Privacy at Kefi

What we collect, and why

• ✦Your account — email, handle, display name. So you can sign in and be findable by friends.
• ✦Your shows — concerts you log, rate, or plan. This is the product: your live-music history.
• ✦Ticket emails you send us — forward a confirmation to tickets@kefi.show and we extract the show details (artist, venue, date), then discard the raw email after processing. We never crawl your inbox.
• ✦Photos you upload — stored privately, shared only to the albums you put them in. Location metadata is stripped from anything that leaves Kefi. Ticket-stub photos used for import are processed transiently and never stored.
• ✦Linked accounts (optional) — connect Spotify and we read your top artists and follows to recommend shows. Tokens are encrypted; disconnect any time and derived data is purged.
• ✦Calendar (optional) — if you connect Google Calendar, we only add your confirmed shows to it. We don't read your other events.

What we don't do

• ✦No selling your personal data. Ever.
• ✦No advertising tracking or personalized ads. Optional Google Analytics is explained below.
• ✦No reading your inbox or calendar beyond exactly what you hand us.
• ✦Artists and partners only ever see aggregated, anonymized numbers — never you individually.

“No selling your personal data. Ever.”

Analytics and technical diagnostics

If you choose “Allow analytics,” Google Analytics uses first-party cookies to measure page visits and engagement. We send page categories, not private link identifiers, search terms, account details, or page contents. Google receives connection information such as your IP address when your browser contacts its service. Advertising storage, advertising personalization, Google Signals, and user-provided data collection are disabled.

Analytics is off until you choose it. Use “Cookie settings” on any page to reject or withdraw consent. Your choice lasts 180 days on this browser; withdrawing removes Kefi's Analytics cookies and stops collection. Browser or storage restrictions may prevent analytics from working.

Separately, limited technical diagnostics help us detect failures and slow pages: error categories, page categories, sampled loading and responsiveness measurements, and aggregated server request counts and timing. These diagnostics do not include messages, search text, account identifiers, cookies, or precise location. Application diagnostic logs are retained for 14 days.

Your defaults & your dials

Attendance visibility is yours per show (public / private). Your precise location is never collected in the background. Everything you share has an off switch that works.

Your rights

Export or delete your data any time — email privacy@kefi.show and we handle it within 30 days (usually much faster). Deleting your account removes your data, including derived data, from our systems. We honor GDPR, UK-GDPR, and CCPA/CPRA rights regardless of where you live.

Where your data lives

On AWS in the United States (Oregon), encrypted in transit and at rest. Third-party processors: AWS (hosting, email), Clerk (sign-in), Google Analytics (only with your analytics consent), Spotify/Google (accounts you connect), setlist.fm and public event sources (show data, not personal data).

Google API disclosure

Kefi's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.