Privacy policy
Updated 26 August 2026
Who we are
Downtown Piano Lab, MB — a music club at Konstitucijos ave. 7A, Vilnius. For anything concerning your data, write to info@downtownpiano.com.
What this website collects about you
By itself — nothing. Until you press "Accept" in the bar at the bottom, the site sets no cookies and tells no one about you.
If you accept, two measurement tools appear: Google Analytics (which pages get read) and Meta Pixel (so ads reach people for whom they are not noise). Decline and the site works exactly the same. You can change your mind anytime via the "Cookie choice" link at the bottom of the page.
The forms work without cookies: what you type, we receive as an email — and nothing more.
The concert list
If you leave your email before buying a ticket, or in the footer form, it joins our concert list (stored with Resend on European servers). We use it for two things: a reminder before the concert and a note when a new evening is announced. One email from you and we remove it.
Email and concert announcements
If you write to us, we keep your address and the message for as long as the correspondence lasts.
If you ask for concert announcements, your address stays on the list until you ask to be removed. We write rarely. We never share or sell addresses.
Tickets
Some tickets are sold by kakava.lt — they process purchase and payment data under their own privacy policy. We only receive the door list: a name and a ticket count, so we know who to open the door for.
Tickets bought from us are processed by Stripe or Paysera. We never see the full card number or online-banking credentials; they remain with the payment provider. What stays with us is the amount, email, ticket count and the provider order identifier. Resend delivers the tickets.
At the door, the QR code answers one question: is this ticket valid, and has it already walked in. There is no name in it.
The app and your account
The app measures the use of its own screens and features through our Cloudflare backend: the screen opened, an event or listening entry identifier, ticket button, reminder, calendar, directions, sharing and purchase steps, language, app version, device platform and country. This lets us see not only an install but where a journey breaks.
The phone creates a random installation identifier for this measurement. Once you sign in, we record only that the session is valid and the membership tier. We do not send a name, email, ticket QR, payment details, listening text, advertising identifier or precise location to analytics. We do not use these data to follow you across other apps or build an advertising profile.
Usage events remain in our Cloudflare D1 database for up to 90 days and then disappear. They are used to understand product operation, purchase-flow failures and aggregate use.
An account exists only once you sign in. The profile data we keep is your email address and your name. Sign in with Google or Apple and we receive a verified email address and, when shared, your name. Apple may provide a private relay address. Neither Google nor Apple gives us your searches, contacts or calendar.
If you sign in with Apple, the server also keeps an encrypted Apple authorisation token. The app never receives it, and we use it only to revoke the “Sign in with Apple” authorisation when you delete your DPL account. The token is removed after deletion.
Signing in by email sends a six-digit code. What the database holds is not the code but a digest of it, and it stops working after a few minutes.
Attached to the account is what belongs to it: your membership tier, your tickets, the drink token and the result of the daily envelope. All of it lives in a Cloudflare database on European servers.
If you request the 5% Instagram follow reward, Meta supplies an Instagram-scoped ID through the messaging webhook and confirms whether that profile follows Downtown Piano Lab. We keep this internal ID, the one-time code, verification state and dates. We do not keep the profile name, picture or message history. The ID is used only to ensure that one Instagram profile receives the reward once.
For the referral programme we keep a personal referral code, the internal DPL member IDs of the referrer and invitee, code acceptance state and Stripe or Paysera payment confirmation. These data are used only for the €5 first-membership discount, the referrer glass, refunds and abuse prevention.
If you allow app notifications, we keep the device’s Expo notification token and your chosen language. They are used only for a new-concert announcement and the concert-day reminder. Expo delivers the message onward through Apple or Google; we do not use the token to build an advertising profile or to track a person.
You can switch the permission off in your phone settings at any time. We disable a device token when its delivery receipt says it is no longer registered.
Deleting your account
In the app: the account button, top right of the bar, then all the way down. Not a request by email — a button.
Press it and your name, membership tier, perks and sign-in codes are gone; every session stops working the same moment. What remains is an anonymised record of the purchase, because the books have to show that a ticket was paid for.
Tickets stay valid. You bought them rather than received them, and deleting an account should not take away what you paid for.
If Apple authorisation cannot be revoked automatically, the DPL account is still deleted and the screen gives you a direct route to remove Downtown Piano Lab from your Apple Account.
We also remove your Instagram reward verification, referral code and the referral record connected with your account. A reward already earned by another person may remain in their account without your name or email.
Your rights
Under the GDPR you may ask what we hold about you, have it corrected, or have it deleted. An email to info@downtownpiano.com is enough — we reply within a day and delete without questions.
If you believe we have mishandled your data, you may complain to the Lithuanian data protection authority, VDAI (vdai.lrv.lt). But write to us first — most things resolve in a single email.