Privacy policy

SNEX ("we") publishes the platform at snex.show and is responsible for processing your data. For any question about your data, write to [email protected].

• Account data: name or nickname, e-mail address, profile picture (if you sign in with Google).
• Service data: projects, bookings, calendar, messages and files you choose to save.
• Billing and payment data for subscriptions, processed by our payment provider.
• Technical data: connection logs and IP address. Our server's access log records each visitor's IP address, the page requested and the browser, for security and bot detection only; it is kept ten days at most, then erased, and is never matched with your account.

We use this data to create and manage your account, provide the platform's features, process subscriptions and payments, keep the service secure and contact you about your account.

We rely on providers who process data on our behalf, in line with the GDPR:

• Supabase, database hosting and authentication (Ireland).
• Hetzner, the server that runs SNEX (Germany) and an encrypted copy of the backups (Finland).
• Cloudflare, the network in front of snex.show (address, TLS encryption, protection) and file storage.
• Stripe, payments and subscriptions.
• OVH, the site's e-mails (France).
• Google, "Sign in with Google" (if you use it).

The processors that host or process data received from Google, TikTok and Meta are listed below: processors of connected-account data.

If you sign in with Google, we receive only your name, profile picture and e-mail address, to create and identify your account. We access no other data in your Google account and use it for no other purpose.

This section describes everything SNEX does with data received from Google APIs. Nothing is read until you connect Google Calendar or a YouTube channel yourself and accept the permissions below on Google's consent screen.

Google Calendar

• calendar.readonly (read): the list of your calendars (name, color, your role) and, for the calendars you tick only, their upcoming events (the next 90 days on the first read), of which SNEX keeps only the start, the end and the title. Why: to block your SNEX time slots when your calendar is busy, so that two things never happen at the same time.
• A calendar shared with your team, only if you share it yourself from one of your activities: SNEX also reads its upcoming events and keeps their start, end, title and location, never the description or the guests. Why: to show them only to the members of the activity you gave "Voir l'agenda" (See the calendar), with the title or "Busy" as you choose. A member who connects their own Google Calendar receives them in a "… (SNEX)" calendar that SNEX creates in their account and keeps up to date.
• calendar.events (write): SNEX writes your sessions and milestones into the calendar you choose (title, times, location, note), and updates, moves or removes them when they change. SNEX never edits or deletes an event it did not create.
• calendar.app.created, requested only if you ask SNEX to create a "SNEX · …" calendar or to add a team's calendar to your Google Calendar: to create that calendar, write to it, and remove it when the access ends.
• email: the address of the connected Google account, shown so you know which account is connected.

What is stored, and for how long. The refresh token, the Google account address, the granted scopes, the list of your calendars and your choices, as long as Google Calendar is connected. The busy slots (start, end, title) of the ticked calendars: read again every 15 minutes; an event changed or cancelled in Google is changed or removed in SNEX too, and a past slot is erased the next day. The events of calendars shared with a team (start, end, title, location): read again every 15 minutes, erased one week after they end. The Google id of the events SNEX wrote, so it can update them.

Deletion. Unticking a calendar immediately erases its slots. Unsharing a calendar immediately erases its events in SNEX, and members no longer see it; a member removed from the activity, or who loses "Voir l'agenda", sees nothing more, and the "… (SNEX)" calendar created in their Google account is removed. "Déconnecter" (Disconnect), on SNEX's Google Calendar card, erases the token, the address, the list of calendars and all slots. Deleting your SNEX account erases everything, including the ids of the events SNEX wrote; those events stay in your calendar, they are yours.

YouTube

• youtube.upload (upload): at the time you chose in the post calendar, SNEX uploads the video you prepared to your channel, with the title, description and privacy status you chose. Nothing is uploaded unless you scheduled it.
• youtube.readonly (read): your channel's name, id and picture, to show "Connected to …"; and the channel's 50 latest uploads (title, description, thumbnail, date, privacy status, duration), to show them in the post calendar next to what you scheduled. This list stays ten minutes in the server's memory and is never written to the database. SNEX never edits or deletes a video and reads no comments, analytics or subscribers.

What is stored, and for how long. The refresh token (encrypted), the channel's id, name and picture, as long as it is connected. For each video SNEX published, its id and link ("Published, view"), as long as its post exists.

Deletion. "Retirer" (Remove), under Créer › Réseaux (Create › Networks), erases the channel and its token. Deleting a post erases its video's id and link (the video stays on YouTube). Deleting your SNEX account erases the channels of the activities you were the only member of, with their tokens.

Revoking access at Google

Disconnecting or removing in SNEX erases your data at SNEX; to also revoke the permission you gave SNEX at Google, go to myaccount.google.com/permissions. Without permission, SNEX can no longer read or write anything.

Who receives it

Google user data is not sold, not shared with third parties other than the technical processors below, not used for advertising, and not used to train AI models. These processors host it or carry it on SNEX's behalf and for nothing else: Supabase (database, Ireland), Hetzner (server, Germany; encrypted backup copy, Finland), Cloudflare (network and TLS encryption in front of snex.show; encrypted backups, European Union). Details: processors. No human reads it, except at your request to solve a problem, for security, or when the law requires it. The safeguards that protect it are described in data protection.

SNEX's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Nothing is read until you connect a TikTok account to a SNEX activity yourself and accept the permissions below at TikTok.

• user.info.basic: the account's id, display name and avatar, to show "Connected to …" and the account that will post.
• video.upload and video.publish: at the time you chose, SNEX uploads and publishes the video you prepared, with the caption, privacy level and settings you chose (comments, duet, stitch, branded content). Before, SNEX reads from TikTok the options allowed for that account; after, the status of the post. Nothing is posted unless you scheduled it. SNEX does not read your other videos.

What is stored, and for how long. The refresh token (encrypted), the account's id, name and avatar, as long as it is connected. For each post, its id and status, as long as the post exists.

Deletion. "Retirer" (Remove), under Créer › Réseaux, erases the account and its token; deleting a post erases what concerns it; deleting your SNEX account erases the accounts of the activities you were the only member of. You can revoke SNEX in TikTok (Settings, Security, App permissions).

Who receives it. This data is not sold, not shared with third parties other than the technical processors (Supabase, Hetzner, Cloudflare), not used for advertising, and not used to train AI models. It is protected as described in data protection.

Nothing is read until you connect an Instagram professional account or a Facebook Page to a SNEX activity yourself and accept the permissions below at Meta.

• Instagram (instagram_business_basic, instagram_business_content_publish; or instagram_basic, instagram_content_publish through the Page): the account's id, name, username, type and picture; publishing the content you scheduled; reading your published media (caption, type, date, link, image) to show it in the post calendar.
• Facebook (pages_show_list, pages_read_engagement, pages_manage_posts): the list of your Pages (name, picture, Page token); publishing to the chosen Page; reading its scheduled and published posts (text, image, link) for the post calendar. business_management, optional: listing the Pages of a Business portfolio that would not appear otherwise.
• For SNEX's own account only (instagram_manage_insights): the statistics of its own Reels (views, average watch time, shares, saves), read when the screen opens, never written to the database; and, through Business Discovery, the public Reels of thirteen professional music accounts (username, follower count, first line of the caption, duration, views, likes, comments, link) for its content watch: fifteen Reels at most, replaced every week.

Posts read this way stay ten minutes in the server's memory and are never written to the database. Nothing is published unless you scheduled it; no paid promotion unless you ask for it.

What is stored, and for how long. The access token (encrypted), the id, name, username and picture of the account or Page, as long as they are connected. When you have several Pages, their list waits for your choice fifteen minutes at most, in an encrypted cookie the browser cannot read. For each post, its id and link, as long as the post exists.

Deletion. "Retirer" (Remove), under Créer › Réseaux, erases the account and its token; removing SNEX from Instagram or Facebook, or requesting deletion of your data from Meta, erases them too; deleting your SNEX account erases the accounts of the activities you were the only member of.

Who receives it. This data is not sold, not shared with third parties other than the technical processors (Supabase, Hetzner, Cloudflare), not used for advertising, and not used to train AI models. It is protected as described in data protection.

The complete list of the providers that host or process data received from Google, TikTok and Meta. No other provider receives it.

• Supabase, Inc.: database. Stores the tokens, the connected accounts, the calendars and busy slots, the ids of published posts. Data hosted in Ireland (European Union).
• Hetzner Online GmbH: the server that runs SNEX, reads the calendars, uploads the scheduled videos and calls the APIs. Germany (Falkenstein); an encrypted copy of the backups in Finland (Helsinki).
• Cloudflare, Inc.: the network in front of snex.show (address, TLS encryption, protection), through which pages travel; file storage (the videos you prepare, the encrypted database backups), in the European Union.

The safeguards in place for data received from Google, TikTok and Meta, and for the account's other sensitive data:

• Encryption in transit: every SNEX page and API is served over HTTPS (TLS); the server's exchanges with the database, Google, TikTok and Meta are encrypted too.
• Tokens encrypted at rest: YouTube, TikTok, Instagram and Facebook tokens are encrypted by SNEX (AES-256-GCM) with a key that is not in the database, only in the server's environment. The whole database, Google Calendar token included, and its backups are encrypted at rest by our database host (AES-256).
• Restricted access: every table is closed by access rules (row-level security); data received from a platform can only be read with its account's session, or by the server. Tokens are read only by the server and never sent to the browser. Direct access to the database and the server is restricted to SNEX's publisher, with SSH keys and credentials that are not in the code.
• Encrypted backups: the database is copied every night and encrypted before it leaves the server; the key that opens these copies is not on the server. They are kept 30 nights: erased data disappears from them 30 days later at most.
• Deletion: on disconnection (Google Calendar), on "Retirer" (Remove) for a network, and on account deletion, as described for each platform above.
• Server log: IP address, page requested and browser, for security only, erased after ten days.
• Data breach: we notify the French data protection authority (CNIL) within 72 hours and the people concerned without undue delay when the risk is high (GDPR, articles 33 and 34), as well as the platform whose data is affected.

Some pages (gear, event, artist) offer a YouTube video. It first shows as a plain image, with no data sent to Google: no YouTube cookie or script loads until you click play.

From the click, the video plays from YouTube's privacy-enhanced domain (youtube-nocookie.com), which limits cookies until you sign in to the player yourself. From then on, what YouTube receives is governed by Google's privacy policy, not SNEX's.

Your data is kept as long as your account is active, then deleted or anonymized within a reasonable time after it is closed, except where the law requires it to be kept (invoicing, accounting).

You can delete your account yourself, in SNEX: Mon compte, then Supprimer mon compte (My account, Delete my account). Deletion is immediate and cannot be undone.

Destroyed: your login, your password, your public pages, your notifications, your linked devices, your connections, your Google Calendar connection, and the connected accounts of the activities you were the only member of. Kept, without your name: the invoices and cash-register records the law requires us to keep, and the messages you sent in shared conversations, which also belong to their recipients.

The steps are also described on the Delete your account page.

Under the GDPR, you have the right to access, rectify, erase, restrict, object to and port your data. To exercise them, write to [email protected]. You can also lodge a complaint with the CNIL.

We only use the cookies needed for the service to work (session, authentication). We use no advertising cookies.

When you arrive through the link of a SNEX post on a social network or of a SNEX e-mail (an address tagged utm_campaign), your browser keeps the name of that post or e-mail for thirty days, in its local storage. We count the arrival, then the sign-up if one follows, per post and per day: a number, never your identity, your IP address or your browser.

To learn what works on SNEX and what breaks, we count a few actions on the site each day: clicks on a handful of buttons (create an account, list or book a studio, claim a studio's page), the fact that a search was made in a part of the site (concerts, gear, artists, the whole site), and, when the text of a button is being tested, which of the two texts was shown and tapped. The text shown depends on the page and the day, never on you.

Each action adds 1 to a counter for the day. Nothing else is recorded: no cookie, no storage in your browser, no identifier, no IP address, no search text. Your IP address is only used to limit the number of requests, in the server's memory for ten seconds, and is never written down. We also count, once per SNEX tab in which someone touched the screen, where the visit came from (search engine, social network, direct, another site): so the same tab is not counted twice, your browser keeps an "already counted" mark in its session storage, erased when the tab is closed.

These counters contain no personal data and do not leave SNEX. An automatic report reads them every morning to find what works and what breaks: it receives only these totals. This measurement, limited to anonymous statistics for our own use, with no cross-referencing and no transfer to a third party, meets the conditions of the CNIL's consent exemption for audience measurement.

If you tick "Artiste" (artist) when you create your account, you receive at most three e-mails from [email protected], the day after you sign up and then around the fourth and tenth day, inviting you to upload a first track. They stop as soon as a track is uploaded, you reply, or you tap the unsubscribe link included in every e-mail: one click is enough. None is sent to an account of someone under 15.

Their links carry the name of the message (utm_campaign), to count arrivals per message as described above. They contain no tracking pixel: we do not know whether you open them. Legal basis: our legitimate interest in helping you get started with the space you have just opened; you can object at any time through that link.

When you click an event's ticketing link, we count that exit: the date concerned, the destination site and the time. Nothing else: not your identity, IP address or browser. This count is anonymous and only tells us which events interest the public. One exception, if you are signed in: the purchase tracking described below.

Some of these links are partner links: SNEX may earn a commission if you buy a ticket, at no change to the price you pay. These links are marked as such on the event page.

Without an account, nothing is recorded or recommended until you tap "Personnaliser" (Personalize) on Écouter; "Arrêter" (Stop) withdraws that consent and erases what was recorded.

With an account, "Pour toi" (For you) is on: you can turn it off in Compte, Réglages (Account, Settings), which also erases what was recorded, or erase everything with "Oublier" (Forget).

Date of birth. Optional, asked at sign-up or in your account: only your age band (15-17, 18-24, 25-34, 35-49, 50 and over) is used, and it is never shown. Under 15, SNEX keeps no profile data for recommendations: the date is not kept, "Pour toi" stays off and only what you do during the current visit counts. You can erase the date at any time. Time, day and device slightly influence the order, without recording anything.

What is recorded: previews played, artists opened, biographies read, your searches, videos started, how far you listen to a track, your "not for me", vendor links followed and, with an account, your favorites and purchases confirmed by the vendor. Without an account, these actions are tied to a random identifier kept in your browser, never sent to a third party, which moves to your account if you sign in. They are kept 180 days and only used for this recommendation.

Your cities. SNEX shows you concerts around the cities you go to. You can choose up to eight in "Mes villes" (My cities). If you choose none, SNEX uses the city in your account or alerts and, with an account, those of the dates you view; these cities are always shown with the mention "from your visits" or "from your account", and you can remove them: a removed city does not come back.

Approximate city from your connection. To show nearby concerts without asking for your location, our server infers an approximate city from your IP address at the time of your visit, from a free database (IP Geolocation by DB-IP, CC BY 4.0 license). Your IP address is neither stored nor used for anything else, and the city is not written to a cookie; if it is uncertain (mobile network, VPN, hosting provider), nothing is inferred. With an account, the last city inferred this way is kept 30 days. Your precise location is never requested on load: it is only sent if you tap "Autour de moi" (Near me).

Without an account. Only the city you choose is kept, in a preference cookie in your browser (13 months at most).

With an account. To recommend concerts and sounds, SNEX remembers what you do in SNEX: previews played, artists opened and followed, favorite artists, liked sounds, searches, dates viewed or saved and ticketing links followed. Each action counts less and less over time. From them we derive your genres, artists, cities, preferred venues and an idea of your budget, never taking into account what a link may earn SNEX. Everything is visible in Mes goûts et mes villes; you can remove an item, turn off "Pour toi", download your data or erase everything. Actions are kept 13 months at most, listening actions 180 days. This data is not sold, shared or sent to a third party.

On your first visit, your browser notes where you arrive from (a search, a shared link, an invitation, the app, another site, or directly). If you create an account in the following days, this indication, and only it, is added to your profile, so we know what makes SNEX known. Nothing is sent to a third party.

Each link to a vendor (tickets, gear, software, records) carries a random click number. The vendor returns it to SNEX with the sale, without ever knowing your identity: it only receives that number.

If you are signed in, SNEX links that number to your account. When the vendor confirms a purchase, it appears in Achats (Purchases), under "Achats par SNEX": the vendor, the date and what was bought. A ticket goes into your calendar and a reminder is sent the day before. We receive neither the price paid, nor your payment details, nor your address.

You can turn this tracking off at any time from the same place. The links already made between your clicks and your account are then erased; dates already added to your calendar stay there, you can remove them yourself. Deleting your account also erases these links.

On a gear or artist page, you can ask for an alert: when the price drops, or when the artist announces a concert near the city you enter. We store the e-mail address, the subject of the alert, the city and the date of each sending. No account is created.

With a concert alert, an optional box, unticked by default, adds a Thursday letter with the weekend's concerts and new dates around that city. We note the date you asked for it; it is only sent after confirmation by e-mail.

Nothing is sent before you confirm through the link you receive. Each alert contains a one-click unsubscribe link; the address stays marked as unsubscribed so the alert does not start again. Links to vendors are partner links: the price does not change. To have your alerts erased, write to [email protected].

For any question about this policy: [email protected].