Noxta is a festival companion app. This policy explains what information the app handles, in plain language, and sets out your rights under the EU General Data Protection Regulation (GDPR).
Noxta is the data controller for the limited information described below. The monitored contact for any privacy question, or to exercise any of the rights set out under “Your rights”, is privacy@noxta.app. The operating entity's registered name and postal address are published here on the app's public launch; until then privacy@noxta.app is the contact of record and is answered.
Attendees do not need an account and Noxta does not ask for their name, email, or phone number to use the festival companion. They pick a festival by scanning a QR code or entering a short code — that's it.
Festival-team members who use the admin panel have individual staff/admin accounts. We store the account's username (which may be an email address), role, status, and hashed credential for as long as the account exists. The hash is used to verify the password; the password itself is not stored.
Admin logins and privileged actions are recorded under that username in a security audit log kept for 180 days. This does not apply to attendees. The separate staff console uses shared, role-scoped PINs and records the role and festival rather than a person's name.
The following stays only on your phone (local storage), except for the pseudonymous usage events used to produce anonymous, aggregate usage statistics, and artist stars and reactions, described in the “Usage statistics” and “Artist ratings” sections below:
Uninstalling the app or clearing its data removes all of this.
The app asks your phone for these three permissions. Each one is optional — your operating system asks you first, and you can take the permission back at any time in your system settings.
Saying no to any of them leaves the rest of the app working — you can always type a festival's short code instead of scanning it.
The app reads public festival data (lineup, stages, schedule, food/bar status) from our backend so it can show it to you — this data isn't personal to you, it's the same for every attendee.
In-app chat is not enabled in this release, so the app does not collect or store chat nicknames or messages.
Staff alerts. Festival staff can broadcast short operational messages through the app — a bar closing, a zone closure, a lost or found item, a medical team being called to an area. Every device holding that festival's short code receives them, so they are public to everyone at the event. Staff are instructed not to name or otherwise identify attendees in them, and the compose form carries that warning. If you believe an alert identifies you, ask any staff member or the festival's info point to have it taken down: staff can withdraw it from the panel, which stops further delivery and retracts it from devices that already received it. Alerts older than 30 days are deleted by an automatic daily retention job.
Noxta collects first-party pseudonymous usage events: app opens, session starts, offline launches, screens viewed as coarse names, whether content loaded from your device's cache or the network, coarse error signals (that an error of a general category occurred — never messages or content), app-update events (offline component installation, update availability and update activation), and web-app installation events, plus the app version, platform, display mode (how the app is opened: installed app or browser tab), and language. Festival codes, artist IDs, written notes and other free-text content are not included. We use these events to view anonymous, aggregate usage statistics.
There are no analytics cookies and no analytics identifier is stored on your device. Our server combines your IP address and browser signature with a secret random value that changes every day and is permanently destroyed about two days later. This daily code is pseudonymous data derived from your IP address: on a single day it links the screens you view together, and we process it under our legitimate interest. We cannot identify you by name, and the code cannot be linked across days. Your IP address is used briefly in two ways and never kept with the statistics: to compute the daily code (then discarded), and for abuse-protection rate limiting — short-lived counters at Cloudflare and in our database that expire within about an hour. Around midnight you may be counted twice.
Cloudflare processes these events as our hosting infrastructure. You can opt out at any time using the Usage statistics toggle on the Home screen or on the app's Settings screen — reached with the gear in the top bar of any festival tab, or from Info → Settings; the change takes effect immediately and nothing is sent while it is off.
Separately from the events above, the website measures its traffic with Cloudflare Web Analytics, a cookieless measurement tool operated by Cloudflare as part of the infrastructure that hosts Noxta. A small script provided by Cloudflare runs when you open the web app and reports page views and loading performance — the address of the page within the app (never query strings), the referring site, the browser and device type, and the country — directly to our own domain. It sets no cookies, stores nothing on your device, and does not fingerprint you; Cloudflare shows us the results only in aggregate form, for up to six months. It is part of how the website is served, so the Usage statistics toggle above does not affect it. Because the results hold nothing linkable to any individual, there is no per-person record we could look up, erase or suppress; any content blocker stops the script from loading at all, and questions about it are welcome at privacy@noxta.app.
If you rate an artist, the app sends the stars and reaction (never your written notes) to our server under a random pseudonymous per-festival code. This means the submission carries a random code instead of your name or an account; the code is stored only on your phone and never tied to your identity. In the retained rating record, the random code is replaced with a scrambled per-artist derivative that cannot be used to group your ratings across artists or festivals. For abuse protection and rate limiting, our server also keeps short-lived counters grouped by IP bucket and by a derivative of the per-festival random code. They stop counting after about an hour and are physically deleted by the daily cleanup job, normally within a day. Your written notes never leave your device. Removing the festival in the app discards the random code. Ratings are deleted 180 days after the festival ends.
Cloudflare hosts all of Noxta: Cloudflare Workers serves the app and backend, Cloudflare D1 stores festival data, and Cloudflare R2 stores organizer-uploaded images.
Email you send to the addresses below reaches us through Cloudflare Email Routing and is delivered to a mailbox hosted by Google, so anything you choose to write to us is handled there too.
Noxta does not use advertising trackers, and no analytics service other than Cloudflare ever receives usage data. Besides the first-party pseudonymous usage events described in “Usage statistics” above, Cloudflare Web Analytics — the cookieless measurement tool run by Cloudflare as our hosting processor, described in that same section — measures traffic on the website.
Under GDPR Article 6, the app's processing rests on these legal bases:
The backend runs an automatic daily retention job. Concrete periods:
Because attendees need no account, most attendee data never leaves your phone, and you control it directly by clearing the app's storage. For the limited information the backend does hold — organizer onboarding submissions, staff/admin account and audit records, and any staff alert you believe identifies you — you have the right under GDPR to:
To exercise any of these, email privacy@noxta.app. You also have the right to lodge a complaint with a data-protection supervisory authority. For the Drops Festival pilot in Slovenia that authority is the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec), ip-rs.si; if you are in another EU country you may contact your local authority instead.
Cloudflare, Inc. is our processor for hosting (Workers, D1, R2) and for the Cloudflare Web Analytics measurement described under “Usage statistics”, and keeps this data in its network. When an analytics beacon arrives, Cloudflare uses your IP address in that moment to derive the country it reports to us; the address is not stored with the statistics. Email you send to our contact addresses reaches us through Cloudflare Email Routing and is delivered to a mailbox hosted by Google LLC in the United States — a transfer outside the EEA, which relies on the EU–US Data Privacy Framework and, as a safeguard, the European Commission's Standard Contractual Clauses. If you prefer your message not to be handled in the US, do not email us the details; ask a staff member at the event instead.
Any cashless-wallet balance shown in the app is read-only information provided by the festival — Noxta does not process payments or store payment details.
Noxta isn't directed at children and doesn't knowingly collect information from anyone under 13. Attendance at any given festival is governed by that festival's own age policy, not by this app.
If you use Noxta as an attendee, you have no account and are in control by default — clear the app's storage or uninstall it to remove everything stored on your device. For other privacy questions, use the contact below.
If this policy changes, the update will be posted on this page with a new "last updated" date.
Contact privacy@noxta.app.