Privacy Policy
What we collect, why we collect it, how long we keep it, and how to make us delete it.
Last updated: 12 August 2026
1. Who we are
BuskFinder is a service that lets buskers publish where and when they'll be playing, and lets people nearby find them. This policy explains what we do with personal data, and applies to everything on this website.
BuskFinder is operated by PromptPilot LTD, a company registered in England and Wales (company number 17391878), whose registered office is 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. PromptPilot LTD is the data controller for the personal data described in this policy.
For anything in this policy, including a request to see or delete your data, email privacy@buskfinder.com.
PromptPilot LTD is registered with the Information Commissioner's Office under registration number ZC219396.
2. What we collect
Only what the service needs to work. You can browse the map and find buskers without giving us anything at all — an account is only needed to publish pitches or follow people.
| What | When |
|---|---|
| Email address and password | When you create an account. Your password is hashed by our authentication provider — it is never stored in a readable form and we cannot see it. |
| Your name or act name | When you create an account. This is public if you publish your profile. |
| Profile details — genre, bio, quote, one-line description, area, photo, social handles, tipping link | Whatever you choose to enter. All public once you publish your profile. Everything here is optional. |
| Pitches — place name, coordinates, dates and times, any note you add | When you schedule a spot. Public, since the whole point is that people can find you there. |
| Going live — which pitch, when you started and stopped, and how far from the pitch you were | When you tap "go live". See section 5 — we record the distance, not your coordinates. |
| Follows and reviews | When you follow a busker or leave a rating. Who follows whom is private; follower counts and average ratings are public. |
| Reports | If you flag a listing. Kept after your account is deleted, but no longer linked to you. |
| Messages you send us | If you use a contact or nomination form, or email us. |
| Server logs — IP address, browser, pages requested | Automatically, by our web host, as with any website. |
We do not run advertising, we do not use tracking or analytics cookies, we do not build profiles of your behaviour, and we never sell personal data to anyone.
3. Why, and our lawful basis
Under UK GDPR we need a lawful basis for each use of your data. Ours are:
| What we do | Lawful basis |
|---|---|
| Run your account, publish your profile and pitches, show them on the map | Contract — we can't provide the service you asked for without this. |
| Send you service emails: confirming your address, resetting your password, telling you about a change to your account | Contract — these are part of running the account, and you can't opt out of them while you have one. |
| Send you optional emails about buskers you follow and our weekly Spotlight | Consent — see section 4. Only if you opt in, and you can withdraw at any time. |
| Check you're at a pitch before letting you go live | Legitimate interests — keeping the map honest. A map that says someone is playing when they aren't is worthless, and it wastes the time of people who walk there. |
| Investigate reports, prevent abuse, keep the site secure | Legitimate interests — protecting users and the service. |
| Respond to a legal or regulatory request | Legal obligation. |
Where we rely on legitimate interests, we've considered whether it's fair to you. You can object to any of it — see section 9.
4. Email, and your consent
We separate two kinds of email, and we treat them differently.
Service emails
Confirming your email address, resetting a password, or telling you about something important to your account. These come with having an account, so there's no opt-out while the account exists. We keep them to a minimum.
Optional emails
Notifications when a busker you follow schedules a spot near you, and our weekly Spotlight. These are sent only if you opt in, on the basis of consent.
- The box is never pre-ticked. Not opting in has no effect on anything else.
- We record when you opted in, so we can show that you did.
- You can withdraw at any time from Email preferences in your dashboard, or by clicking unsubscribe in any of these emails. Withdrawing is as easy as opting in was, and takes effect immediately.
- Withdrawing doesn't affect anything we sent while consent was in place.
We won't send you anything else. No third party sends you email on our behalf beyond the provider that delivers it for us, and we never pass your address to anyone for their own marketing.
5. Location data
This is the part people care most about, so we've tried to design it well rather than just describe it well.
If you're looking for buskers
When you tap "use my location", your browser gives your position to the page, in your device. It is used there to sort results by distance and to centre the map. It is never sent to us, and never stored. Close the tab and it's gone. Your browser asks permission first, and refusing simply means results are sorted from a default point instead.
If you're a busker
Pitch locations are public — you choose and publish them deliberately, because being findable is the point.
When you go live, we check your device is near the pitch you published. We record how far away you were, in metres — not where you were. We need the check, not your position, so we don't keep your position. That distance is kept so we can look into reports that someone claimed a pitch they weren't at.
Searching for a place
If you type a place name we don't already know, the text is sent to Nominatim, OpenStreetMap's geocoding service, to turn it into coordinates. What you typed goes to them; nothing that identifies you does.
6. Who we share it with
We don't sell personal data, and we don't share it for anyone else's marketing. We use a small number of providers to run the service:
| Provider | What they handle |
|---|---|
| Supabase | Our database, login system and photo storage. Data is held on servers in Frankfurt, Germany. The UK recognises the European Economic Area as providing adequate protection for personal data, so this is a permitted transfer and needs no additional safeguards. |
| Krystal Hosting Ltd | Hosts the website and keeps standard server logs. |
| OpenStreetMap and CARTO | Supply the map tiles. Loading a map sends your IP address to them, as with any embedded map. |
| Google Fonts | Supplies the typeface. Sends your IP address to Google when a page loads. |
| jsDelivr and unpkg | Deliver the map and database code libraries. Same as above. |
Anything published on your profile — your act name, photo, bio, and the pitches you schedule — is public and visible to anyone, including search engines. That's what publishing means. You control it: nothing is public until you tick "my profile is live", and you can unpublish at any time.
7. Cookies and local storage
We don't use tracking, advertising or analytics cookies. That's why you've never seen a cookie banner here — there's nothing to consent to.
When you sign in, your browser stores a login token so you stay signed in between pages. That's strictly necessary for a login to work at all, and it's cleared when you sign out. Our providers may set their own strictly necessary cookies for security.
8. How long we keep it
- Your account and profile — until you delete it. Delete it and it goes immediately.
- Pitches and live sessions — kept while your account exists, so you have a record of where you've played. Deleted with your account.
- Reports — kept for up to two years so we can spot repeat problems, but the link to whoever filed the report is removed when their account is deleted.
- Messages you send us — up to two years, then deleted.
- Server logs — kept by our host for a short period, typically a few weeks.
9. Your rights, including deletion
Under UK GDPR you have the right to:
- See what we hold about you
- Correct anything wrong — most of it you can edit yourself in your dashboard
- Delete your data (the "right to be forgotten")
- Restrict or object to how we use it
- Take it elsewhere in a portable format
- Withdraw consent for optional emails, at any time
Deleting your account yourself
You don't need to ask us. Go to Your dashboard → Delete my account. It removes your profile, your pitches, your live session history, your photo, who you follow and any reviews you've written, and it happens straight away. It cannot be undone.
The only thing that survives is any report you filed about someone else, kept as an abuse record with your identity stripped out.
If you'd rather we did it, or you can't sign in, email privacy@buskfinder.com and we'll action it within 30 days.
Everything else
Email us at the address above. We'll respond within one month, free of charge. We may ask you to confirm who you are first, so that nobody else can use these rights to get at your data.
10. Children and young people
You must be at least 13 to have a BuskFinder account. We do not knowingly collect any information about children under 13. If we find out an account belongs to someone younger, we will delete it and everything attached to it.
If you are 13, 14 or 15, you need a parent or guardian's permission before creating an account. By signing up you are confirming you have it. We may ask you to confirm this, and we may contact a parent or guardian to check.
We ask for this because of what a busker profile actually does: it publishes a name, a photo and a location at a specific time, in public, to anyone. That is a reasonable thing for an adult to decide for themselves and a decision a young person should make with a grown-up alongside them.
If you are a parent or guardian and you would like an account removed, or you want to know what we hold about your child — whatever their age — email privacy@buskfinder.com and we will action it without asking you to prove anything unreasonable.
A few practical notes for younger buskers and their families:
- You never have to publish your profile. It stays private until you tick "my profile is live".
- You choose every pitch you publish. Nothing about where you are is shared unless you post it.
- You can delete your account and everything in it yourself, at any time, from your dashboard.
- Busking itself may have its own age rules depending on the council or landowner — worth checking locally before you play.
11. Security
The site is served over HTTPS. Passwords are hashed by our authentication provider and are never visible to us. Access to the database is governed by row-level security rules, meaning the database itself enforces that you can only change your own data — it isn't left to the website to remember to check.
No system is perfectly secure. If we ever suffer a breach likely to put your rights at risk, we'll tell you and the ICO as the law requires.
12. Changes, and complaints
If we change this policy we'll update the date at the top, and for anything significant we'll tell account holders directly.
If you're unhappy with how we've handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.