Privacy Policy

eResonate ("we", "us") operates the eResonate live-music social network, on the website at eresonate.com and in the eResonate app for iPhone and iPad. This policy explains what we collect, why, and the choices you have. We designed the network to collect as little as possible. eResonate is only for people aged 18 and over.

1. Information We Collect

• Account information you provide: display name, email address, account type (fan, band, or venue), genre, and any profile details you add (bio, location, photo). If you sign in with Apple or Google, we receive the name and email address they share with us.
• Content you create: posts, comments, group memberships, messages, and connections, and the reports, appeals and removal requests you send us.
• Age and consent records: whether you are 18 or over, how that was established, which regional rule applied, your country and region, the App Store country, when it was checked, and which versions of our Terms you accepted and when. We never store your date of birth or your age range (section 4).
• Technical data: basic request metadata (such as IP address) used for security, rate limits and abuse prevention. For each device where you are signed in, we keep the type of device and browser and an approximate city and country worked out from the IP address, so you can see where you are signed in and sign a device out.
• App data, only if you use the app: an App Attest key for your install, a DeviceCheck token, and crash and performance diagnostics (section 7).

We do not ask for or store passwords. We do not sell your personal information.

2. How We Use It

• To operate your account and the network: showing your posts, delivering your messages, running groups.
• To keep the network safe: rate limiting, spam and abuse prevention, the automated checks in section 5, and handling reports.
• To keep eResonate for adults only and to meet the age laws where you live. We use your age record for nothing else.
• To review reports, enforce our rules, handle appeals, and meet legal duties such as removing intimate images within 48 hours and reporting child sexual exploitation (section 6).
• To contact you about the service (for example, product updates you opted into).
• To report performed works to music-rights societies. If you are an artist or venue that streams a show, the setlist you file and the venue's confirmation of it are shared with performing-rights organizations and other rights-management agencies so songwriters and publishers can be paid. This covers the show and the works performed; it is not used for advertising.

3. Advertising

eResonate is funded by advertising sold across the platform. Our ad system uses first-party context (such as the genre or city of the content you're viewing) to select which ads to show, not cross-site tracking cookies or the sale of your personal data.

4. Adults Only: How We Check Age

eResonate is only for people aged 18 and over. We do not knowingly let anyone under 18 use it, and we do not knowingly collect personal information from children.

• In the app, we ask Apple for your age range through Declared Age Range when you first open the app, and again on later launches until an answer is held. You choose whether to share it. The app learns only whether you are 18 or over and how that age was established (declared by you, declared by a guardian, or confirmed by Apple). It sends that to our server signed with App Attest (section 7). When you are creating an account and the answer is under 18, the app stops and sends us nothing. When you already have an account, an under-18 answer is sent to us so we can suspend the account until an adult age is confirmed.
• Date of birth. If your device gives no age range, in the United States and Canada the app may ask for your date of birth instead, and the website asks for it when you create an account. We use it once to work out whether you are 18 or over and never store it. If the answer is under 18, no account is created, and to stop repeated guesses the same app install or network cannot try again for 24 hours. For that we keep a short-lived record of the install or network, not of the date.
• Where the law requires a confirmed age, such as in the United Kingdom and some US states, we accept only an age that Apple has confirmed or that an age-check provider has verified. We do not work with an age-check provider yet, so the website cannot open accounts in those places. Where the App Store reports that a state requires its age signal, the app relies on that signal.
• Accounts made before we asked about age are asked to confirm their age once.

If someone is under 18. If an existing account tells us its owner is under 18, we suspend it until an adult age is confirmed by Apple or reviewed by our team. If we learn that an account belongs to a child under 13, we delete it and everything in it, including the messages it sent, unless the age turns out to be a mistake. If you believe a child is using eResonate, report the account with the reason "This person may be under 18", or write to privacy@eresonate.com. A report alone never suspends an account: a person on our team reviews it, and if it shows the owner is under 18, suspends the account until an adult age is confirmed.

5. Automated Safety Checks

Text. What you write for others to see or receive (your profile, posts, comments, direct messages, group chat, group, page and show details, and invitations) is checked against lists of words and phrases our team maintains, after the text is normalised so that, for example, look-alike letters and numbers are read as the letters they stand for. This is a keyword check only. No machine-learning system and no outside company reads your messages for it. Depending on the list a match is on, the text is stopped, posted and queued for a person on our team to look at, or only counted. When text is stopped, you see that an automated check stopped it, and you can edit it or ask a person to review the decision. For each match we record when and where it happened, the kind of match, and up to 200 characters of the text.

Images. Every image uploaded to eResonate since this policy took effect on 20 October 2026 (profile photos and banners, post photos, group images, photos in group chat, and link-preview pictures) is checked before anyone else can see it:

• against a list of digital fingerprints (hashes) of images our team has removed as child sexual abuse material or intimate-image abuse; and
• by Microsoft's PhotoDNA Cloud Service, once it is in use on eResonate. PhotoDNA compares the image with fingerprints of known child sexual abuse material, and the image is sent to Microsoft for this check only.

A matching image is never published. If the check cannot run, the image waits, unpublished, until it can. A match with known child sexual abuse material closes the account and preserves evidence (section 6), and our team reviews every such case.

Images stored before then are checked in the background against the same list of fingerprints. Once PhotoDNA is in use, stored images that it has not yet checked are also checked by it in the background.

On your iPhone or iPad. If you have turned on Sensitive Content Warnings in iOS, the app uses Apple's on-device analysis to blur images that may contain nudity until you tap them. This happens on your device and nothing about it is sent to us.

Decisions made automatically. An automated check can stop text from being posted, keep an image from being published, close an account whose upload matches known child sexual abuse material, suspend an account whose owner gives an age under 18, and, for some serious reports, hide the reported item until a person reviews it. You can ask a person to review any of these decisions through our appeals page, from the notice we send you, or from Your reports in the app. Your data download lists the automated decisions made about what you wrote.

6. Reports, Moderation and Evidence

• Reports. When you report something we keep your report, what was reported, a copy of what you saw (so it survives deletion), and your contact address if you gave one. We do not tell the reported person who reported them.
• Review. Our team can see reported content, the reported account and the activity around it, to decide what to do. Decisions are logged.
• Removed images. When we remove an image it stops being served, and a private copy is kept for up to 180 days so the decision can be appealed or reversed. It is then deleted, unless the case is still open, a legal hold applies, or it is evidence.
• Child sexual exploitation. When content appears to involve child sexual abuse or exploitation, we preserve it with related account records (account details, sign-in records and related messages) in a restricted evidence store. Only authorised staff can open it, and every access is logged. When the material is confirmed, we keep it for at least one year, as US law requires, and report it to NCMEC's CyberTipline, which may make it available to law enforcement. If a report is not confirmed, the preserved copy is released.
• Intimate-image requests. We keep the request (the typed name, contact details, the locations and the statement), our decision, and fingerprints of removed images so copies cannot be uploaded again. The person who posted the image is told it was removed, without the requester's details.
• Appeals and complaints. We keep what you send us and our decision.

7. The eResonate App

• An account is required. Without one, the app shows only sign-in, account creation, Help & Safety, our legal pages and the intimate-image removal form.
• App Attest. The app uses Apple's App Attest to prove to our server that sign-ups and some other requests come from a genuine copy of the app. We keep a key identifier and public key for each install, the account it was used with, and when it was used, and delete them when you delete your account. To limit how many accounts one install can create, we also keep a one-way fingerprint of the install key and the time an account was created through the app, with no link to the account, for 31 days.
• DeviceCheck. Apple's DeviceCheck lets us set two markers that Apple keeps for each device: one recording that an account was created through the app on that device this month, and one recording that the device was used by an account closed for child sexual exploitation. The markers do not tell us who you are, and they stay with the device if the app or the account is deleted. We keep the latest DeviceCheck token the app sent with your account and delete it when you delete your account.
• Diagnostics. When the app crashes, hangs or runs slowly, iOS gives the app a diagnostic report (MetricKit), which the app sends to us with a random install identifier, the app version, the iOS version and the device model. After a call, the app sends a short quality summary: the type of connection, round-trip time, packet loss, how long the call lasted and, if it failed, why. When you are signed in, these are linked to your account. We use them only to fix problems and keep them for 30 days.
• Anonymous usage. Off unless you turn on Share anonymous usage in the app's settings. When it is on, the app tells Plausible Analytics which screens are opened and a few actions, such as signing up, sending a message or filing a report, with no account, device or advertising identifier. Our website also uses Plausible to count visits and a few actions, such as sending a report. Plausible does not use cookies.
• Permissions. The app asks for your camera, microphone or other device access only when you use a feature that needs it. You can change this at any time in iOS Settings.
• No tracking. The app contains no advertising or tracking software from other companies and does not track you across other companies' apps or websites.

8. Who We Share Data With

We do not sell your personal information or share it for advertising. We use these service providers, each only to run the part of eResonate named:

• Cloudflare: hosting, storage, live video and the network.
• Resend: sending email.
• Twilio: text messages (section 10).
• Apple: Sign in with Apple, App Attest, DeviceCheck and the age range, when you use them.
• Google: Sign in with Google, when you choose it.
• Microsoft: PhotoDNA image matching, once it is in use (section 5).
• Plausible Analytics: anonymous usage counts (section 7).
• Netlify: hosting the eresonate.com website, which means it receives your IP address and browser details when you load a page.
• Google Fonts: delivering the fonts our web pages use, which means Google receives your IP address and browser details when a page loads.
• Embedded players: YouTube (in its privacy-enhanced mode), Vimeo, Spotify, Apple Music, Tidal, SoundCloud and Bandcamp, only on pages that show a video or a track from them. Loading the player sends your IP address and browser details to that service, under its own privacy policy.

We also share information with NCMEC and law enforcement as section 6 describes and as the law requires, and setlist and performance data with music-rights organisations as section 2 describes. Copies of some service emails we send you, such as notifications and confirmations but never sign-in links or codes, also go to our team's mailbox so we can answer questions about them.

9. Your Data, Your Control

You can, at any time, in Settings on the website or in the app:

• Export your data. Download everything tied to your account, including your age record (the result and how it was checked, never more), the versions of our Terms you accepted, the reports, appeals and removal requests you filed and what became of them, the automated decisions made about what you wrote, any of your content our team removed, and how many app installs and diagnostic reports are linked to your account.
• Delete your account. Permanently erase your account, profile, posts, comments, messages, connections and follows. In the app, you see what is deleted and what is kept before you confirm. If you used Sign in with Apple in the app, we also revoke eResonate's access to your Apple Account; if you used it only on the website, Delete Your Account explains how to remove that access yourself.

When you delete your account, these are kept:

• the other person's copy of direct messages you exchanged, shown as from "Former member", so the person you wrote to keeps their own conversation (not when we delete the account of a child under 13);
• photos, voice notes and files you shared in a group, which are taken down at once and kept privately for one year, so that a report, a dispute or a legal request can still be answered, and are then deleted;
• reports you filed, without your name;
• show agreements you signed, as legal and rights records;
• booking requests you sent to a venue, without your contact details;
• legal, safety and finance records, such as preserved evidence and records of removed content;
• if you bought anything through the App Store, Apple's own purchase records.

A legal hold can delay a deletion; if one does, we tell you, and privacy@eresonate.com can explain. Delete Your Account has the steps.

If you are in a jurisdiction with data-protection rights (such as the EU/UK under GDPR, or California under CCPA), these tools satisfy your rights to access and erasure. You can also ask a person to review an automated decision (section 5). For any other request, contact us at privacy@eresonate.com.

10. Text Messages

If you add a mobile number to your account we use it for two things and nothing else: to confirm the number is yours with a one-time code, and to send the notifications you switched on (alerts about shows you follow, and sign-in codes when you ask for one). The number is never shown on your profile and nobody can find you by it.

We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. Your number is passed only to our messaging provider, Twilio, for the sole purpose of delivering those messages on behalf of eResonate Media Corporation.

Texts are off unless you turn them on, in Settings & Privacy › Email & notifications, and only after the number is confirmed. Show alerts by text explains the program in full. Reply STOP to any message, switch them off in Settings, or remove the number, and they stop. Msg & data rates may apply.

11. Data Retention & Security

We retain your data while your account is active and delete it when you delete your account, except as section 9 describes. Some records have their own periods:

• Records of the devices where you are signed in: until 90 days after the device was last used.
• App diagnostics: 30 days.
• Images our team removed or a check stopped: up to 180 days, then deleted, unless a case is open, a legal hold applies, or they are evidence.
• Photos, voice notes and files shared in groups: one year after they are deleted, then removed.
• Evidence of child sexual exploitation: at least one year once confirmed, and longer when a legal hold or the law requires.
• The lock after an under-18 date of birth: 24 hours.
• Records of automated text checks: while your account exists. When you delete your account, your name and the text excerpt are removed and only the counts remain.
• Reports, moderation records, appeals and removal requests: kept as safety records, without your name once you delete your account.

Data is stored on Cloudflare's infrastructure. Session tokens and recovery codes are stored only as one-way hashes. No system is perfectly secure, but we limit what we collect and restrict access to it.

12. Changes

We'll post any changes here and update the date and version above. Continued use after a change means you accept the updated policy.