Privacy
This policy covers naptownwail.com and the Naptown Wail iOS app. Both are run by one person in Indianapolis.
You can read every show, band, venue, and presenter without an account. Reading takes no name, no email, and no sign-in.
There are no tracking pixels, no advertising networks, and no third-party scripts that follow you. The register keeps one number: how many times each page was opened, by day. It carries no address, no cookie, and no device identifier, so there is nothing in it that links one view to another or to you. Nothing about your visit is sold or shared.
A coffee on the about page is paid on Stripe's checkout page, not on this site. Stripe takes the card and sends the receipt, under its own privacy policy. The register keeps nothing about it. The editor sees the payment in Stripe, with whatever name and email you give there.
An account does two things: follow bands, so their shows get flagged in the calendar, and RSVP to shows, so you get a reminder the day before. Making one is optional.
An account stores exactly this:
- Your username.
- Your password, hashed. The plain password is never written down.
- Your email, only if you type one in. It is optional and can be blank or removed at any time.
- The bands you follow.
- The shows you RSVP to.
- Your show alert preferences.
- Which shows you have already been alerted about, so the same one is not sent twice.
- A notification token for your phone, only if you turn on push notifications in the iOS app.
- Anything you post to a show's room, described below.
- Any classified ad you post, described below.
That is the whole record. No name, no location, no phone number, no contacts, no payment details, and no device identifier except the notification token described below.
A show page prints how many people have RSVPed to it. It never prints which ones.
You can RSVP to a show with an email and no account. That stores exactly this: the email, and which show it is going to. Nothing else, and no cookie is set.
The email is sent a confirmation when you RSVP and a reminder the day before the show, and nothing else. Every one of those letters carries a link that takes the address off every show it is on. The record is deleted once the show has passed.
The letters also carry a link to make an account. If you make one, or sign into one, through that link, your RSVPs move onto the account and the email becomes the account's email if it has none.
Your browser remembers which shows it RSVPed to without an account, so the button stays pressed. That is kept on your device, not sent to the register.
If you give an email it is used to send show alerts for bands you follow and shows you RSVP to, and for nothing else. It is never sold, rented, shared, or used for marketing. There is no newsletter attached to it.
The iOS app can send a notification when a band you follow has a show coming up, or the day before a show you RSVP to. Turning it on asks the phone for permission and then stores one thing: a push token, the address Apple's notification service uses to reach that installation of the app. A push token is a device identifier. It is stored against your account and used only to send show alerts for bands you follow and shows you RSVP to.
Turning push notifications off deletes the token. So does signing out, and so does deleting your account. If you decline the permission, no token is ever created. Push notifications are separate from email alerts: switching one on does not switch on the other.
A signed-in reader can post to the room under a show: a few lines of text, up to four photos, or one clip of up to five seconds. A post stores your username, what you wrote, the photos or the clip, which night and room it is about, and when you posted it. Posts are public on the show's page.
Photos are redrawn in your browser before they upload, which takes the camera's location and other details out of the file. A clip is cut to five seconds and saved again without any of the details your phone wrote into it, location included. The file as your phone made it is deleted when that is done, usually within the hour. Photos and clips are kept with Cloudflare R2, a storage provider acting for the register.
A post with photos or a clip has a box that lets the bands on that night's bill use them, with credit to you. If you tick it, the register keeps that yes, when you gave it, and which version of the wording you agreed to, and puts a copy of the photos or the clip with your username where the bands' shared media library collects it. If you leave it unticked, nothing is shared.
A post stays up until you delete it or delete your account. Either way the post comes off the page at once, and its photos and clips are deleted from storage within a day. A copy already made for the bands stays with them, because you said yes to that, unless the post was taken down because someone in it asked.
Anyone can report a post, with or without an account. A report stores the reason, any note written with it, and a scrambled code that tells one reporter from another. Signed in, the code is made from your account. Signed out, it is made from your connection's address and your browser under a key that changes every day, so it can't be turned back into either. Blocking someone's posts is kept in your browser and is not sent to the register.
A signed-in reader with an email on file can post a classified ad. An ad stores your username, the section, the title, the price if you give one, what you wrote, up to three photos, and when it runs out. Photos go through the same redrawing as a show's room. An ad runs 30 days and you can renew it. Once it runs out it comes off the page, and it is deleted with its photos 30 days after that.
Your email is never printed. When a reader writes to you about an ad, the register sends their message to your email through Resend, with their email as the address to reply to, so when you answer they see your address. The message is not kept. The register keeps a note that they wrote to you, without the message, for 30 days, to limit how many messages one account can send in a day.
Signing in sets one cookie. It holds your session so you are not asked to sign in on every visit, it expires after 90 days, and it is used for nothing else. There are no advertising or tracking cookies.
Delete your account from the account panel on the site, or from the account sheet in the iOS app. Your account, your email, every band you follow, every show you RSVP to, and any push token on file are deleted immediately from the database. There is no undo and there is no backup copy held back.
Your posts to show rooms and your classified ads are deleted with it, and their photos and clips are deleted from storage within a day.
The site is hosted on Vercel. Account records and the page counts are stored in a Neon Postgres database. Both are service providers acting for the register, not audiences for your data. Alert emails, when they are switched on, are sent through Resend. Push notifications, when they are switched on, are delivered by Apple's Push Notification service, which receives the token and the text of the notification in order to deliver it.
Show listings, band names, venues, and presenters are public information about public events, compiled by hand and by scraper. If you are in a listing and want it corrected or taken down, write the desk and it will be handled.
The register is not directed at children under 13 and does not knowingly collect anything from them.
If this policy changes, the revised version is posted here. Questions, corrections, or a request to see or delete what is on file: email the editor.