If you invite collaborators to a tour (band members, tour manager), they will have access to the data on that tour according to their assigned role (owner, editor, or viewer). You control who gets invited and at what permission level. Owners can remove collaborators at any time from the tour Settings page.

We keep your data while your account is active. Archived tours are kept for 30 days before permanent deletion. If you cancel your subscription, your data is preserved and read-only — you can reactivate anytime and pick up where you left off. If you delete your account, we permanently remove your tours, documents, and account data within 30 days, except where retention is required by law (e.g., financial records for tax purposes).

You can:

• Access and export your data — every tour has a CSV export.
• Update any account info or tour data from inside the app.
• Delete tours, documents, or your entire account at any time.
• Request a copy of all data we hold about you by emailing us.

If you're in California, the EU, the UK, or another jurisdiction with specific privacy rights (CCPA, GDPR, etc.), those rights apply in full. Contact us to exercise them.

We protect your data with industry-standard practices: TLS for data in transit, encryption at rest, row-level security on all multi-user data, and isolated storage for sensitive documents. No system is 100% secure, but we take this seriously and respond quickly to any vulnerability disclosure.

Tourbook is not directed to anyone under 13. We do not knowingly collect data from children under 13.

We'll update this policy when our practices change. The “Last updated” date at the top reflects the most recent change. For material changes, we'll notify you by email.

Questions, requests, or concerns? Email support@tourbook.band.