Privacy Policy

The short version

• Thespiary is a hobby project run by one person. It does not sell your data, show you ads, or track you across the web.
• Your attendance log, your ratings, your reviews and your notes are private by default. You choose, per entry, what becomes public.
• Facts you contribute to the shared archive - shows, productions, who performed in what - are public and stay public, without your name on them.
• Playbill scans you upload are yours alone. Nobody else on Thespiary can see them, and they are never published.
• We send a copy of each playbill page you upload to an outside service to read the credits out of it. Your uploads are also held by the services that store and back up our files (section 4). They are never shown to anyone else.
• You can export what you wrote and created on Thespiary, and you can delete your account.

1. Who we are

Thespiary is operated by Ryan Brooks, an individual in Missouri, United States, who decides what is done with your data. There is no company, no staff, and no third-party analytics. For anything in this policy, write to privacy@thespiary.com.

2. What we collect, and why

We collect what a feature needs and nothing else. Where a field is optional, it is genuinely optional - leaving it blank does not break anything.

2.1 Your account

Your email address is encrypted at rest. We store it as ciphertext, plus a one-way keyed hash used to find your account when you sign in. The hash is designed so it cannot be turned back into your address. These are safeguards we take on a best-effort basis, not a guarantee.

The account record also has columns for a language, a time zone, preferred production types and a profile picture. Nothing in the site sets them, so they are empty. When you last used the site is recorded on your sessions (2.5), not on your account.

2.2 What you log

When you record a performance you attended, we store what you tell us: which performance, and optionally your seat, what you paid, private notes, a star rating, a review, tags, a spoiler flag, and who you went with.

Companions can be tagged as other Thespiary users, or just typed in as a name - in which case that name is personal data about someone who is not our user, so please be considerate about what you type.

We also keep previous versions of your reviews and discussion posts for 90 days, so that one edited after someone complained about it can still be looked at by a moderator. A daily job then deletes them.

Your wishlist - what you want to see, its priority, notes, an optional reminder date - is stored the same way, and is private.

2.3 Playbills you upload

We store the image files, their size and dimensions, and the raw text the extraction step produced from them. Files are kept in the object storage described in section 4.

We strip metadata from every image on upload. Photos often carry the GPS coordinates and camera details of where they were taken. We re-encode the image without any of it before storing it. The file you send sits on our server only for the moment it takes to do that, and the extraction service only ever receives the cleaned copy.

2.4 Notifications

We keep the notifications we have sent you, whether you have read them, and your per-event preferences for in-app and email delivery.

2.5 Signing in

• Sessions. When you sign in we store a one-way hash of your session token - never the token itself - with the times it was created, last used, and expires.
• Sign-in links. A hash of the link token, which email it was for (stored encrypted), and when it expires or was used. The record is deleted a day after that.
• Email changes. The new address (encrypted) and the hashes of the confirmation tokens. The address is cleared as soon as the change completes, is canceled or lapses, and the record itself is deleted 30 days later.
• External sign-in, if you are a moderator or admin who signs in through an identity provider: which provider, your subject identifier there, and when you last used it.

The database has columns for a hashed IP address and browser fingerprint on each session. They are never filled in. No code writes them.

2.6 API keys

If you register for an API key we ask for your email address and a description of what you plan to use it for. We email that address once, with a link that works once and for one hour; opening the link makes the key and shows it to you.

We keep the address, encrypted in the same way as account email addresses. Alongside it we store a one-way hash of it (used to limit how many keys one address can ask for), a hash of the key, its first few characters, and the description.

We use the address only to write to you about your key or the API (for example, before an API version is retired), to look into abuse of the API, and to answer a legal demand we cannot refuse. Only admins can read it, and each time it is read is recorded. It is deleted 90 days after your last key is revoked, or sooner if you ask at privacy@thespiary.com, which also revokes your keys.

2.7 Technical data

• Your IP address is used to count requests. Sign-in requests and API-key registrations are throttled per IP per hour. The counter lives in a cache with a short expiry and is not written to the database.
• The application logs one line per request: the method, the name of the route (not the address you actually asked for, so no tokens or search terms), and the status code. It does not log IP addresses, raw paths, query strings, request bodies or headers. The server's own access log, which did record paths and IP addresses, is switched off.

These logs rotate by size, not by age: each service keeps at most three files of 10 MB, so how far back they go depends on how busy the site is.

2.8 What we do not collect

No advertising identifiers. No third-party analytics. No tracking pixels in our emails. No cross-site tracking. No behavioral profiling. No location beyond the city you type in yourself.

Your city is stored for suggesting things near you and nothing else. It is not shown to other users, is not returned by the public API and does not appear in data dumps.

3. Who can see it

3.1 Your log is private by default

Every visibility setting on a new entry starts at private.

You can set your attendance, your rating and your review each to one of three levels: private, friends, or public.

• Private - only you.
• Friends - you and people you are mutually connected to.
• Public - anyone on the internet, signed in or not.

3.2 What "public" actually exposes

If you mark a review public, it appears on that production's page to anyone, with your display name, the venue, and the date and time of the performance you attended. Your star rating appears alongside it only if you also marked the rating public.

Be aware of what that implies: a public review tells people you were in a particular building on a particular evening.

Public star ratings are also counted into a production's average score, which is only shown once at least five people have rated it.

3.3 What is never shown to anyone else

Your seat, what you paid, your private notes and your wishlist are not served to any other user by any part of the site today. They appear only in your own view and in your data export.

Your companions are private unless you set their visibility to friends. If you do, your friends can see them on your profile and in the feed.

Your playbill scans are served only to you, by an endpoint that checks you own the file before it hands it over.

3.4 Moderators and admins

Moderators can see content that has been reported, and previous versions of a review that was edited. We run the server ourselves, so we can technically reach anything in the database - that is inherent in self-hosting, and we would rather say so than imply otherwise.

Moderation records identify you by a stable pseudonym rather than your user ID, so that when your account is deleted the record can survive without pointing at you.

3.5 The public API and open data

Anyone can register a free API key and read the shared archive. There is also a public data dump that needs no key at all.

Neither contains anything from your account or your log. The dump is built from eight collections: shows, productions, production venue stops, venues, performances, persons, cast credits and crew credits.

They do contain personal data about performers and crew, most of whom are not Thespiary users. The persons collection carries each person's name and the public details we hold for them: biography, official statement, website and Actors' Equity status. The credits say who appeared in what. This is public information about public work, but it is information about real people, and we say so. A performer who wants their profile hidden can write to privacy@thespiary.com; we can then hide it, and it disappears from the API and from all future dumps.

• Your attendance and your reviews are never in a dump, at any visibility setting, and are not reachable through the public API.
• Credits you contribute are - that is the point of the archive - but without your name. Contributor attribution is stored internally and is not published.
• Playbill images, the raw extraction output, and storage keys are never in a dump.
• A performer whose profile is hidden is excluded from dumps and from the API entirely, as though they did not exist.

See the open data license notice on the terms page.

4. Who else handles your data

We use as few outside services as we can. Each one gets only what it needs.

Thespiary is run from the United States, and your data is stored and processed there. The one exception is our encrypted off-site backups, which are kept with Hetzner in the European Union.

On the extraction step, specifically: each page is sent to Anthropic over the network. What Anthropic does with it afterwards is governed by Anthropic's terms, not ours.

We do not sell, rent, or share your personal data with anyone else. The only other circumstance in which we would hand it over is a legal obligation we cannot refuse.

5. How long we keep it

These limits are enforced by scheduled jobs that run daily. Everything in this table that belongs to your account is destroyed by account deletion too, apart from the things listed in 6.2.

6. Your rights

6.1 Get a copy of everything

Ask for an export from your account settings. We build a ZIP with an HTML file you can open in a browser and a JSON file for machines, then email you a download link. The link works once and expires after 7 days.

The export contains your account details (including your email address in readable form), your full attendance history with notes and companions, your wishlist, who you follow, everything you have contributed to the archive, your discussion posts, the reactions and likes you gave, the earlier versions of your reviews and posts that we still hold, your playbill uploads (their details, and the processed files up to a total of 200 MB; anything beyond that is listed so you can ask for it), the API keys registered with your email address (dates and tier only, never the key), your profile claims, the appeals you filed and the reports you raised, your notifications and preferences, and a log of your sessions and linked sign-in providers.

It does not contain other people's data, the moderation records held about you (sanctions, flags against you, internal notes), or audit records. Those are internal records.

6.2 Delete your account

Ask from your account settings. Immediately: your profile and content are hidden and you cannot use the site. After 30 days, everything is erased for good. Within those 30 days you can sign in - but only onto a screen that lets you cancel the deletion and nothing else.

When the 30 days are up we hard-delete your account, your entire log, your reviews and their history, your wishlist, your follows and blocks, your notifications, your playbills, and the image files themselves, off our disk and out of the object store.

Some things survive, by design:

• Facts you contributed to the archive - the shows, productions, venues, people and credits - stay, because other people's records depend on them. Your name is removed from them: the "contributed by" link is set to nothing.
• Discussion posts stay in place so threads still make sense, but the text is replaced with "[Deleted]" and the author with nobody.
• A record that your account was erased. So that a restored backup can be cleaned again (section 9), we keep an entry saying that an erasure happened. It holds your pseudonym, not your email or name, and a list of the archive records you contributed, by id. We delete it 13 months after the erasure.
• Moderation records about you. The audit event stays, under the pseudonym described in 3.4, and names your account only by that pseudonym. The detail attached to it (reasons, before and after states) is stripped of your identity when you are erased and removed on the schedule in section 5.
• Backups, until they age out (section 9).

Things other people wrote that mention you, such as their own reviews or a companion name they typed in, are theirs and stay.

Deleting immediately. If you do not want to wait 30 days, you can delete your account at once from the account page. You must have signed in within the last 15 minutes, and you type a confirmation phrase, because it cannot be undone. You are signed out straight away and your data is erased within minutes. If a moderation case is open against your account, the normal 30-day period applies instead, so a moderator has time to act; you are told so, and you can still cancel during that time.

You can also delete a single playbill without closing your account, from "My uploads" on the upload page. The scan and the text extracted from it are removed for good. Credits you already submitted from it stay in the shared archive, for the reason given above, with the link back to the scan cleared.

If you upload a Playbill and do not review it, we delete it after 60 days. We email you two weeks before, and reviewing it in that time keeps it.

6.3 Correct something that is wrong

You can change your email address yourself, and it is deliberately awkward: we confirm with your old address first, and only then send a link to the new one. Both addresses are told when it completes.

Your display name, bio and city are yours to change whenever you like, from the Profile section of your account settings. Nothing is reviewed and nothing waits: the change is live as soon as you save it.

Your country is the one profile field with no screen behind it. Write to privacy@thespiary.com and we will set or clear it for you.

If you think a moderation decision about you is wrong, appeal it - see the terms.

6.4 Ask us to pause, or object

You can ask us to stop processing your data while a dispute is being worked out, and you can object to us keeping moderation records about you on legitimate-interest grounds. Both are handled by hand, at privacy@thespiary.com. There is no automated flow, and given the size of this project there is not likely to be one.

6.5 Complain

If you are unhappy with how we have handled your data you can complain to the relevant authorities. You do not have to raise it with us first, though we would rather you did.

7. Cookies

We use three cookies and they are all strictly necessary:

• your session, so you stay signed in;
• a CSRF token, so a malicious site cannot act as you;
• during an external sign-in, a short-lived cookie holding the state of that sign-in.

There are no advertising cookies, no analytics cookies, and no third-party scripts. That is why you are not being asked to click a cookie banner: there is nothing optional to consent to.

If that ever changes, we will ask before setting anything non-essential.

8. Children

You must be at least 13 to have a Thespiary account. If you are under 13 you may not create one. We do not knowingly collect data from children under 13. There is no age check at signup - we do not ask your age, and creating an account is your confirmation that you are at least 13 - and if we find out an account belongs to someone under 13, we delete it and purge the data the same way as any other deletion. The terms say the same.

9. Backups can hold data we have erased

Backups exist so that a disk failure does not destroy the archive. They are snapshots of the database and the uploaded files at a point in time, and a snapshot taken before you deleted your account still has your data in it.

We do not reach into old backups to remove one person's records - doing so reliably is not realistic, and a partly-rewritten backup is not a backup. Your data therefore persists in them until they age out:

• the backups kept on our own server are deleted after 14 days;
• the encrypted off-site archives are kept as 14 daily, 8 weekly and 12 monthly archives, so a deleted account can remain in the oldest monthly archive for about 12 months.

If we ever have to restore from a backup, we replay the record of completed erasures (6.2) over the restored database, and the site stays closed - it answers only its health check - until that has been done. A deletion you asked for does not come back to life because of a restore. We keep that record for 13 months, a month longer than the oldest backup, so it always covers the backups that could still hold you.

10. Published data dumps cannot be recalled

Once a dated data dump is downloaded by someone, it exists on their computer and we have no way to change it.

• Deleting your account removes your contributions' attribution from all future dumps.
• A performer who hides their profile disappears from all future dumps immediately.
• Dumps we published in the past stay as they were published, wherever copies of them have gone.

Since dumps never contain attendance, reviews, or the names of contributors, what is at stake here is the archive's factual records, including the public details of performers (3.5) - not your personal log. We disclose it anyway, because it is a genuine limit on erasure.

11. How we protect it

• HTTPS everywhere, with HSTS.
• No passwords exist to be stolen, from us or from you.
• Your email address is encrypted in the database; session, sign-in and download tokens are stored only as one-way hashes; API keys the same.
• Sessions expire on their own, and can be revoked instantly.
• A strict Content-Security-Policy that permits no inline or third-party scripts.
• Uploaded images are re-encoded before storage, which strips metadata and defuses malformed files.
• The application runs against the database with reduced privileges; it cannot alter the moderation audit log.

No system is perfectly secure, and this one is maintained by one person in their spare time. We are telling you what we do, not promising it is enough.

12. If something goes wrong

If we discover a breach affecting personal data we will tell affected users within 72 hours of finding out, by email and in-app notification. We will say what happened, what data was involved, what we are doing, and what you should do. We will notify the relevant authorities where the law requires it, and disclose publicly if a lot of people are affected.

13. Changes to this policy

This policy is versioned. The current version is at the top of this page.

If we change something material - how your data is used, who it is shared with, or how long it is kept - we will ask you to agree again before you carry on using Thespiary. The first thing the site does after the new version goes live is put a short screen in front of you, with links to the current policy and terms and a box to tick. Accepting takes you straight back to what you were doing.

Until you accept, ordinary use of the site pauses - but your account does not. Your account settings, an email change, a data export and account deletion all keep working, so you are never trapped by a policy you have not agreed to.

Fixing a typo or making a sentence clearer is not material and will not interrupt you.

14. Contact

Privacy questions, export or deletion requests, corrections, objections: privacy@thespiary.com

Copyright and takedown requests go to a different address - see the copyright and takedown policy.

Thespiary is run by an individual. A postal address is available on request where one is genuinely needed.

Changes since the 2026-10-14 version

2026-10-17. The age-confirmation opt-in for sensitive images, and the timestamp we stored when you confirmed, were replaced by an optional "always show sensitive images" display setting. This reduces the data we keep. It is not a new use of your data, so it does not need you to agree again and the version above is unchanged.

2026-10-17. The option to delete your account immediately, which skips the 30-day wait, is now described in section 6.2, including the exception: while a moderation case is open against your account, the 30-day period applies instead.

2026-10-20. This version is a material update, so you will be asked to agree again. It fills in who runs Thespiary (Ryan Brooks, an individual in Missouri, United States), the privacy contact (privacy@thespiary.com) and the minimum age (13), and it corrects statements that no longer matched what the software does:

• Who handles your data (section 4). We now name the email provider (Mailgun) and the text-extraction provider (Anthropic), and add object storage (Backblaze B2), backup storage (Hetzner Storage Box, through Borg) and the staff sign-in provider. Your uploads are no longer described as leaving our server in only one place.
• How long we keep it (section 5 and 9). Backups can hold erased data for up to about 12 months. Previous versions of reviews and posts are deleted after 90 days, and notifications are archived after 90 days and deleted after 365, by jobs that now run. Moderation detail is cleared after 90 or 365 days. The record that an account was erased is kept for 13 months.
• What you can export (6.1). The export now covers your discussion posts, reactions, earlier versions, playbill uploads, API keys registered with your email, claims, appeals and reports. Moderation records and audit rows are still left out.
• What survives deletion (6.2). We list the erasure record, moderation audit events, and backups, which the old text did not.
• API keys (2.6). The key is now sent once, as a one-hour link, to the address you give. We now keep the address, encrypted, to tell you about API changes and to look into abuse.
• Data dumps (3.5). There are eight collections, not seven, and they include public details about performers and crew; the old text wrongly said they held no personal data.
• Logs (2.7). The application logs the method, route and status of each request; the server's access log, with IP addresses and paths, is off.
• Companions (3.3). Your friends can see your companions if you set them to friends.
• Account fields (2.1). Language, time zone, preferred production types and profile picture are not collected; your city is stored but not yet used.