Privacy Policy
Last updated: 7 October 2026
Undercurrent (undercurrent.band) is a music site for artists, venues, service providers and fans. Artists, venues and service providers make pages. Fans follow them. People post updates, gigs and classifieds, comment, and send each other messages.
This page says what we collect, why, who helps us run the site, and how to get your data deleted. Questions: info@undercurrent.band.
What we collect
Your account. We use Clerk to handle sign-in. You sign in with your email address or with Google. When you sign up we get your email address and, if you give one, your name. If you sign in with Google, we get the name, email address and profile photo that Google shares with us. We do not get your Google password, and we do not post to Google.
What you put on the site. The pages you make and what is on them: names, bios, photos, links, music embeds, venue addresses, gigs, posts, classifieds, applications, comments, follows and direct messages. Most of this is public, because a public page is the point. Direct messages are visible only to the people in the conversation.
Your settings. Your public name, your email preferences and your cookie choice.
If you ask us to tell you when we reach your city, we keep the email address and city you give us.
Technical data. When you use the site, our hosting and security services see your IP address, browser and device type, and the pages you ask for. We use this to run the site, stop abuse and fix errors.
We do not take payments at present, so we hold no card or bank details.
How we use it
- To run the site: sign you in, show your pages and posts, deliver your messages.
- To send you email: a welcome email, your data export if you ask for one, and notifications (new messages, comments, applications, gig reminders, classified alerts and expiry notices). Every notification email has an unsubscribe link, and you can turn them off in your email preferences.
- To keep the site safe: rate limits, spam and abuse checks, moderation of reported content.
- To find and fix bugs, and to see which parts of the site people use.
We do not sell your data. We do not use it for advertising.
Cookies and analytics
- Sign-in cookies from Clerk keep you signed in. The site cannot work without them.
- Vercel Web Analytics counts page views. It does not use cookies.
- PostHog records page views and how the signed-in parts of the site are used. It runs only if you accept analytics cookies in the cookie banner. Then it stores an ID in a cookie and in your browser's local storage. If you reject, PostHog does not load. You can change your choice at any time with the "Cookie settings" link in the footer. When you withdraw consent, we stop PostHog and delete its cookies and local storage. Our servers also send some events to PostHog, for example when you post or fill a notice. We send these only if you accepted analytics cookies while signed in. If you rejected, or did not choose, our servers send no events about you.
- Sentry collects error reports when something breaks: the error, the page, your browser and your IP address. We do not record your screen.
- Your browser's local storage keeps your cookie choice and your recent searches. These stay on your device.
- Embedded players. Artist pages can show players from Bandcamp, Spotify, SoundCloud and YouTube. These load from those services, which can set their own cookies.
- Venue maps load map images from OpenStreetMap, which sees your IP address.
There are no advertising cookies and no cross-site tracking. More detail is in our Cookie Policy.
Who helps us run the site
These companies process data for us, only to provide their service:
- Clerk — sign-in and accounts (with Cloudflare Turnstile for bot checks)
- Vercel — hosting and page-view analytics
- Neon — our database
- Cloudflare R2 — storage for photos and other uploads
- Inngest — background jobs, such as sending email and deleting accounts
- Resend — sending email
- Upstash — rate limits
- Sentry — error reports
- PostHog — product analytics
- OpenStreetMap — map images, and turning venue addresses into map positions
Some of these companies are outside the UK. Where data leaves the UK, it is covered by the standard legal safeguards for international transfers.
We will share data with others only if the law makes us, or to protect people from harm.
How long we keep it
We keep your data while your account is open. When you delete your account, we hide it at once and delete your personal data within 30 days. Error reports and analytics expire on their own schedules.
Your rights
You can ask to see, correct, export or delete your data, or object to how we use it. You can export your data and delete your account yourself in Account settings when signed in. For anything else, email info@undercurrent.band.
If you are not happy with our answer, you can complain to the UK Information Commissioner's Office at ico.org.uk.
The site is not for children under 16.
Data deletion
You can delete your data in two ways:
- Do it yourself. Sign in, open Account settings, and choose Delete my account.
- Ask us. Email info@undercurrent.band from the email address on your account and ask us to delete your data.
Either way, we delete your account and personal data within 30 days. A page you own with other people stays up while another owner remains. A page with no owner left is hidden.
Disconnect Undercurrent from your Google account. This stops Undercurrent getting your details from Google. It does not delete what we already hold. To do that, use one of the steps above.
To disconnect, go to myaccount.google.com/connections, choose Undercurrent, and choose Delete all connections.
Changes
If we change this policy, we update this page and the date at the top. If a change is big, we email registered users first.