Privacy policy
Last updated 16 September 2026
We never see your card number. Nothing tracks you on a band's page — no trackers, no analytics, no advertising cookies, ever. We don't sell anything to anybody. The only thing we ask for that identifies you is an email address, and only if you tick the box asking to hear from the band. Our own two marketing pages, where we advertise Crowdset to musicians, do carry an advertising cookie; the rest of this page says exactly where and why.
Crowdset is operated by Will Thompson Music, Corp ("Crowdset", "we", "us") in Florida, United States. It lets people at a live show request songs and send paid shout-outs from their phone. This policy covers crowdset.live and every band page on it.
Everything a fan or a band actually uses — every band page, the song list, the payment screen, the band's own office and the venue display — carries no advertising or analytics code of any kind. That is the promise that matters, and it has not changed.
Two pages are different, and they are ours rather than anyone's: the homepage at crowdset.live and the sign-up page at crowdset.live/start. Those exist to explain Crowdset to working musicians, they are where our own ads send people, and they carry a Meta advertising cookie so we can tell which ads reached a musician and which wasted our money. If you scanned a code in a bar, you will never see either page and nothing has been set on your device.
Two kinds of people use Crowdset, and we hold different things about each. Fans are people in the room scanning the code. Bands are the performers who signed up and get paid.
What we collect from fans
A random device tag
The first time you open a band's page, your browser generates a random string — something like f-8k2p9x — and stores it on your own device. It lets the board show which requests are yours and keeps your running total straight. It is not your name, it is not linked to your identity, and it is not shared between bands' pages in any way we can read back to a person. Clearing your browser storage erases it permanently.
A display name, if you type one
You can put a name on a request or a shout-out so it reads properly on the venue screen. Whatever you type is what shows up. Nothing checks it, and nothing requires it to be your real name.
What you asked for
The song you requested, the shout-out text, the amount, and the time. This is the band's record of the night and our record of the money.
Payment details
Your card number, expiry, security code and wallet credentials go straight from your phone to Stripe. They never touch a Crowdset server and we could not retrieve them if we tried.
What comes back to us is a reference number for the payment, the amount, and whether it went through. If you paid with Apple Pay or Google Pay, we don't receive the card behind it either. Stripe is a certified PCI Service Provider Level 1 and handles that data under its own privacy policy.
Your email address — only if you offer it
After a request goes through, the band may ask whether you'd like to hear about their next show. That box is optional and skipping it changes nothing about your request. If you fill it in, your address is stored against that band and that band alone, and it is given to that band so they can mail you. Different bands never see each other's lists. We do not use these addresses ourselves and we don't pass them to anyone else.
What we collect from bands
The band name and address you chose, a contact email, the venue and city you type in for a night, your setlist, an optional logo image, and the takings from each show. If you choose to load your set list from a photo or by saying it, that photo or text is sent to Anthropic to read the song titles off it, and only the list of songs comes back — we don't keep the photo. To get paid you also connect a Stripe account: your bank details, tax details and identity documents go to Stripe, not to us. We hold only the account reference Stripe gives us.
What we do not do
- No advertising shown inside Crowdset. We never sell space on a band's page and a fan is never shown an ad by us.
- No analytics, tracking pixels, session recording or fingerprinting on any band page, fan page, office or payment screen. There are no third-party scripts on the fan page besides Stripe's own payment form.
- No selling, renting or trading personal information. We have never done this and the business does not depend on it.
- No location tracking. Crowdset never asks for your location and never receives it.
- No accounts or passwords for fans. There is nothing to sign up for and nothing to sign out of.
- No tracking of anyone who has told their browser not to be tracked — see below.
Cookies and storage
Crowdset sets no advertising or tracking cookies on any band page, fan page, office or payment screen. It uses your browser's own local storage for two things: the random device tag described above, and — for bands — the code that keeps you signed in to your own office page. Both live on your device, not on ours.
On our two marketing pages — the homepage and crowdset.live/start — we load Meta's advertising pixel, which sets a cookie and tells Meta that a browser visited the page and whether it went on to sign up. That is how we find out which of our ads reach working musicians. TikTok's equivalent pixel runs on the same two pages for the same reason. Nothing else on crowdset.live loads either one.
We honour Global Privacy Control. If your browser or an extension sends a GPC signal — or an older Do Not Track header — the advertising pixel is never loaded at all on those pages. Not loaded and then ignored: never requested, so nothing is set and nothing is sent. Most privacy-focused browsers send this by default, and in California, Colorado and several other states it is a legally binding opt-out from targeted advertising.
Who else sees this information
We share the minimum needed to run the thing, with these companies and nobody else:
- Stripe, Inc. — takes the payment and pays the band. Receives the payment amount and card data directly from you. stripe.com/privacy
- Netlify, Inc. — hosts the site and holds the encrypted nightly backup. Receives standard web server logs, including IP addresses, as any website host does.
- Neon, Inc. — hosts the database the show data sits in.
- Anthropic, PBC — reads the song titles off a set-list photo, or out of text a band dictated, when a band chooses to load their list that way. Receives only that photo or text, never a fan's details or any payment data. anthropic.com/legal/privacy
- Resend, Inc. — delivers the emails we send bands: your codes when you sign up, a lost code when you ask for it, and a reminder if your page still has no songs. Receives the band's email address and that message.
- Meta Platforms, Inc. — receives a page view, and a sign-up if one happens, from our two marketing pages only. Never from a band page, a fan page, an office or a payment screen, and never if your browser sends a Global Privacy Control signal. facebook.com/privacy/policy
- TikTok — the same as Meta, on the same two marketing pages only, and never when your browser sends a Global Privacy Control signal. tiktok.com/legal/privacy-policy
- The band whose page you used — sees your display name, your requests, and your email address if you gave one. Once a band exports their mailing list, that copy is theirs and is governed by what they do with it, not by this policy.
We will also disclose information if a law, subpoena or court order requires it, or to investigate fraud or a chargeback. If Crowdset were ever sold, this data would move with it and we would say so on this page before that happened.
How it's protected
- Everything travels over HTTPS. There is no unencrypted route into the site.
- Card data never enters our systems, so it cannot leak from them.
- The database is encrypted at rest by our host and is not reachable from the public internet — only from our own server code, using a credential held in the host's secret storage.
- A band's office page is protected by a private code and is not indexed or linkable without it.
- Nightly backups are written to private, access-controlled storage.
No system is perfectly secure, and we won't pretend otherwise. If we ever discover a breach affecting your information we will post it on this page and notify affected people by email where we hold one.
How long we keep it
Show records and the money ledger are kept for as long as the band's account is open, and for seven years after a payment, because payment and tax records have to be retained. Mailing list entries stay until the band or the fan removes them. Backups roll off after 30 days.
Your choices
You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Email support@crowdset.live and we'll answer within 30 days. There is no charge and we will not treat you differently for asking.
If you are in California, Colorado, Connecticut, Virginia or another state with a consumer privacy law, those rights include access, correction, deletion, portability, and the right to opt out of sale or targeted advertising. We do not sell personal information, so there is nothing there to opt out of. On targeted advertising, the only place it could apply is our two marketing pages, and you opt out by turning on Global Privacy Control in your browser — we honour it before anything loads. You can also email us and we will confirm it in writing.
To leave a band's mailing list, use the unsubscribe link in their email or write to us and we'll remove you from the list held on our side.
Children
Crowdset is not directed at children and is not intended for anyone under 13. We don't knowingly collect information from children under 13. If you believe a child has sent us information, write to us and we will delete it.
Where the data lives
Crowdset's servers and databases are in the United States. If you use it from elsewhere, your information is processed in the US.
Changes
If this policy changes, the date at the top changes with it, and material changes will be flagged on the page for at least 30 days.
Contact
Will Thompson Music, Corp — operator of Crowdset
Panama City, Florida, United States
support@crowdset.live