Privacy

Version . In force from .

Who we are

AnyRequests is a trading name of Mark Griffiths, trading as Rhexen ("Rhexen").
Chew Wood, Glossop, SK13 5RR

Rhexen is the data controller for the personal data described here. That means Rhexen decides how it is used and is responsible for it under UK data protection law (UK GDPR and the Data Protection Act 2018).

Contact

What changed in version 3.4

Version 3.4 describes the longer feedback survey and the permissions you choose in it, Send feedback in the app, what we keep about each and for how long, and what happens to feedback sent from the app when an account is closed. It also says what our system emails us about new activity, names Zoho, which now receives our email in place of ImprovMX, and says what the "Find lyrics" button sends to Google.

What changed in version 3.3

Version 3.3 lists every way our server uses your IP address, and adds to the list of how long we keep things the records it left out.

What changed in version 3.2

Version 3.2 says two more things about the feedback form: the scrambled code we keep for a day to stop one sender flooding it, and the note we make against your account when you open the form from your dashboard or choose not to be asked again.

What changed in version 3.1

Version 3.1 adds what the service already did and this policy did not say: that you agree to the terms when you sign up and we record it; your answers to the setup screens; when you last used the app; what we give Stripe when you set up payments and with each payment; the artists sent to Anthropic when you open Build my list; ImprovMX, which forwards our email; support notes and copies of account emails; and exactly what is kept when an account is closed. It also says plainly that we do not sell your details or pass them to anyone for their own marketing.

What changed in version 3.0

Version 3.0 says who runs AnyRequests and adds what earlier versions left out: the device code in full, paid requests, searches that find nothing, blocking a phone, what is kept on your device, passing requests to the next act (and that only the act that goes live there can see them), venues and location readings, what is shared between musicians and how the sharing switch governs all of it, past gigs included, private gigs, our website's own counting, the feedback form, the demo, the most requested chart, who else handles data, how long everything is kept, and your rights. The name you add to a request is the only thing typed into a request that is deleted after the gig; earlier versions said more than that, and this one is exact.

If you are requesting a song

You do not need an account. We never ask for your email address or phone number. When you send a request we store:

There is no advertising and no analytics on the request page.

The device code

The device code is a random code your browser keeps (under the name anyRequestsDeviceToken). It is made the first time a request page needs it. It is not your name, your number or your card, and no musician is ever shown the code itself.

Your phone sends it with each request, vote, tip and purchase. We use it to:

It stays the same on that browser until you clear the site's data, so it is the same code at every AnyRequests gig you use on that phone. We do not use it to follow you from gig to gig or from musician to musician. It is kept on each request, vote and payment for as long as that record is kept. For a payment, that is seven years.

When your request is played

While the request page is open and the gig is live, it checks with us about every ten seconds, using your device code, whether any of your requests have been marked played. When one has, it shows a card once for that song: "Your request was played". It offers a chance to say thanks with a tip, unless your phone has already tipped at this gig. If you come back to the page and your request has not been played yet, it says so, and does not ask for money.

Your browser remembers what it has already shown you, for that gig only, so you are not shown the same thing twice. That record stays on your phone and is replaced at the next gig you use on that page.

Searches that find nothing

If you search for a song and nothing is found, we keep what you typed, with your device code and the gig, for 90 days. We use it to see which songs are missing from our catalogue. The musician whose page it was can read their own list; no other musician can. After 90 days it is deleted automatically.

Who can see your request

The musician sees everything you send, including any name you added. On the public request page only song titles and vote counts are shown. Names are never shown publicly, and the permissions on our database stop the public page reading them at all.

The act on after them may see it too. If the musician does not get to your request, and another act goes live at the same venue, as a public gig, within three hours of them finishing, or is already playing there when they finish, that act can be offered it, with the name you added so they know who it is for. Only that act: it has to have gone live there, with its phone placing it at the venue, and no other musician can see it. They can choose to add it to their own list. If they do, your song, the name you added and your device code go with it. This only happens at public gigs, when both acts have sharing switched on, and the request page tells you when it might happen. The act before is never named to the act after, and no money or tip passes between them.

How long we keep what you send

The name you add is deleted three hours after the gig ends. A job that runs every ten minutes removes it, so nobody has to remember. If your request was passed to the next act, their copy of the name is deleted three hours after their gig ends.

The song is not deleted. What stays is the song, the date, your device code and the fact that somebody asked for it. The musician keeps that as the history of what their audiences asked for. There is no date on which it is deleted.

Version 1.0 of this policy said requests were deleted after twelve months. That job never deleted anything, because the product is younger than that, and it was removed on 7 September 2026. What is deleted now is the name, and it goes in three hours.

If a musician reports a request

A musician can report a request as abusive or inappropriate. Only the musician can do this. There is no way for anybody in the audience to report anybody else, deliberately, because a request that anyone in the room could flag is a request anyone in the room could have removed.

They can report it during the gig and for three hours after it ends, while the name you added is still there to look at. A reported request keeps the song, the name and the reason the musician gave for twelve months, so that we can read it, decide whether something needs doing, and have a record if it does. After twelve months the name is deleted in the same way.

If a musician blocks your phone

A musician can block a phone for the rest of a gig. We record the device code, the musician, the gig and when. That phone's requests are then refused until the gig ends. The record is kept with the gig's other records; there is no separate deletion date for it yet.

Tips and paid requests

Stripe processes the payment and the musician is the seller. When you tip, the payment is taken on the musician's page by Stripe and paid into the musician's own Stripe account. It does not pass through an account of ours and it never sits on our balance. A tip is a thank you. It never buys a song and never changes the order of the queue.

After your first request at a gig, the page shows the full tip card once for that visit, then a small tip button. Under the button it says that the tip goes straight to the musician.

We never receive or hold card or bank details. Card numbers, wallet details and the musician's bank account are handled by Stripe. They are never sent to us, never stored by us, and we cannot see them. Stripe uses them under its own privacy policy.

We take a platform fee of 4% of each card payment, on tips and on paid requests. Stripe deducts it at the moment of payment and pays it to us.

What we record about each tip is the amount, the fees, the Stripe references, when it happened, which musician and which gig, your phone's device code, and whether it was later refunded or disputed. We do not record your name, email or card with it. Because the device code is on it, the musician's screen can show that the person who asked for a song also tipped, using the name you added to your request if you added one (for example, "£5 just came in from Sarah").

When you tap a tip button, we record that it was tapped, with your phone's device code, the musician, the gig and when, so the musician can see it on their live screen.

What we give Stripe with each payment is which musician and which gig it is for, the amounts, and your phone's device code, so the payment can be matched to its gig and to any requests it bought. Nothing else about you goes with it from us.

Some musicians let you buy extra requests at a gig. The payment works like a tip: it goes to the musician's own Stripe account. We record the price, how many requests it bought, the fees, the Stripe references, the musician, the gig, your phone's device code, and any refund or dispute. The device code is how the requests you bought are kept for you, on that phone, for that gig only.

Financial records are kept for seven years, because we are required to keep records of transactions for tax. They cannot be deleted on request, and they stay if a musician closes their account. This is the one part of your data that a deletion request does not reach.

What is kept on your device

We set no cookies, and we use no advertising or analytics cookies or trackers. Some things are kept in your browser's own storage, because the service needs them or because you asked for them. None of them is sent to anybody else.

On the request page:

For musicians, in the app:

On our website and sign-up pages:

The label of the link you arrived from (such as ?ref=poster or a utm_source tag) is not kept in your browser. It travels in the address of the sign-up link instead, so it can be saved with your account if you sign up from it, and it is gone when you close the page.

Stripe's own code loads only when you open the tip or payment form, or when a musician opens their payments screen. When it loads, Stripe sets its own cookies, which it uses to prevent fraud. Stripe explains them in its cookie policy.

You can clear all of this at any time in your browser's settings, by clearing the data for anyrequests.app. On the request page that gives you a new device code.

If you are a musician using AnyRequests

We store your email address and password (hashed, never in plain text) for signing in. We also store what you put on your page and in the app: your name, page link, tagline, images and links; your tip and request settings; your Stripe account reference and whether Stripe has verified it (never your bank details); your songs and songbooks; your gigs and where they were; the location readings described under Venues; how often you have used the AI features, so that we can apply fair-use limits; and your notification subscriptions. You can change most of it from your dashboard whenever you like.

We keep your answers to the setup screens, including how your act plays (on your own, as a duo or trio, or as a band, and live or with backing tracks), and which screens you have finished, so we can pick up where you left off. How your act plays also changes some of the wording on your audience page.

When you set up payments, we give Stripe your email address, your act name and your page address so that it can open your Stripe account, and set the rest of the account's basics ourselves. Stripe asks for everything else it needs itself, on its own pages.

We record when you last used the app, so we can see which accounts are in use. While the app is open on your screen we note that, and which screen it is on: that the app is open tells us a new request needs no notification, and the screen's name only appears in our server logs when we look into why a notification was or was not sent. The note is removed when the app is closed or put away, and if that does not reach us it is replaced the next time you open the app.

We also record, from the moment you sign up:

Venues

When you go live you choose the venue from a shared list of UK venues, built from Overture Maps (open map data that contains no OpenStreetMap data), or you type a name of your own. If you type a name that is not on the list, at a public gig and with a good location reading, it is added to the shared list at the place you are standing, so other musicians can find the same room. Other musicians can see that venue's name and position, but never that you added it, and never which venues you have played.

Location readings

When you open Go Live, your phone asks once for your location, to put nearby venues at the top. It takes one reading, for up to eight seconds, and you are not tracked during the gig. If the reading is good and the venue you choose is on the shared list, we keep that reading with the venue: where you were, how accurate it was, when, and which gig. We do this for public and private gigs alike.

We use readings to place the venue correctly on the map, to know that a gig really happened there before it counts towards what that venue's audiences ask for, and to decide whether requests can pass between acts there. Readings are kept for as long as the venue is on the shared list, because they are what places it. If your phone does not give an exact location, our server uses your IP address once to guess roughly which town you are in, so the venue search starts nearby. Vercel, our hosting company, makes the guess. That guess is never stored.

What your audiences ask for helps other musicians

When a gig ends with requests from two or more phones, the songs asked for that our catalogue recognises count towards lists other musicians see on their dashboard. A public gig at a venue on the shared list counts towards that venue's list, once a location reading shows you were there. Every gig counts towards a national list called "Everywhere". Other musicians see song titles, artists and how often they were asked for. They never see your name, your gigs, the date, the words anyone typed, anybody's name or any money. At a venue where only a few gigs have been counted, a list may come from your gigs alone; it never says so.

Songbooks made for a venue. When a musician makes a songbook by describing a gig at a venue with three or more public gigs, the songs most asked for there may be suggested to them. What is used is song titles and how often they were asked for, and nothing else: never a musician, a gig, a date or anybody's name. Private gigs are never used for this.

The setting "Share requests with the act before and after me" is on by default. It controls all of this: the venue and "Everywhere" lists, what a venue is known to ask for when a songbook is made for it, and the passing of requests between acts. Switch it off and you neither give nor receive. While it is off, none of your gigs count towards any of it, including gigs from before you switched it off; switch it back on and they count again. Nothing is copied out of your gigs to make these lists, so there is nothing left behind to delete.

Private gigs

A gig marked private (a wedding, a party, a function) never passes requests to another act, never receives them, and never counts towards a venue's list. Its songs do count, unnamed, towards "Everywhere" and towards the list for its kind of occasion (weddings, birthdays and so on), which other musicians can see, in the same way as above. If you choose a venue from the shared list for a private gig, a good location reading is still kept and the venue still counts one more gig played. No other musician can see that it was you, or that the gig was there.

The most requested chart

Our website may show the songs most requested across AnyRequests in the last 30 days. It shows song titles and artists only. It is counted across many gigs and many acts, including private gigs, and only from acts with sharing switched on. It never shows a venue, a musician, a name typed into a request, or anything about money. It is only shown once the last 30 days hold at least 40 gigs, 10 acts and 400 requests and votes, and a song is only listed once it has been asked for by at least 3 acts at 5 or more gigs.

Songbooks built by AI

When you make a songbook by describing a gig, what you describe and your song list (up to 2,000 songs) are sent to Anthropic, whose model picks from your songs. If you name a venue, the songs most asked for there may be sent too, as described above. If we know little about the venue, Anthropic's model may search the web for it, which sends the venue name to Anthropic's search provider. What it finds about the venue (never your description) is kept and reused for any musician who names the same venue, and it is looked up again once it is more than 30 days old.

Build my list. When you open Build my list on the Songs tab, the names of the artists on your song list (up to 60) and of the artists your audiences have asked for that are not on it (up to 12), with how many of each, and which decades your list sits in, are sent to Anthropic, whose model names other acts that suit the same rooms. No songs you typed, no names and nothing about your gigs go with them.

If you ask us to read a setlist

You can add songs by uploading a file. Most of those files never leave your phone or computer: spreadsheets, Word documents, CSV files and PDFs that contain real text are all read on your own device by the app itself. A text file is read on your device too, unless its lines cannot be split into songs; then it is read in the same way as a pasted list, by Anthropic, and the app says so.

Two kinds of file cannot be read on your device, because there is no text in them to read: a photograph of a setlist, and a PDF that turns out to be a scan rather than a typed document. Those are sent to Anthropic, whose model reads the writing and sends back the text. The app tells you which route your file took at the moment you choose it.

A list you paste or type in is read by AI too. It is sent to Anthropic, whose model splits it into titles and artists so that it can cope with whatever shape your list is in. The box you paste into says so.

It is used to read the list of songs and for nothing else. It is not used to train anyone's model, it is not used for advertising, and it is not shared with anyone beyond that.

A photograph may show more than song titles. A picture of a page can catch handwriting, a venue name, other people's names, or whatever else happens to be on the paper or behind it. We only ask the model for the list of songs, but the whole picture is what gets sent, so it is worth a look before you upload it. If you would rather not send a photograph at all, a screenshot, a typed list or the Add a song button all work without one.

The same is true of a scanned PDF, and it is easier to forget. A scan is a picture of a page wearing a document's file name, so it carries whatever was on that page just as a photograph does, and the whole of every page is sent.

We do not keep the photograph or the scan. It is held in memory only for as long as the request takes, and it is never written to our database or our file storage. What is saved afterwards is the list of songs you confirm, exactly as if you had typed them.

Notifications

If you turn on notifications, your browser gives us a subscription that lets us send a message to that browser. We store it, with a description of the browser it came from so you can tell your devices apart. We use it to tell you when a request arrives during a gig, when money is paid out or something needs your attention on your account, and when another act at your venue asks if you have finished. A new request notification shows the song and the name the person added. Notifications are delivered by your browser's maker (Apple, Google or Mozilla), encrypted so that they cannot read them. Turning notifications off in the app or in your browser settings ends the subscription.

Emails

When you sign up we record three answers separately: that you agree to the terms and have read this policy, that you confirmed you are 18 or over, and whether you want marketing emails. None of the boxes is ticked for you, and sign-up will not make a new account without the first two. Each answer is stored with the date, the time and the version of this policy and the terms that were in force.

You can turn marketing emails off at any time from Settings in your dashboard, in one tap, without contacting anybody. Turning it off is recorded in the same way as turning it on, so there is always a record of what you chose and when.

Some emails are sent whatever you choose, because they are needed to run your account: confirming your address, resetting your password, and notices about your account itself. These are not marketing and cannot be turned off while the account is open.

Marketing emails are optional. We ask about them separately, the box is not ticked for you, and saying no changes nothing else about your account.

We do not sell your details, and we do not pass them to anyone for their own marketing: not to other musicians, not to venues, not to anyone. The service providers listed under "Who else handles your data" handle them only to run AnyRequests, and Stripe also uses payment details under its own privacy policy.

When we can see your account

The people who run AnyRequests can open your account to help you. If you contact us with a problem, somebody may need to see what you see in order to fix it. We would rather say so plainly than have you find out.

Downloading your data and closing your account

You can download your data and close your account yourself, in Settings, under Privacy and data and Close account. The download is a file with your profile, what you agreed to, your venues, gigs, songs and requests. It leaves out your audiences' device codes.

Closing takes your page down, so your printed codes stop working, and you can no longer sign in. It removes your name, tagline, images, links and sign-in email from your account, and your notification subscriptions. We keep the record of payments for seven years, and your account number. Your gigs, songs and requests stay, with nothing on them that names you, because they are counted in what venues' audiences ask for, and so do your setup answers and how you heard about us. Venues you added to the shared list stay on it, and so do the location readings that place them.

We also keep the records that show what happened on the account: what you agreed to, the record of who opened it and what was changed (which includes your name and sign-in email as they were when you closed it), our notes, and copies of the notices we emailed you. Your Stripe account is yours and is not closed with it; you can close it with Stripe. You can also email privacy@anyrequests.app.

Our website

Counting visits. On our home page and the demo page we count how the page is used, so that we can tell what helps musicians decide. Each time one of those pages is opened we record: that it was opened; which parts were reached and how far down it was read, in broad bands; whether the demo was touched, whether its code was scanned and whether a demo request was sent; whether a sign-up or sign-in button was pressed; whether the "add to home screen" offer was shown, accepted or closed; the page's address; the link label you arrived with (?ref= and utm tags), if any; the name of the website that linked to us, but not the full address; whether the visit was to the live site or a test copy; whether the screen is a phone, tablet or computer; and the screen width, in broad bands.

These events are tied together by a random code made fresh each time the page loads. It is held only while the page is open and is never stored on your device, so two visits cannot be linked, and a visit cannot be linked to an account. We set no cookie for this and store nothing in your browser for it. We do not record your IP address in our own database. There is no counting of this kind on the request page, on a musician's live screen, or anywhere in the musician's app. We keep these records for 400 days, and then they are deleted automatically.

If you send us feedback. Musicians can tell us how they use AnyRequests through a short survey we send them. It asks for your name, your act name, where and how you play, what you like, which parts of AnyRequests you use, how you took requests before, a gig where it made a difference, what is missing, how likely you are to recommend us (a number from 0 to 10 that only we see and never publish), what you would tell another musician, and, if you like, how to contact you. All of it is optional except what you would tell another musician and whether we may quote it. It is stored in our own database and read only by us. It is not linked to an account.

Your permissions. You choose whether we may quote you word for word, or trimmed for length, or not at all; where we may use a quote (our website, social media, or printed material); how to credit you; and whether we may email you to ask for a photo. We record each choice separately, with the date and the version of the wording you saw. We use a quote only where you said, and we never change its words beyond trimming it if you allowed that. If you send us a photo by email, we keep it with your answer and use it only where you allowed.

Changing your mind. Email privacy@anyrequests.app at any time. We stop using your quote straight away, and delete your answer, and any photo, if you ask.

Send feedback in the app. If you use Send feedback from the menu, we keep your message, what kind of message it is, your account, the screen you sent it from and the version of the app you were using, so that we can find the problem. We do not record where you are.

If you send us feedback, we also keep a scrambled code made from your internet address and the date, using a secret key, so it cannot be turned back into your address. It is only used to stop one sender flooding the form, and it is deleted the next time the form is used after a day has passed. If you open the survey from the link on your dashboard, the link carries a one-time code. When you send your answer, we note against your account that you answered, so that we do not ask you again; if you do not send it, nothing is noted. If you choose not to be asked again, we note that too. The note does not say anything about what you wrote, and your answer is not linked to your account.

We only ever quote you if you said yes. A quote is chosen by hand, shown on our website exactly as you wrote it, and credited exactly as you chose. It never shows how to contact you or where you play. You can withdraw permission, or ask us to delete what you sent, at any time by emailing privacy@anyrequests.app, and we will take the quote down.

The demo. On our website you can send a pretend request from your phone to your own screen. What you type on your phone is sent through Supabase's real-time service straight to the page that showed the code, and only while that page is open. It is not saved in our database, and the demo makes no device code. We count that the demo was used (see above), but not what you typed.

IP addresses

We do not keep your IP address in our own database. Like any website, the services we run on keep short technical logs of requests, including the IP address, so that they can operate and protect the service: Supabase (our database) and Vercel (our hosting). We do not copy IP addresses out of those logs.

Our own server code uses your IP address in three ways, and never saves the address itself:

Who else handles your data

For musicians: the "Find chords" button opens Ultimate Guitar's own website, with the song title in the address. What happens there is under Ultimate Guitar's own policy.

For a musician who plays to backing tracks, the "Find lyrics" button opens Google's own search instead, with the song title, the name of the artist who recorded it if we know it, and the word "lyrics" in the search. Your act's name is not included. What happens there is under Google's own policy.

Emails to us about new activity. When feedback arrives, a request is reported or a musician signs up, our system emails us a short notice through Resend, the email service we already use. A notice about feedback or a report contains its type and its first line. A notice about a sign-up contains the account number and the plan, never a name or an email address.

Anthropic and the United States. Anthropic acts on our instructions and does not use what we send to train its models. It keeps what is sent to its API for a short period under its own published retention policy, longer if its safety systems flag something, and that copy is held in the United States. There is no option to keep it in the UK or the EU. If that matters to you, do not upload a photograph or a scan, and do not paste your list in: a spreadsheet, a Word document, a CSV file, or a PDF that contains real text is read on your own device and nothing is sent anywhere.

Where any of these companies hold personal data outside the UK, we rely on the safeguards UK law provides for that, such as the UK's adequacy regulations or the International Data Transfer Addendum. You can ask us which applies to each one.

Why we are allowed to use your data

How long we keep things

Children

Musicians must be 18 or over. The request page asks nobody for personal details, and the name box is optional. Please do not put a child's full name in it.

Your rights

You have the right to ask for a copy of your data, to have it corrected, to have it deleted, to restrict or object to how we use it, and to take it elsewhere. Where we rely on your consent you can withdraw it at any time. Email privacy@anyrequests.app. We reply within one month.

If you used a request page, we do not know who you are, so we cannot find your requests from your name or email. The quickest route is to ask the musician whose page you used: they can hide or delete any request from their dashboard straight away. You can also email us with the musician, the gig and the song, and we will do what we can.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113). We would like the chance to put it right first, so please tell us too.

Changes to this policy

When this policy changes, we change the version and the date at the top. Every record of what a musician agreed to names the version that was in force at the time.