Privacy Notice

Punk Aficionado is a music site, not a data broker. We collect the least we can get away with, we don't sell it, and you can get out of any list with one click or one word. This page explains exactly what we collect, why, and what you can do about it.

1. Who we are

"Punk Aficionado," "we," "us," and "our" means the Punk Aficionado publication and website at punkaficionado.com, along with our associated social accounts (including @punkaficionado on Instagram) and any newsletter, podcast, or messaging service we operate.

We are based in the United States. Our site is available worldwide, and this notice is written to cover readers everywhere — including specific rights sections for California and for the EU/UK further down.

For privacy questions, requests, or complaints, contact us at hello@punkaficionado.com.

2. What we collect

We only collect information in three ways: you give it to us, your browser sends it automatically, or our hosting provider logs it for security.

Information you give us

We do not ask for and do not want your date of birth, home address, government ID, or payment card details. Please don't send them. We don't run ads, we don't run a store, and we have no reason to hold that information.

Information collected automatically

• Basic site analytics. We run Google Analytics to see aggregate traffic — which pages get read, roughly where visitors come from. It sets standard analytics cookies; see our Cookie & Storage Notice for the specifics. We don't use it to build advertising profiles and we don't share this data with ad networks.
• Spam protection. Our newsletter and submission forms use a hidden "honeypot" field to catch automated bots. It doesn't collect anything about you personally — real visitors never see or fill it.
• Signup source. A short label (for example popup or footer) recording which part of the site you signed up from.
• Timestamp. When you subscribed — which is also our record of your consent.
• Server and security logs. Our host, Cloudflare, processes standard request data (IP address, user agent, requested page, timestamp) to serve pages and block attacks. That is handled by Cloudflare under its own terms and retained on its schedule.
• Local browser storage. We store a single value in your browser so the newsletter popup doesn't nag you twice. It never leaves your device. See our Cookie & Storage Notice.

What we do not collect

As of the date above we run no advertising pixels, no retargeting, no cross-site ad trackers, and we don't sell or share data with ad networks. Google Analytics (described above) is the only analytics running on the site. If that changes further, we will update this notice and say so on the site before turning anything on.

3. Why we use it (and our legal basis)

• To send you the newsletter you asked for — because you consented.
• To send text messages, if we launch them and you opt in — because you consented, separately and expressly.
• To publish submissions you send us — because you asked us to consider them.
• To keep the site up and stop abuse — our legitimate interest in running a site that isn't drowning in bot signups.
• To reply to you — our legitimate interest in answering our own mail.
• To comply with the law — where we have to.

We do not use your information to build advertising profiles, and we do not make automated decisions about you that have legal or similarly significant effects.

4. Who we share it with

We do not sell your personal information. We do not rent it, trade it, or hand it to data brokers. We share it only with the small set of vendors it takes to run the thing, and only so they can do their job for us:

• Cloudflare — hosting, the database that holds band/show submissions, and security filtering.
• Mailchimp — our email platform; it holds newsletter subscriber details and sends The Dispatch.
• Web3Forms — processes what you type into the Submit or Add a Band forms and forwards it to us; it's a secondary copy alongside our own database.
• Google Analytics — aggregate site-traffic analytics, described in §2. Google's own privacy policy governs how it processes that data.
• A future SMS provider — only if and when we launch text alerts, and only for numbers that opted in.
• Embedded services you choose to use — pressing play on the Spotify embed connects you to Spotify, which applies its own privacy policy. Our pages also load fonts from Google Fonts.
• Law enforcement or legal process — if we are legally required to, or where we reasonably believe it's necessary to protect someone's safety or our rights.
• A successor — if Punk Aficionado is ever merged, acquired, or handed off, subscriber data may transfer with it. You would be notified and could unsubscribe.

Anything you post publicly through us — a submitted band write-up, a review that we run, a show listing — is public by design. Don't put anything in a submission you don't want the world to read.

5. How long we keep it

• Newsletter emails: until you unsubscribe, plus a short suppression record so we don't accidentally re-add you.
• Phone numbers: until you text STOP or ask us to remove it, plus an opt-out record for the same reason.
• Signup metadata (source, timestamp): up to 24 months, then deleted.
• Analytics data: retained on Google Analytics' standard schedule — see Google's own privacy policy for specifics.
• Published submissions: as long as the piece is on the site.
• Email correspondence: up to 24 months.

6. Security

The site is served over HTTPS. Newsletter signups are held with our email platform, Mailchimp, under its own security practices. Band, show, and other submissions are stored in an access-controlled Cloudflare D1 database we control directly. Access to both is limited to the people who actually run the publication.

That said: no website is perfectly secure, and anyone who tells you otherwise is selling something. We can't guarantee absolute security, and you send information to us at your own risk. If we ever suffer a breach affecting your data, we'll notify you and any required regulator as the law requires.

7. Your choices and rights

Everyone, everywhere

• Unsubscribe — every newsletter has a one-click unsubscribe link at the bottom. It works immediately.
• Ask what we have — email us and we'll tell you what's on file.
• Ask us to delete it — email us and we'll wipe your record.
• Correct it — wrong email, wrong credit on a submission: tell us and we'll fix it.
• Pull a submission — ask and we'll take it down, subject to §5 above.

Send any of these to hello@punkaficionado.com. We aim to respond within 30 days. We may need to confirm you control the email address in question — we'll never ask you for extra sensitive information just to verify a request. Exercising these rights costs you nothing and we won't treat you differently for it.

California residents (CCPA / CPRA)

If you live in California, you have the right to know what personal information we collect, use, and disclose; to request deletion; to request correction; to receive a portable copy; and not to be discriminated against for exercising those rights.

In the past 12 months we collected the categories described in §2 above — identifiers (email address, hashed IP) and internet activity (signup source, timestamp) — for the purposes in §3, and disclosed them only to the service providers in §4. We have not sold or shared personal information as those terms are defined under the CCPA/CPRA, and we do not sell or share the personal information of anyone under 16. Because we don't sell or share, there's no "Do Not Sell or Share My Personal Information" link to click — but if that ever changes, one will appear here.

You may use an authorized agent to make a request on your behalf; we'll ask for proof of authorization.

Other US states

Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana and other states with comprehensive privacy laws have broadly similar rights to access, correct, delete, and port their data, and to opt out of targeted advertising (which we don't do). Use the same contact address. If we deny a request, you may appeal by replying to our decision with the word "appeal."

EU / UK / EEA readers (GDPR)

If you're in the EU, UK, or EEA, you additionally have the right to object to processing, to restrict processing, to data portability, and to withdraw consent at any time (withdrawing doesn't affect anything we did before you withdrew). Our legal bases are set out in §3.

Your data is processed in the United States. Where we transfer personal data out of the EEA or UK, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) as implemented by our vendors. You have the right to lodge a complaint with your national supervisory authority — though we'd appreciate the chance to sort it out first.

8. If we launch text messages

We are not sending SMS today. Our newsletter signup includes an optional mobile number field with its own consent checkbox — if you fill it in and check the box, we hold your number for future show and album alerts, but no text message goes out until that program actually launches. Signing up for the email newsletter — even with a mobile number attached — will never, on its own, sign you up for texts; that requires the separate checkbox described above, or texting a keyword to a number once the program is live.

When that happens, message frequency, carrier charges, STOP/HELP handling, and how we treat phone numbers are all covered in our SMS Terms. Phone numbers collected for texting will never be sold or shared with third parties for their own marketing.

9. Children

This site is not directed to children under 13, and we don't knowingly collect information from them. If you believe a child under 13 has given us personal information, email us and we'll delete it. Readers between 13 and 18 should get a parent or guardian's OK before subscribing.

10. Links out

We link to bands, labels, venues, ticket sellers, streaming services, and other music sites constantly. Those are not us. Once you click through, that site's privacy policy governs — not this one.

11. Changes to this notice

We'll update this page when what we do changes. The "last updated" date at the top always reflects the current version. If the change is material — new categories of data, a new purpose, anything involving selling data (we won't) — we'll say so in the newsletter or on the site before it takes effect.

12. Contact