Privacy
Privacy policy
This policy covers www.symphonicbase.com, operated as SymphonicBase. It describes what we store and why. Last updated 2 October 2026.
Reading a programme
You can read a published programme without an account. Delivering the page means the server receives the usual technical data of a request, including IP address and browser type. The site is served through Cloudflare, which may process that technical data and set a cookie to limit abusive traffic.
Concert statistics
When a published programme is opened, we store an event on our own server: which programme, whether it was an open or a click on a control, the language, the path, the referrer, the browser's user-agent, and the time. Organisers see totals, so they know whether audiences opened the page. The event is not attached to an account. We do not ask you to sign in to be counted.
Accounts
If you register, we store your email address, a hash of your password (not the password itself), and any name or phone number you choose to add. A signed-in session is an httpOnly cookie named sb_session. It lasts up to 14 days and is marked secure on the public site.
Passkeys
You may register a passkey for sign-in. We store the public key credential for that authenticator. We do not receive your fingerprint, face image, or device PIN. Those stay on your device.
Messages you send us
The contact form stores the email address and the message, so we can reply. A band application stores the ensemble name, contact name, email, phone, website, social link, and message. Forms may include a Cloudflare Turnstile check. Turnstile receives a token and may process your IP address to distinguish a person from a script.
Email left on a concert page
If a programme offers a subscribe field and you use it, we store that email address against the programme. It is visible to SymphonicBase administrators and is used only in connection with that programme. Leaving an address does not create an account. If you later register with the same address, the account and the subscription stay separate records.
Advertising
Concert pages that carry a real programme may load one Google AdSense unit (publisher ca-pub-9881754227153394). The unit is labelled Advertisement. Google may set cookies and use them to serve and measure ads, including ads related to your activity on this and other sites, according to your Google ad settings. Login, account, and draft pages do not carry an ad unit.
How Google uses data in advertising
Google Analytics
We use Google Analytics, measurement ID G-TK0LXHCFF5, to see which pages are used. Google Analytics sets cookies and receives usage data such as pages viewed and a client identifier.
Google Analytics opt-out add-on
How long we keep it, and who else sees it
Account details stay while the account exists. Enquiry and application messages stay so we can answer them and keep a record of the request. A subscription address stays until you ask us to remove it or the programme is deleted. Concert statistics stay as the history of that programme. You can ask us to delete an account, a message, or a subscription address through the contact form. If you are in Hong Kong, the Personal Data (Privacy) Ordinance may also give you a right to request access or correction.
We do not sell personal information. We pass data to Google and Cloudflare only so advertising, analytics, the human-check on forms, and network protection can run. We may disclose information if the law requires it.
Children
The site is a concert-programme service for general audiences. It is not directed at children under 13, and we do not knowingly collect their personal information.
If this policy changes, the date at the top of this page changes with it.