00 The evidence chain
How a visitor is routed from the municipal website to a third‑party app and its English‑only privacy policy.
The municipality presents the app as “the official TT Festival App”
under its own banner, while the app and its data processing are run by a separate party (the organising
stichting / Appmiral). Each snapshot’s README.md holds the full reasoning and verbatim quotes.
01 Gemeente Assen — assen.nl
Municipal website. Three pages where the city promotes the festival and its “official” app.
assen.nl — municipal site
| # | Page | Status | Note |
|---|---|---|---|
| 1 | www.assen.nl/ | 200 | Municipal homepage |
| 2 | www.assen.nl/tt | 200 | TT campaign landing page |
| 3 | www.assen.nl/heeft-u-nog-vragen | 200 | “Download de officiële TT Festival App via app.ttfestival.nl” |
Reason for capture
- The municipality blurs who actually runs the app — the “official” framing sits under the city’s banner, but the app is operated by a third party (Appmiral / the organising stichting).
- Because Gemeente Assen actively directs the public to the app while (per this investigation) being aware of the processing concerns, the endorsement is evidence relevant to the municipality’s position.
02 Appmiral — the app & its privacy policy
The third party the municipality links to: the deeplink/download landing page and the app’s privacy policy.
appmiral.com — app vendor
| # | Page | Status | Note |
|---|---|---|---|
| 1 | ttfestival2026.deeplink.appmiral.com/ | 200 | Deeplink / app download landing (app.ttfestival.nl redirects here) |
| 2 | app.appmiral.com/ttfestival2026/privacy-policy | 200 | “TT Festival 2026 – Privacy Statement”. English-only (see below) |
Reason for capture
- EU‑only storage claim is testable. The policy states data is stored in the EU
(AWS
eu-west-1, Ireland) — this repo’s investigation documents location streaming to AWSus-east-1(USA). - Crowd Connected location sharing is admitted (UUID + coordinates + push token).
- English‑only — no Dutch version. Served as
<html lang=en>; requesting withAccept-Language: nl-NL,nlreturns identical English text; 0 hreflang/alternate links and no language switcher. For a Dutch event/audience this is a GDPR Art. 12(1) transparency concern. Proof:logs/language-check_privacy-policy.txt.
03 ttfestival.nl — full site mirror
Complete capture of the official festival website, seeded from its sitemap index.
ttfestival.nl — full mirror
A full wget --mirror capture (page requisites, link conversion,
adjusted extensions) seeded from sitemap_index.xml. Completeness is cross‑checked against the
174 URLs listed across the six sub‑sitemaps (posts, pages, artists, editions, categories, authors).
Coverage and tool versions are recorded under meta/ and logs/.
⬇ The full 1 GB+ website clone (every page + all media) lives in the private
companion repo GraafG/tt-festival-app-evidence. This public folder keeps the readable
highlights above plus mirror-manifest.sha256 — the SHA‑256 of every mirrored file — so the
private bytes remain verifiable from here.
04 App cohort — APK harvest, integrations & live tracking config
Not a web page but the installed Android apps themselves: every Appmiral/Appstrakt app on the phone, pulled as APKs, scanned against Appmiral’s advertised integrations, and read for each location app’s live km‑range + remote kill‑switch.
Appmiral app cohort — 140 apps
| Integration | Apps /140 | Note |
|---|---|---|
| Instagram · Firebase · Google Fused Location | 140 | platform baseline — in every app |
| AWS Cognito · Kinesis Firehose · CM.com · Beatswitch · YouTube · Maps SDK | 139 | near‑universal (the tracking pipeline) |
| Permutive | 36 | variable adoption |
| Mapbox | 16 | variable adoption |
| Crowd Connected (literal pkg/host) | 9 | obfuscated away in most; capability still bundled fleet‑wide |
| TikTok · Azure · Eventim · SeeTickets · WeezEvents · PwC · Halo · … | 0 | advertised but absent in every installed app |
Live config — km range + remote kill‑switch (6 apps with a populated Crowd Connected DB)
com.appmiral.ttfestival— 🔴 kill‑switch ON, 60 km ring centred on Assen (52.99, 6.56), SDK in BACKGROUND mode.- mdlbeast 60 km · rockforpeople 40 km · teamnl 50 km · museumnachtamsterdam 80 km · dutchgp — all armed but toggled OFF by Crowd Connected’s backend.
- The on/off is server‑pushed, not a local setting: identical SDK, different remote switch. Every app requests fine+coarse location; 30 also request background location.
- Advertised ≠ embedded. Many “integrations” are baked into ~all 140 apps by the shared template (over‑stating per‑festival use), while 19 advertised partners appear in 0 installed apps.
05 Email correspondence — notice to the responsible parties
The emails that put Gemeente Assen and Stichting TT Festival on notice of these findings — and the replies they sent.
email correspondence
Beyond the web captures, the repo preserves the correspondence in which both the
municipality (s.gils2@assen.nl, info@assen.nl) and the organisation
(ranco@ttfestival.nl) were told, in writing, what the app actually does — and how they replied.
Each message is kept byte-exact as the original .eml plus a readable .txt rendering and
extracted attachments.
| Date | From → To | What it shows |
|---|---|---|
| 06-16 | Gemeente Assen newsletter → residents | “Download de TT Festival App” — the municipal promotion that the rest of the chain responds to. |
| 06-16 | Geert → info@assen.nl, s.gils2@assen.nl | Notifies the municipality: 60 km location collection sent to the USA, contradicting the “EU-only” policy; advises pausing promotion. |
| 06-16 | Sebas van Gils (Assen, openbare orde en veiligheid) → Geert | Acknowledges: “…dan moeten wij hier zeker iets mee.” Will escalate internally and follow up. |
| 06-23 | Ranco van Bergeijk (ttfestival.nl) → Geert | Admission: Crowd Connected confirms location data is processed via AWS us-east-1 (USA); says the privacy statement is being re-checked. |
| 06-25 | Geert → Ranco, info@ttfestival.nl | Legal rebuttal (pseudonymised ≠ anonymous; Dutch-language; Art. 12) and a formal GDPR Art. 15 access request; controllership question to the stichting. |
Reason for capture
- The responsible parties were demonstrably notified — dated, written notice with a link to this repository, before and during the festival.
- The US transfer is admitted in writing. The operator concedes processing in AWS
us-east-1(Virginia, USA) — the exact point the app’s own privacy policy denies. - The municipality acknowledged it must act, then is assessable against its own words.
- Controllership is squarely put to Stichting TT Festival (GDPR Art. 4(7)/24) as the publisher named in the app stores.
06 Verify integrity
Every artifact is hashed. Bytes are preserved exactly in git (no line‑ending rewrites), so checksums recomputed after cloning will still match.
Run inside any snapshot folder (public lightweight artifacts):
sha256sum -c SHA256SUMS.txt
Each folder’s own README.md and SHA256SUMS.txt are the only files not
listed in its manifest (they are the capture log and the manifest itself). The repo ships
evidence/.gitattributes with * -text so git never alters captured bytes.
To verify the full‑site clones in the private companion repo
GraafG/tt-festival-app-evidence, run sha256sum -c SHA256SUMS.txt inside its snapshot
folder and compare against this repo’s <snapshot>/mirror-manifest.sha256 — the two lists are
identical, so the public repo independently attests to the private bytes.
07 Method (common to all snapshots)
| curl | Exact, unmodified server response bodies plus full response headers and redirect chains. |
| GNU Wget | --mirror --page-requisites --convert-links --adjust-extension — a browsable offline clone with assets. These bulky clones are stored in the private companion repo; their checksums stay here. |
| Google Chrome | Full‑page PNG screenshots and the JavaScript‑rendered DOM at a desktop viewport (1440×900), via Chrome DevTools. |
| User‑Agent | A single consistent desktop browser UA across all tools, so every artifact reflects the same rendering path. Exact tool versions: each snapshot’s logs/tool-versions.txt. |
These captures mirror public pages for fixed‑point, reproducible reference. URLs are preserved
unmodified. This evidence set is separate from the large local‑only ttfestival.nl notes in
../SITE-MIRROR.md.