Privacy policy

What this site collects on its own

Nothing. There is no analytics, no advertising, no tracking pixel, no tag manager, no social widget, no comment system and no chat bubble.

No cookies either, and that is worth being exact about rather than leaving as a slogan. Nothing on any page you can reach sets one. The site has exactly one cookie in it: the band's own sign-in to the private admin area, which is set when somebody on the band's side enters a code emailed to them, and which nobody else is ever given. So there is no cookie banner, because there is nothing to ask you about.

The fonts are served from this site rather than fetched from Google, so opening a page does not tell anybody else that you did.

Reading this site is anonymous as far as the site is concerned. The one thing happening underneath is the hosting company's own request logs, covered under server logs below.

The booking and contact forms

The booking form asks for your name, your email, a phone number if you want to give one, the event date, the kind of event, the venue if you know it, and whatever you want to say. Only the name, email, date and event type are required.

The contact form asks for an email, a subject and a message. A name if you feel like it.

That is saved to the band's database and emailed to the band's booking address so somebody can reply, and the email is addressed back to you so a reply reaches you directly. It is not sold, not shared and not handed to an advertiser. There is no mailing list. Sending a form does not sign you up for anything, and no marketing comes back at you from this site.

Both of those are deliberate, and the saving is the newer half. Before it, a message that failed to send was gone, which is how the previous version of this site quietly lost enquiries. Now what you wrote is written down first and emailed second, so an email that does not go through does not cost you a reply.

The two companies involved in that — the one that stores it and the one that carries the email — are named below, with the others. Nothing else is done with what you write, and no confirmation email is sent to you: the only mail your message causes is the one that goes to the band.

How long it is kept: two years from when you send it, after which it is deleted. Two rather than one because a wedding is often booked more than a year ahead, and an enquiry deleted before the event it is about is no use to anybody. There is no automatic job doing the deleting yet, so today it is a person going in and removing old rows — which is worth saying plainly rather than implying a schedule that does not exist. You can ask for yours to go sooner, at any time, and that is the section below.

Filling in a form is the only way this site learns your name. If you want to be certain a message got through, email booking@cahillandcompany.com directly.

Photos and video you send

If you send photos or video from a show, that is personal information. Yours, and that of everyone else in the shot. What the band may do with it is the media terms; this is the data part.

Where it goes: the file travels from your phone straight to a private storage bucket belonging to the band, on Supabase, who are named below. It does not pass through the website's own server on the way. There is no public address for it — no link, no folder anybody can browse, nothing on this site that will show it — and it is not readable with any of the keys this website hands to your browser. Only the band, signed in to its own admin page, can see it.

Stored with each file: the file itself, the original filename, the type and size, and the time it arrived. Alongside that, a note that you ticked the media-terms box — which version of the terms was on the screen, a fingerprint of the exact sentence, and when you ticked it — and a random number that groups together the files you sent in one go. That is the whole record. The uploader does not ask your name, your email or your phone number and does not create an account, so nothing in it says who you are.

One thing worth knowing, because most people do not: a photo carries hidden information inside the file. Depending on your phone's settings that can include the exact time you took it, the make and model of the phone, and the GPS coordinates of where you were standing.

Photos are cleaned of all of that before they leave your phone. It happens in your browser, on your device, before a single byte is sent. The coordinates are not removed after the band receives them. The band never receives them. The only thing kept is the marker that says which way up the picture goes, because without it portrait shots arrive on their side. The picture itself is untouched and is not re-compressed.

And then it is checked again on arrival, which is new and is the part worth trusting. Once the file has landed, the site opens it and looks for anything the cleaning should have removed. If it finds any — a location, a timestamp, a camera serial, a caption written by an editing app — the photo is deleted rather than kept, and you are told it was not accepted. So the promise in the paragraph above no longer depends on your phone's browser having done its job properly. It is verified on the file itself.

Video is the exception, and it is worth reading twice. A video from a phone carries the same location information, and this site does not remove it. Stripping it means rebuilding a file that can be a couple of gigabytes, on your phone, which is not something an upload page can do. So if you send video, assume the band receives where it was shot. If that matters to you, turn location off for the camera before the gig, or send photos instead.

How long it is kept: twelve months, after which it is deleted. Shorter than the two years for a form message, and deliberately: an enquiry about a wedding has to outlive the wedding, whereas a photo from a Friday night is either used in the weeks after or it is not. A file the band has specifically marked to keep stays longer, and if that ever applies to something of yours you can ask.

As with form messages, there is no automatic job doing the deleting yet, so today it is a person going in and removing old files. That is worth saying plainly rather than implying a schedule that does not exist. You can ask for something of yours to go sooner, at any time, and that is the section below.

One more thing, kept away from the file and worth being straight about. To stop somebody scripting the upload page and filling the band's storage, the site counts how much has been sent from one internet connection in the last hour. It does that without keeping your IP address: the address is turned into a scrambled value it cannot be read back out of, and that value is deleted within a couple of hours. It is not attached to your files, and there is no way to go from a stored photo to the connection it came from.

Server logs

The site runs on Vercel. Like any web host, their servers keep their own request logs, which typically means your IP address, the page you asked for, the time, and the user-agent string your browser sends. That happens on any site you visit anywhere, and those logs are the host's rather than the band's.

Nobody here runs analytics on top of them or builds a picture of visitors out of them.

What is not in those logs, because it used to be: what you wrote in a form. The site records that a message arrived, when, and a random reference number for it, and nothing about the person who sent it. No name, no email address, no phone number. That is a deliberate change, and the reason it is mentioned at all is that the previous version of this page disclosed the opposite.

The band signing in to its own admin pages also writes a line or two, and those are held to the same rule. If somebody who is not the band tries and is refused, the line says that a sign-in was refused and says nothing about who tried — not the address they typed, not anything else. The site is built so that it could not write it down even by mistake: an address that is not on the band's own list is never sent anywhere and never stored.

Other companies involved

Five, and this is the whole list. None of them hears from you unless you do something first.

• Vimeo, for the performance videos, and only once you press play. The thumbnails on the videos page are served from this site, so browsing it does not tell Vimeo anything. Press play and the player loads from Vimeo, which is the moment they see your device. The player also loads things of its own while it starts up, currently including a Cloudflare check; all of that is Vimeo’s, under Vimeo’s privacy policy, and it does not happen until you press the button.
• Instagram, Venmo and Facebook, as links out. Nothing goes to them until you tap one, and then you are on their site under their rules.
• Vercel, the host, as described under server logs above.
• Resend, which delivers the one email a form sends. Fill in the booking or contact form and what you wrote passes through them on its way to the band’s inbox, the same way any email passes through a mail provider. They are not sent your details for any other reason, they are not given a list, and they are not contacted at all if you do not submit a form.
• Supabase, which runs the database the band’s enquiries are kept in, and the private storage the photos and video go to. If you send a form, what you wrote is stored there: your name, your email, a phone number if you gave one, and the message itself, for the two years described above. If you send photos or video, the files themselves and the short record described above are stored there too, for twelve months. Nothing else about you is in it — not a record of you reading a page, not anything you did without filling in a form or sending a file.
• The one other thing in that database is a list of the times the band signed in to its own admin pages: the date, and which of the band’s addresses it was. That is there so that if one of their accounts were ever broken into, it would be possible to say when. It contains nothing about anybody who visits this site, and a refused sign-in is recorded without an address at all — so somebody who stumbled onto the sign-in page and typed their own email would not end up stored anywhere. Supabase also handles that sign-in, which is the same company already named above rather than a new one.
• All of it is the band’s own data on Supabase’s machines. It is not shared with them for any purpose of their own, and nothing in it is readable without the band’s own credentials.

No advertising network, no data broker, no marketing-email platform, no font CDN. If that changes, this page changes with it.

What you can ask for

Email booking@cahillandcompany.com and you can ask what the band holds that relates to you, ask for it to be deleted, or ask for a photo or video to be taken down.

Give enough detail to find it. For a form message, your email address is enough, and the reference number the site showed you when you sent it is quicker still. For an upload, the date or the venue and roughly what is in the shot is plenty.

There is no login and no settings page to do this yourself. It is an email to a person, which for a band this size is the honest mechanism rather than a worse version of one.

Worth being straight about one thing, because this page used to be unable to promise it: until recently a form message was held only in the memory of whichever server took it, so an honest answer to “what do you have from me” was often that nobody could tell. Messages are now written down properly, which is what makes both halves of this section — telling you what is held, and deleting it — something that can actually be done rather than something a page says.

Children

Nothing on this site is aimed at children and Cahill & Co. does not knowingly collect anything from anyone under 18. The media terms cover sending photos or video of anyone under 18: do not.

When this changes

The date at the top changes with it. There is no version history and no notification, so the date is the thing to check.