ShowHunter

Privacy Policy — ShowHunter

East Heights Labs, LLC  ·  Houston, TX  ·  ShowHunter

App: ShowHunter
Developer: East Heights Labs, LLC
Effective Date: [TO BE SET ON LAUNCH]
Last Updated: October 26, 2026
Version: 0.2 (Aaron Woo MHW_v2 markups incorporated; ShowHunter rebrand)

Table of Contents

§1 — Introduction / Who We Are

§1.1 About East Heights Labs, LLC

ShowHunter is a live music discovery application developed and operated by East Heights Labs, LLC (“East Heights Labs,” “we,” “us,” or “our”), a Texas limited liability company with a principal mailing address at:

East Heights Labs, LLC
1900 W Gray St, P.O. Box #130180
Houston, TX 77219

This Privacy Policy (“Policy”) describes how East Heights Labs collects, uses, stores, and shares information about users (“you” or “your”) of the ShowHunter iOS application (“App”) and any related services, websites, or platforms operated by East Heights Labs (collectively, the “Services”).

§1.2 Scope of This Policy

This Policy applies to all users of the App, including:

By downloading, installing, or using the App, you acknowledge that you have read and understood this Policy. If you do not agree with this Policy, please do not use the App.

§1.3 Alpha / Pre-Launch Status

At the time of this writing, the App is in alpha testing via Apple TestFlight and has not yet launched publicly on the Apple App Store. Some features and data practices described herein may not yet be fully implemented. This Policy is published in advance to comply with Apple’s App Store Review Guidelines and applicable law. We will update this Policy as features are added or changed.

§1.4 No Advertising Business Model

East Heights Labs does not serve advertisements and does not sell user data. The App is supported by subscription revenue. We have no financial relationship with advertisers and do not profile users for advertising purposes.

§2 — Information We Collect

We collect the minimum information necessary to operate the App. The categories below describe what we collect, when, and why.

§2.1 Device UUID (Anonymous Identifier)

When you first launch the App, we generate and assign a random, device-specific UUID (“Device UUID”) to your installation. This UUID:

We may retain multiple UUIDs associated with a single account if you use the App on multiple devices or reinstall the App (see §2.4 and §6).

§2.2 Sign In with Apple (Optional)

We offer Sign In with Apple as an optional authentication method. You are not required to sign in to use the core features of the App. If you choose to sign in:

2.2.1 What Apple Provides to Us

Apple’s Sign In with Apple service provides us with:

2.2.2 What We Do Not Receive

We do not receive:

2.2.3 How We Use Sign In with Apple Data

We use your Apple sub claim, email (if provided), and display name (if provided) solely to:

We do not share your Apple sub claim, email, or display name with third parties except as described in §4.

§2.3 Location Data

The App requests access to your device’s location to show live music events near you.

2.3.1 How Location Is Used

2.3.2 What We Do Not Do With Location

2.3.3 Permission Control

You may grant “While Using” or “Always” location access, or deny location access entirely through iOS Settings. The App functions with reduced capability (no proximity sorting, no “near me” features) if location is denied.

§2.4 Account Activity and UUID History

When you sign in with Apple, we link your anonymous activity history to your account. Specifically:

This linkage exists to provide a seamless cross-device experience. We retain your UUID history for the duration of your account and delete it upon account deletion (see §6.2).

§2.5 Community Contributions

If you submit any of the following, we collect and store that content:

Community contributions are associated with your Device UUID (anonymous users) or your account (signed-in users). You retain ownership of your contributions, but grant East Heights Labs a worldwide, royalty-free, perpetual, irrevocable license to use, display, and distribute your contributions as described in our Terms of Service (§4.2 of the ToS).

We may retain anonymized, de-identified community contributions (stage time reports, venue corrections) even after account deletion, as provided in §6.4.

§2.6 Subscription and Entitlement Data

If you subscribe to ShowHunter, we collect and store:

Subscription and billing processing is handled by Apple’s StoreKit / App Store (see §5.5). We do not receive your payment card information. We receive only transaction identifiers and entitlement status from Apple.

Entitlement data is linked to your account and used solely to provision subscription benefits. It is deleted upon account deletion (see §6.2).

§2.7 Usage Data and Diagnostics

Currently: We do not collect analytics or behavioral telemetry in the alpha version of the App.

In the future: If we add analytics, we will update this Policy before doing so and, where required by law, obtain your consent. Any analytics we implement will be described in this section with specificity (vendor, data collected, retention period, opt-out mechanism).

Apple may collect app crash reports and usage data through its own frameworks (e.g., MetricKit, TestFlight diagnostics). This data is governed by Apple’s Privacy Policy and your iOS privacy settings.

§2.8 Communications Data

If you contact us by email (e.g., to request account deletion or report an issue), we collect and retain the content of that communication, including your email address, for the purpose of responding and maintaining a record of the interaction. We do not use this information for marketing without your consent.

§3 — How We Use Your Information

We use the information we collect for the following purposes:

§3.1 Providing and Operating the App

§3.2 Improving the App and Services

We do not use individual behavioral data to train machine learning models or improve third-party products without your explicit consent.

§3.4 Communications

We do not use your data for:

§4 — How We Share Your Information

We do not sell your personal information. We do not share your personal information with third parties for advertising or marketing purposes. We share information only in the limited circumstances described below.

§4.1 Service Providers (Processors)

We use the following infrastructure service providers to operate the App. These providers process data on our behalf and are contractually prohibited from using your data for their own purposes:

Provider Role Data Processed
Railway Backend hosting (Python FastAPI) All server-side data in transit and at rest
PostgreSQL (via Railway) Database All stored user and event data

We do not currently use email marketing platforms, advertising networks, or analytics vendors. If we add such providers, we will update this Policy. We may also disclose your information to contractors, service providers, and other third parties we use to support our business who are bound by contractual obligations to keep personal information confidential and use it only for the purposes for which we disclose it to them.

We may disclose your information if we believe in good faith that disclosure is necessary to:

§4.3 Business Transfers

If East Heights Labs is involved in a merger, acquisition, asset sale, or other business combination, your information may be disclosed to a buyer, prospective buyer, or successor and may be transferred as part of that transaction. We will notify you via the App or by email (if available) before your information is transferred and becomes subject to a different privacy policy.

§4.4 Aggregate and De-Identified Data

We may share aggregate, de-identified, or anonymized data that cannot reasonably be used to identify you (e.g., “X% of users in Houston attend outdoor music events”) for research, analytics, or promotional purposes. This data is not personal information.

§4.5 No Sale or Sharing for Advertising

We do not sell, rent, or otherwise make available your personal information to third parties for advertising, profiling, or cross-context behavioral advertising purposes. This applies to all users, including California residents (see §7.2) and Texas residents (see §7.1).

§5 — Third-Party Services

The App integrates with third-party services as described below. When you use these features, your data may be processed by those third parties under their own privacy policies. East Heights Labs does not control third-party data practices.

§5.1 Apple Maps and MapKit

The App uses Apple Maps via the MapKit framework, including MKLocalSearch, to display maps and perform location-based event searches. When you use map features:

§5.2 Apple CoreLocation

The App uses CoreLocation to access your device’s GPS location, subject to the permissions you grant in iOS. Location data is used locally and for proximity queries to our backend. We do not store your precise location on our servers (see §2.3).

§5.3 Ticketmaster API

We retrieve event data from the Ticketmaster Discovery API to populate event listings in the App. This integration:

Ticketmaster’s privacy practices are governed by the Ticketmaster Privacy Policy (https://www.livenation.com/privacy-policy).

§5.4 JamBase API (and Potentially Bandsintown API)

We may retrieve event and artist data from JamBase and/or Bandsintown to supplement event listings. These integrations:

If these integrations are expanded in a manner that involves user data, we will update this Policy.

§5.5 Apple App Store and StoreKit

Subscription purchases are processed by Apple’s App Store via StoreKit. Apple processes your payment information directly. We receive only transaction identifiers and entitlement status to provision your subscription tier. We do not receive your payment card information, billing address, or Apple ID.

Apple’s data practices in connection with App Store purchases are governed by Apple’s Privacy Policy and the Apple Media Services Terms and Conditions.

§5.6 Apple Sign In with Apple

As described in §2.2, Sign In with Apple is processed by Apple. We receive only the limited account identifier and optional fields described in §2.2.1. Apple’s privacy practices for this service are governed by Apple’s Privacy Policy.

§5.7 Apple TestFlight (Alpha Only)

During the alpha phase, the App is distributed via Apple TestFlight. TestFlight may collect diagnostic, performance, and usage data governed by Apple’s Privacy Policy and separate TestFlight terms. This data collection is managed by Apple and is outside East Heights Labs’ control.

§5.8 SeatGeek

We retrieve event data from the SeatGeek API to populate event listings and ticket links in the App. This integration:

SeatGeek’s privacy practices are governed by the SeatGeek Privacy Policy (https://seatgeek.com/privacy-policy).

§5.9 Setlist.fm

We may use data from Setlist.fm as input to our stage time estimation model. This integration:

Setlist.fm’s privacy practices are governed by the Setlist.fm Privacy Policy (https://www.setlist.fm/privacy-policy).

§5.10 Railway

Our backend infrastructure is hosted on Railway. Railway processes data on our behalf as a service provider:

Railway’s privacy practices are governed by the Railway Privacy Policy (https://railway.app/legal/privacy).

§5.11 Vercel

Our venue dashboard is hosted on Vercel. Vercel processes data on our behalf as a service provider:

Vercel’s privacy practices are governed by the Vercel Privacy Policy (https://vercel.com/legal/privacy-policy).

§6 — Data Retention

We retain personal information only as long as necessary to fulfill the purposes described in this Policy, comply with legal obligations, and resolve disputes.

§6.1 Anonymous Users (No Account)

For users who have not signed in with Apple:

§6.2 Registered Users (Sign In with Apple)

Upon account deletion:

Exception: Community-contributed stage time reports and venue corrections may be retained in anonymized, de-identified form after account deletion, with all linkage to your account, name, email, and Device UUIDs severed. This exception exists to preserve the accuracy of the event data index, which benefits all users. Once de-identified, this data cannot reasonably be attributed to you.

§6.3 Inactive Accounts

We do not currently have an automatic inactive-account deletion policy. [OPEN ITEM — see Appendix A, Item 3]

§6.4 Community Contributions (Anonymized)

As noted in §6.2, certain community contributions may be retained in de-identified form indefinitely after account deletion. This data does not constitute personal information once all identifiers are severed.

§6.5 Anonymous User Deletion Requests

Anonymous users do not have an account identifier we can use to locate their data with certainty. If you wish to request deletion of data associated with your anonymous use:

  1. Contact us at privacy@eastheightslabs.com;
  2. Provide your approximate activity window (date range) and the city or cities where you used the App;
  3. We will make reasonable, good-faith efforts to identify and delete data plausibly associated with your device.

We cannot guarantee precise attribution for anonymous users and will so advise you upon receipt of your request.

Notwithstanding the above retention periods, we may retain information longer if required by law, regulation, legal process, or to resolve active disputes, claims, or investigations.

§7 — Your Privacy Rights

Depending on where you reside, you may have certain rights regarding your personal information. East Heights Labs will honor these rights to the extent required by applicable law. To exercise any right described below, contact us at privacy@eastheightslabs.com.

We will respond to verifiable requests within the timeframes required by applicable law. We will not discriminate against you for exercising your privacy rights.

§7.1 Texas Residents — Texas Data Privacy and Security Act (TDPSA)

The Texas Data Privacy and Security Act (Tex. Bus. & Com. Code §541 et seq.) grants Texas residents the following rights with respect to their personal data:

7.1.1 Right to Access
You have the right to confirm whether we are processing your personal data and to access that data.

7.1.2 Right to Correction
You have the right to correct inaccuracies in your personal data, taking into account the nature of the data and the purposes of processing.

7.1.3 Right to Deletion
You have the right to request deletion of personal data you have provided to us or that we have collected about you.

7.1.4 Right to Data Portability
You have the right to obtain a copy of your personal data that you previously provided to us in a portable and, to the extent technically feasible, readily usable format.

7.1.5 Right to Opt Out of Sale
You have the right to opt out of the sale of your personal data. East Heights Labs does not sell personal data. No opt-out is required, but you may contact us to confirm this.

7.1.6 Right to Opt Out of Targeted Advertising
You have the right to opt out of the processing of your personal data for purposes of targeted advertising. East Heights Labs does not conduct targeted advertising. No opt-out is required, but you may contact us to confirm this.

7.1.7 Right to Appeal
If we decline to take action on your request, you have the right to appeal that decision. To appeal:

  1. Submit a written appeal to privacy@eastheightslabs.com within a reasonable time after receiving our decision;
  2. Describe the basis for your appeal;
  3. We will respond within 60 days of receiving your appeal, as required by the TDPSA.

If your appeal is denied, you may submit a complaint to the Texas Attorney General’s Office at texasattorneygeneral.gov.

§7.2 California Residents — California Consumer Privacy Act (CCPA / CPRA)

Although the App is currently available primarily in Texas, we provide the following disclosures to California residents in anticipation of national expansion.

The California Consumer Privacy Act (Cal. Civ. Code §1798.100 et seq.), as amended by the California Privacy Rights Act (CPRA), grants California residents the following rights:

7.2.1 Right to Know
You have the right to request disclosure of: (a) the categories and specific pieces of personal information we have collected about you; (b) the categories of sources from which we collected that information; (c) our business or commercial purposes for collecting or selling that information; and (d) the categories of third parties with whom we share that information.

7.2.2 Right to Delete
You have the right to request deletion of personal information we have collected about you, subject to certain exceptions.

7.2.3 Right to Correct
You have the right to request correction of inaccurate personal information we maintain about you.

7.2.4 Right to Opt Out of Sale or Sharing
You have the right to opt out of the sale or sharing of your personal information. East Heights Labs does not sell or share personal information within the meaning of the CCPA/CPRA. No opt-out is required.

7.2.5 Right to Non-Discrimination
We will not discriminate against you for exercising any of your CCPA rights.

7.2.6 Right to Limit Use of Sensitive Personal Information
To the extent we process sensitive personal information (as defined by the CPRA), you have the right to limit our use of such data to purposes authorized by law. We do not believe we process sensitive personal information as defined by the CPRA, but if you have questions, contact us at privacy@eastheightslabs.com. [OPEN ITEM — see Appendix A, Item 6]

7.2.7 How to Submit a CCPA Request
Submit requests by email to privacy@eastheightslabs.com with the subject line “CCPA Privacy Request.” We will respond within 45 days (extendable by an additional 45 days with notice).

7.2.8 Authorized Agents
California residents may authorize an agent to submit requests on their behalf. We will require the agent to provide written authorization from you and may require you to verify your identity directly.

§7.3 All Users — General Rights

Regardless of your location, you may:

§7.4 How to Submit a Request

To exercise any of the rights described in this §7:

We may need to verify your identity before processing certain requests. We will not require you to create an account to exercise your rights.

§8 — Children’s Privacy

§8.1 Age Restriction

ShowHunter is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. The App is intended for users who are at least 13 years of age (or the minimum age required by applicable law in their jurisdiction).

§8.2 COPPA Compliance

In accordance with the Children’s Online Privacy Protection Act (COPPA) (15 U.S.C. §6501 et seq.):

§8.3 If We Learn a Child Has Registered

If we discover that a user under the age of 13 has provided personal information without verifiable parental consent, we will:

  1. Promptly delete that information from our records;
  2. Terminate the associated account if applicable; and
  3. Notify the parent or guardian if contact information is available.

§8.4 Parental Contact

Parents or legal guardians who believe their child has provided personal information to ShowHunter should contact us immediately at privacy@eastheightslabs.com. We will take prompt action to delete the information and terminate the account.

§9 — Security

§9.1 Security Measures

East Heights Labs implements reasonable administrative, technical, and physical security measures designed to protect your personal information from unauthorized access, disclosure, alteration, and destruction. These measures include:

§9.2 Limitations

No security system is impenetrable. We cannot guarantee the absolute security of your information. In the event of a data breach that affects your personal information, we will:

§9.3 Your Responsibilities

You are responsible for maintaining the security of your Apple ID and device. Sign In with Apple uses Apple’s authentication infrastructure; we never receive your Apple ID password. If you believe your account has been compromised, contact us at privacy@eastheightslabs.com and change your Apple ID credentials through Apple’s account settings.

§10 — Changes to This Policy

§10.1 Notice of Changes

We may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or App features. When we make material changes, we will:

§10.2 Continued Use

Your continued use of the App after the effective date of a revised Policy constitutes your acceptance of the changes. If you do not agree with the revised Policy, you should discontinue use of the App and may request deletion of your account and data as described in §6 and §7.

§10.3 Archived Versions

Previous versions of this Policy will be archived and available upon request by contacting privacy@eastheightslabs.com. [OPEN ITEM — see Appendix A, Item 7]

§11 — Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

East Heights Labs, LLC
Attn: Privacy
1900 W Gray St, P.O. Box #130180
Houston, TX 77219

Email: privacy@eastheightslabs.com
Support: support@showhunter.app
Website: https://showhunter.app/privacy

We will respond to privacy inquiries within a reasonable time and no later than required by applicable law.

Appendix A — Open Items for Attorney Review

The following items require attorney judgment and should be resolved before this Policy is published. Items are numbered for reference in counsel’s review.

Item 1 — TDPSA Controller/Processor Threshold Analysis

The Texas Data Privacy and Security Act applies to controllers that conduct business in Texas and either: (a) process personal data of 100,000+ consumers per year; or (b) process personal data of 25,000+ consumers per year and derive over 25% of gross revenue from the sale of personal data. Because we do not sell personal data, prong (b) likely does not apply. Prong (a) depends on user volume. Counsel should confirm: (i) whether the app is currently subject to the TDPSA at alpha stage; (ii) whether proactive compliance (included in this draft) is the appropriate posture; and (iii) whether any exemptions apply.

Item 2 — CCPA Applicability Threshold

The CCPA/CPRA applies to businesses that: (a) have annual gross revenues over $25 million; (b) buy, sell, receive, or share personal information of 100,000+ consumers or households annually; or (c) derive 50%+ of annual revenues from selling consumers’ personal information. East Heights Labs is pre-revenue. Counsel should confirm: (i) whether CCPA disclosures are appropriate at this stage as a forward-looking measure; (ii) whether any safe harbor or exemption applies to small businesses during the pre-revenue period; and (iii) whether proactive inclusion creates unintended legal obligations.

Item 3 — Inactive Account Retention Policy

We have not yet defined a retention period for accounts with no activity. Counsel should advise on: (i) best practices for inactive account retention (e.g., 2-year inactivity trigger); (ii) whether TDPSA or other applicable law requires a defined retention limit; and (iii) whether a user notice and grace period should precede deletion.

Item 4 — Apple Sign In with Apple Compliance Review

Apple’s App Store Review Guidelines (Guideline 4.8) and Sign In with Apple requirements impose specific obligations on apps that use Sign In with Apple, including requirements around account deletion and data handling. Counsel should confirm that this Policy’s account deletion and data handling provisions fully satisfy Apple’s requirements, including the requirement to offer in-app account deletion before App Store launch.

Item 5 — In-App Account Deletion Requirement (Apple)

Apple requires apps that support account creation to offer in-app account deletion before App Store approval (App Store Review Guideline 5.1.1(v)). The current deletion path is email-only (privacy@eastheightslabs.com). This is acceptable for TestFlight alpha, but must be remediated before App Store submission. This item is flagged here for completeness; no change to the Policy text is required, but the technical implementation is a prerequisite to launch.

Item 6 — Sensitive Personal Information Under CPRA

The CPRA defines “sensitive personal information” broadly, including precise geolocation data. The App collects precise device location. Counsel should advise: (i) whether the App’s location processing constitutes “sensitive personal information” under CPRA; (ii) if so, whether a “Limit Use of My Sensitive Personal Information” link or mechanism is required; and (iii) whether the current §7.2.6 treatment is sufficient.

Item 7 — Policy Archive and Versioning

§10.3 commits to providing previous versions upon request. Counsel should advise on: (i) how long prior versions should be retained; (ii) whether they should be publicly posted or available only on request; and (iii) whether a versioned archive at the public privacy URL (eastheightslabs.com/privacy.html) is advisable.

Item 8 — Bandsintown API — Confirm Data Sharing Terms

The Bandsintown API is listed as a potential integration. Before activating this integration, counsel and the development team should review Bandsintown’s API terms of service to confirm: (i) no user data is transmitted in API requests; (ii) no cross-referencing of user identifiers with Bandsintown’s data is occurring; and (iii) the Policy’s §5.4 description is accurate upon activation.

Item 9 — Railway / PostgreSQL DPA

East Heights Labs should execute a Data Processing Agreement (DPA) with Railway (or its underlying cloud provider) before storing personal data at scale. Counsel should confirm: (i) whether Railway offers a DPA; (ii) whether a DPA is required under TDPSA or other applicable law; and (iii) whether the current hosting arrangement satisfies applicable data residency requirements (note: Railway may use infrastructure outside Texas or the U.S.).

Item 10 — Future Analytics Vendors

§2.7 acknowledges that analytics may be added in the future. Counsel should advise on: (i) preferred analytics vendors that minimize data exposure (e.g., privacy-preserving, self-hosted, or server-side only); (ii) consent requirements under TDPSA, CCPA, and App Store guidelines for analytics; and (iii) whether a “Do Not Track” or opt-out mechanism will be required.

Item 11 — Effective Date and Version Numbering

This Policy has a placeholder effective date (“[TO BE SET ON LAUNCH]”). Counsel should advise on: (i) when this Policy should become effective (TestFlight distribution vs. App Store launch vs. earlier); and (ii) the versioning convention to use in the change log.

Item 12 — Texas Breach Notification

Texas Business & Commerce Code §521.053 requires notification to affected individuals and the Texas Attorney General within 60 days of a data breach. Counsel should confirm: (i) current compliance posture; (ii) whether an incident response plan should be referenced in the Policy; and (iii) whether notification obligations extend to Ticketmaster/JamBase API event data (we believe not, as no user data is shared, but confirm).

Change Log

Version Date Author Notes
0.1 2026-09-08 East Heights Labs (AI-assisted draft) Initial draft for attorney review. Pre-launch, alpha stage.
0.2 2026-10-26 Tom Hagen (incorporating A. Woo MHW_v2 markups) Aaron Woo markups applied: §2.5 license expanded (sublicense + transferable); §4.1 contractor/DPA language added; §4.2 merger disclosure expanded; §5.8–5.11 added (SeatGeek, Setlist.fm, Railway, Vercel); §7.3 location path updated; app rebranded to ShowHunter throughout.

ShowHunter is a product of East Heights Labs, LLC. All rights reserved.
Privacy questions: privacy@eastheightslabs.com
Support: support@showhunter.app
Policy URL: https://showhunter.app/privacy