Who we are
BoomSched is made by XFour IT Limited, trading as XFour Labs ("we", "us"). We are a company registered in England and Wales, number 11776254. Our registered office is 100 Berkshire Place, C/O KT Wells Ltd, Winnersh Triangle, Wokingham, RG41 5RD, United Kingdom. We are the controller of the personal data described here, under UK data protection law (UK GDPR and the Data Protection Act 2018).
Questions about this policy: gdpr@xfour.co.uk.
The short version
BoomSched is an unofficial festival schedule and crew planner. You star sets, rate them, share your picks with friends by QR code, link or crew code, and build day plans. It is not made by or linked to any festival.
There is no account. The app makes a random member ID on your device and asks for a display name. Connecting Spotify is optional.
- We do not collect: your real name, email or phone number.
- We do not collect: your precise location.
- We do not collect: advertising IDs. BoomSched has no ads.
What we collect, where it goes, and how long we keep it
| Data | Where it is stored | Why | How long |
|---|---|---|---|
| Display name, starred sets, ratings, crews, day plans, reminder settings | On your device | To run the app | Until you clear them or delete the app |
| Your display name, random member ID and picks, inside QR codes and share links you create | Inside the code or link only. No server is involved | So friends can merge your picks with theirs | For as long as the person you gave it to keeps it |
| Crew sync: festival, crew code and name, your member ID, display name, favourites, ratings and plans | Supabase (our database host) | To keep your crew's picks in sync. Only if you join or create a crew | Until you ask us to delete it. We plan to remove crews that have not changed for 30 days |
| Spotify: your top artists, followed artists, artists from liked songs, Spotify display name, access tokens | On your device only | To highlight acts you already like. Optional | Until you disconnect Spotify |
| Your clipboard, read once after setup | On your device only | To pick up a share link you copied before installing the app | Not kept |
| Usage events and screen views, linked to your random member ID and your display name | PostHog (EU) | To see which features people use and fix problems | Deleted automatically after PostHog's retention period (usually up to 1 year), or sooner if you ask |
| Crash reports, error logs, and screen recordings of some sessions (10% of sessions, and sessions with an error). QR codes are hidden in recordings. Feedback you choose to send | Sentry (United States) | To find and fix bugs | Deleted automatically after Sentry's retention period (usually 30 to 90 days) |
| App performance numbers and update checks | Expo (EAS Update) | To deliver fixes without a full store update | Per Expo's policy |
What other people can see
- Anyone with your crew code can see the display names, picks, ratings and plans of everyone in that crew. Only share the code with people you trust.
- Anyone you give a QR code or share link to can see your display name and picks.
Permissions the app asks for
The app asks before it uses any of these. You can say no, or change your mind later in your phone's settings. The rest of the app still works.
| Permission | What it is used for |
|---|---|
| Camera (optional) | Scans a friend's QR code so their picks merge with yours. No photos are taken or uploaded. |
| Notifications (optional) | Set reminders and a morning nudge. These are made on your device. |
Why we use your data (our lawful basis)
| Purpose | Lawful basis |
|---|---|
| Running the app, QR swap and crew sync | Contract: to provide the service you asked for |
| Spotify and camera | Your consent. You can disconnect or withdraw it at any time |
| Analytics and crash reports | Our legitimate interests in improving the app and fixing faults |
We do not sell your data. We do not use it for advertising. We do not make automated decisions about you that have legal or similar effects.
Service providers
We use these companies to run the app. They may only use your data to provide their service to us.
| Provider | What they do | Location |
|---|---|---|
| Supabase | Crew sync database | See supabase.com/privacy |
| PostHog | Product analytics (anonymous usage events) | EU (Frankfurt) |
| Sentry (Functional Software Inc.) | Crash and error reports | United States |
| Spotify | Optional: reads your music taste, read-only | Spotify (Sweden / global) |
| Expo (650 Industries) | App updates and performance metrics | United States |
| Cloudflare | Hosts the web version | Global network |
Where a provider processes data outside the UK, we rely on UK adequacy regulations (for example for the EU), or on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or the UK-US Data Bridge where the provider is certified.
Deleting your data
- Use "Clear my stars" and "Leave crew" in the app.
- Leaving a crew does not yet delete your row from the crew database. Email us your crew code and display name and we will delete it.
- Disconnect Spotify in the app to wipe your Spotify data from your device.
- Deleting the app removes everything stored on your device.
Children
BoomSched is meant for adults going to festivals. It is not for children under 13. If you think a child has given us personal data, email us and we will delete it.
Security
Data sent between the app and our providers is encrypted in transit. We give access only to the people and systems that need it, and we keep the amount of data we collect small. No system is perfectly secure. If a breach puts your rights at risk, we will tell you and the Information Commissioner's Office as the law requires.
Your rights
Under UK data protection law you have the right to:
- ask for a copy of your personal data;
- ask us to correct data that is wrong;
- ask us to delete your data;
- object to, or ask us to limit, how we use your data;
- ask for your data in a format you can move to another service;
- withdraw consent at any time, where we rely on consent.
Email gdpr@xfour.co.uk. We will reply within one month. Much of your data may be only on your device, where we cannot see it.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113. We would like the chance to fix it first, so please contact us.
Changes to this policy
When the app changes what it collects, we update this page and the date at the top. If a change is significant, we will also tell you in the app.
Contact
XFour IT Limited, 100 Berkshire Place, C/O KT Wells Ltd, Winnersh Triangle, Wokingham, RG41 5RD, United Kingdom.
Privacy: gdpr@xfour.co.uk · Support: support@xfour.co.uk
Policy based on a review of the app's source code (BoomSched, main branch) on 29 October 2026.