Privacy

Privacy Statement

Last updated 16 June 2026  ·  Publisher nalolabs (be.nalolabs)  ·  Applies to all nalolabs apps, including StageCrawlr
The short version
On-device by default. Without an account, your notes, ratings and lists stay on your phone — we have no access to them.
Sign-in is optional. If you do, only your email address and show attendance records are stored — nothing else. Even with full access to our data, all anyone sees is a list of shows.
We never sell your data — and there are no ads, analytics, or tracking SDKs in our apps.
No location, no contacts, no camera or mic. See §3.3 for everything we don't collect.

01 Who we are

nalolabs ("we", "us", "our") is an independent app studio based in Belgium. We build apps for people who care about music, live events, and personal experiences — StageCrawlr among them.

For the purposes of the EU General Data Protection Regulation (GDPR), nalolabs is the data controller for personal data processed through our apps. Contact: privacy@nalolabs.be.

02 What this policy covers

This policy applies to all apps published by nalolabs. Where a specific app collects data beyond what's described here, a supplementary in-app notice makes that clear before any data is collected.

StageCrawlr, specifically: the app retrieves artists, venues and setlists from the setlist.fm API — your search request (e.g. an artist name) is sent so results can come back, but never your diary or identity. The "I'm here!" check-in is a manual tap; StageCrawlr does not use your device location (see §3.3). StageCrawlr is independent and not affiliated with setlist.fm.

03 What data we collect and why

3.1 — Data you provide directly

Depending on the app, this may include:

  • A display name or username you choose
  • User-generated content — notes, ratings, annotations and lists (in StageCrawlr: your diary, show ratings, notes and starred songs)
  • Preferences and settings you configure

This data powers the core features of the app. In apps with no account or cloud sync, it stays entirely on your device — we have no access to it.

3.2 — Data collected when you sign in

When you optionally sign in (via Google), we collect only the minimum needed to link your show data to your account:

  • Your email address — used solely for authentication and to associate your diary with your account
  • Your show attendance records — which shows you've logged, with dates and venues

That's it. We don't store your name, profile photo, listening habits, or any other personal detail. If someone were to gain access to our data, they would only see a list of shows attended — nothing more. Sign-in is always optional — the app works fully without an account. Signing out never deletes your local data.

3.3 — Data we do not collect

We do not collect, request, or access:

  • Your physical location (precise or approximate)
  • Your contacts or address book
  • Payment card details (handled entirely by the platform's payment system)
  • Microphone, camera, or media files
  • Browsing history or installed apps
  • Any data from children under 13

3.4 — No analytics or advertising SDKs

Our apps do not include analytics SDKs, advertising SDKs, or crash-reporting SDKs that send data to third parties. We do not track you across apps or websites.

04 How we use your data

We use your data only for:

  • App functionality — delivering the features you use
  • Account management — linking your email to your show data for sync and continuity across devices
  • Service communication — essential notices about your account or the app
  • Security — detecting and preventing abuse

We do not use your data to build advertising profiles, make inferences about sensitive characteristics, or make automated decisions with significant effects on you.

05 How we share data

5.1 — We do not sell personal data. Ever.

5.2 — Infrastructure providers

We use the following third-party services to operate our apps. These providers act as data processors under our instruction and do not use your data for their own purposes:

Service
Role
Firebase (Google)
Authentication, cloud storage, push notifications — where applicable per app
Google Play
App distribution and payment processing
setlist.fm (StageCrawlr)
Retrieving artists, venues and setlists relevant to the app's purpose

5.3 — Commercial partners

Where an app lets commercial partners (such as event organisers or content creators) reach users through the platform, our commitment is:

  • Partners never receive personal data. No names, email addresses, or device identifiers are shared.
  • Analytics are aggregate and anonymised. Partners see numbers, not individuals; segments below a minimum size are suppressed.
  • Messages are delivered by us. A partner composes content; we deliver it. The partner never sees who received it.
  • You control who can reach you. Any partner-initiated communication requires your explicit opt-in, withdrawable any time in settings.

This is a core principle that will not change without prominent prior notice and your explicit consent.

5.4 — Legal requirements

We may share data when required by law, to protect our legal rights, or in the event of a merger or acquisition — in which case this policy continues to apply.

06 Deleting your data

  • On-device data: clear it from within the app (Settings → Clear data) or uninstall the app.
  • Cloud data and account (where applicable): delete your account from within the app (Settings → Delete account). This permanently removes all associated cloud data.
  • By request: email privacy@nalolabs.be with the subject Data Deletion Request. We confirm deletion within 30 days.

07 Data retention

Data type
Retention
On-device data
Until you clear it or uninstall the app
Email address
Until account deletion
Show attendance records (cloud)
Until you delete your account or request deletion
Aggregate partner analytics
Retained anonymised; not linked to individuals

When you delete your account, personal data in our cloud is permanently deleted within 30 days.

08 Your rights under GDPR

If you are in the European Economic Area (EEA), you have the right to:

  • Access — request a copy of your personal data
  • Rectification — ask us to correct inaccurate data
  • Erasure — ask us to delete your data
  • Portability — receive your data in a portable, machine-readable format
  • Restriction — ask us to limit how we process your data
  • Object — object to processing based on legitimate interests
  • Withdraw consent — for processing based on consent (e.g. notifications), any time, without affecting prior processing

Contact privacy@nalolabs.be to exercise any of these rights; we respond within 30 days. To lodge a complaint, contact the Belgian Data Protection Authority: www.dataprotectionauthority.be.

Legal bases for processing (GDPR Article 6)

Processing activity
Legal basis
Core app functionality
Contract
Cloud sync
Contract
Push notifications
Consent
Community / social features
Consent
Aggregate partner analytics
Legitimate interests (anonymised data is outside GDPR scope)

09 Security

We apply measures appropriate to the risk:

  • All data in transit is encrypted (TLS)
  • Cloud data is protected by security rules that restrict access to the account owner
  • No personal data is logged in production builds
  • Local sensitive data uses Android Keystore encryption where applicable

To report a security issue: privacy@nalolabs.be.

10 Children's privacy

Our apps are not directed at children under 13, and we do not knowingly collect data from children under 13. If you believe a child has provided us with personal data, contact us and we'll delete it promptly.

11 Changes to this policy

Material changes — particularly to how we share data — are communicated via in-app notice at least 30 days before taking effect. Minor clarifications are reflected in the "last updated" date above.

12 Contact

For GDPR requests, use the subject line: GDPR Request — [request type].