Privacy Policy
Effective Date: April 29, 2026
Last Updated: May 7, 2026 — Updated to reflect notification history, city preferences, local device storage, and data deletion features.
This Privacy Policy explains how Maple Arts ("we", "our", or "us") collects, uses, and protects information when you use the Maple Arts mobile application ("the App") available on iOS and Android. By using the App, you agree to the practices described in this policy.
1. Who We Are
The Maple Arts app is operated by Maple Arts, a Canadian non-profit organisation that presents live Arabic music events across Canada.
- Organisation: Maple Arts
- Website: https://maplearts.co
- Contact: artists@maplearts.co
- Country: Canada
2. What Data We Collect and Why
We collect only what is necessary to make the app work. Below is a complete and accurate description of all data we collect.
2.1 Data Stored on Our Servers (Firebase Firestore)
| Data | What It Is | Why We Collect It | How Long We Keep It |
|---|---|---|---|
| Device ID | A randomly generated unique identifier (UUID) created the first time you open the app. It is not your Apple ID, Google account, name, or email. You can view your Device ID in the app under Settings → Data & Privacy. | To identify your device so we can send you push notifications and save your city preferences. | Until you request deletion or uninstall the app. |
| Expo Push Token | A token generated by Expo's notification service that identifies your device for push notification delivery. | To send you push notifications about upcoming Maple Arts concerts and events. | Until you disable notifications or request deletion. |
| Device Type and OS | Whether you are on iOS or Android, your device model name, OS name, and OS version (e.g. "iPhone", "iOS", "26.3.1"). | To ensure notifications are formatted and delivered correctly for your device. | Until you request deletion or uninstall the app. |
| City Preferences | The list of Canadian cities you select in the Settings screen (e.g. ["Toronto", "Montreal"]) or a wildcard ["*"] if you select All Cities. | To send you notifications only about events in cities you are interested in. | Until you change your preferences or request deletion. |
2.2 Data Stored Locally on Your Device Only
The following data is stored only on your device using React Native's AsyncStorage. It is never transmitted to our servers.
| Data | What It Is | Why We Store It |
|---|---|---|
| Device ID | The same UUID described above, stored locally so it persists across app restarts. You can view it in Settings → Data & Privacy. | So your city preferences and notification settings are remembered when you close and reopen the app. |
| Last-Read Timestamp | The date and time you last opened the Notifications tab. | To show an unread badge on the Notifications tab when new notifications have arrived since you last checked. |
2.3 Data Processed in Memory Only
The following data is processed temporarily during your session and is never written to any database or file:
- Opened notification IDs — tracked in memory during your current session to determine when to clear the unread badge. This resets every time you close the app.
2.4 Data We Do NOT Collect
We do not collect any of the following:
- Your name, email address, or phone number
- Your precise or approximate location or GPS data
- Your contacts or address book
- Your photos, camera, or microphone data
- Your payment or financial information
- Your browsing history inside or outside the app
- Your IP address
- Advertising identifiers (IDFA on iOS, GAID on Android)
- Any analytics or usage tracking data
3. How We Use Your Data
We use the data described above for these specific purposes only:
- Push notifications: Using your Expo push token and city preferences to send you relevant concert announcements and event updates — only if you have granted notification permission.
- App functionality: Using your device ID to load your saved city preferences when you open the app, and using the last-read timestamp to show the unread notification badge.
We do not use your data for advertising, profiling, marketing to third parties, or any commercial purpose beyond what is described above.
4. Push Notifications
When you first open the app, your device will ask if you want to allow notifications from Maple Arts. This permission is optional — you can browse events, view notification history, and use all other app features without enabling notifications.
If you allow notifications, we will use your push token to send you alerts about upcoming concerts and events. You can disable notifications at any time in your device's Settings app under Maple Arts.
When you disable notifications, your push token remains in our database but is no longer used to send you alerts. You can request complete deletion by following the process in Section 7.
5. City Preferences
In the Settings screen, you can select which Canadian cities you want to receive concert notifications about. This preference is saved to our database alongside your device ID. It is used only to filter which notifications are delivered to your device.
You can change your city preferences at any time inside the app. Changes take effect immediately.
6. Third-Party Services
The app uses the following third-party services, each with its own privacy policy:
6.1 Google Firebase (Firestore)
We use Firebase Firestore to store your device ID, push token, device type, and city preferences. Firebase is operated by Google LLC. Our Firebase project is hosted in the United States (nam5 multi-region). Data is encrypted at rest and in transit. Google's Privacy Policy: https://policies.google.com/privacy
6.2 Expo Notifications
We use Expo's push notification service to route notifications to your device. Expo processes your push token to determine whether to deliver via Apple Push Notification service (APNs) or Firebase Cloud Messaging (FCM). Expo's Privacy Policy: https://expo.dev/privacy
6.3 Apple Push Notification Service (iOS only)
On iOS devices, notifications are delivered through Apple's APNs infrastructure. Apple's Privacy Policy: https://www.apple.com/legal/privacy
6.4 Firebase Cloud Messaging (Android only)
On Android devices, notifications are delivered through Google's FCM infrastructure. Google's Privacy Policy: https://policies.google.com/privacy
6.5 External Ticketing
When you tap "Book Tickets", you are taken to the Maple Arts website (maplearts.co) in your device's browser. Any information you provide on that website is governed by the Maple Arts website privacy policy. The app does not collect or transmit any information related to your ticket purchase.
7. Your Data — How to View and Delete It
7.1 Viewing Your Device ID
You can view the unique Device ID associated with your data at any time by opening the app and going to Settings → Data & Privacy. Your Device ID is displayed there and can be copied to your clipboard with one tap.
7.2 Requesting Deletion
To request deletion of all data associated with your device, follow these steps:
- Open the Maple Arts app and go to Settings → Data & Privacy
- Tap Copy next to your Device ID
- Email artists@maplearts.co with the subject line "Data Deletion Request" and paste your Device ID in the message
We will delete your record from our database within 30 days of receiving your request and confirm via email when complete.
7.3 Data Retention
We retain your data for as long as the app is installed on your device. The last-read timestamp stored on your device is automatically removed when you uninstall the app. Data in our Firebase database is retained until you request deletion.
8. Data Security
- All data transmitted between the app and our servers uses encrypted HTTPS connections.
- Data stored in Firebase Firestore is encrypted at rest by Google.
- Our Firebase security rules restrict write access to events and notifications — only our admin tools can create or modify them.
- We do not sell, rent, or share your data with any third parties for marketing, advertising, or profiling purposes.
9. Apple App Store Privacy Labels
In compliance with Apple App Store requirements, the following summarises our declared privacy practices:
- Data Not Linked to You: Device ID (used for push notifications and city preferences)
- Data Not Collected: Location, contacts, browsing history, purchases, health, financial info, sensitive info, advertising identifiers
- No Tracking: We do not track users across third-party apps or websites
- No Analytics: We do not use any third-party analytics SDK
10. Your Rights Under GDPR (European Users)
If you are located in the European Union or European Economic Area, you have the following rights under GDPR:
- Right of Access: Request a copy of the data we hold about your device.
- Right to Rectification: Request correction of inaccurate data.
- Right to Erasure: Request deletion of your data. See Section 7.2 for how to do this.
- Right to Restriction: Request that we stop processing your data.
- Right to Data Portability: Request your data in a structured, machine-readable format.
- Right to Object: Object to processing of your data at any time.
Legal basis for processing: Consent — granted when you allow push notifications. You can withdraw consent at any time by disabling notifications or requesting deletion via Section 7.2.
We will respond to all GDPR requests within 30 days. Contact: artists@maplearts.co
11. Your Rights Under CCPA and CPRA (California Users)
- Right to Know: You have the right to know what personal information we collect, use, and share.
- Right to Delete: You have the right to request deletion of your personal information. See Section 7.2.
- Right to Opt Out of Sale: We do not sell your personal information.
- Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.
Contact: artists@maplearts.co
12. Children's Privacy
The Maple Arts app does not require account creation and does not collect any personal information such as name, email, date of birth, or location. The only data collected is a random device identifier used for push notifications.
We do not knowingly collect personal information from children under the age of 13 (or 16 in the EU). If you believe we have inadvertently collected information from a child, please contact us at artists@maplearts.co and we will delete it promptly.
13. International Data Transfers
Our Firebase database is hosted in the United States (Google's nam5 multi-region). If you are located outside the United States, your data is transferred to and processed in the United States. This transfer is governed by Google's data processing agreements which comply with applicable international transfer requirements including EU Standard Contractual Clauses.
14. Changes to This Privacy Policy
We will update this Privacy Policy when we add new features that affect data collection or when laws require changes. When updated, we will change the "Last Updated" date at the top of this page. For significant changes that affect how we use your data, we will notify you via an in-app notification before the change takes effect.
15. Contact Us
For any questions about this Privacy Policy or to exercise your data rights:
Maple Arts
Email: artists@maplearts.co
Website: https://maplearts.co
Country: Canada