Privacy at Kefi

What we collect, and why

• Your account — email, handle, display name. So you can sign in and be findable by friends.
• Your shows — concerts you log, rate, or plan. This is the product: your live-music history.
• Ticket emails you send us — forward a confirmation to tickets@kefi.show and we extract the show details (artist, venue, date), then discard the raw email after processing. We never crawl your inbox.
• Photos you upload — stored privately, shared only to the albums you put them in. Location metadata is stripped from anything that leaves Kefi. Ticket-stub photos used for import are processed transiently and never stored.
• Linked accounts (optional) — connect Spotify and we read your top artists and follows to recommend shows. Tokens are encrypted; disconnect any time and derived data is purged.
• Calendar (optional) — if you connect Google Calendar, we only add your confirmed shows to it. We don't read your other events.

What we don't do

• No selling your personal data. Ever.
• No surveillance advertising, no third-party tracking pixels.
• No reading your inbox or calendar beyond exactly what you hand us.
• Artists and partners only ever see aggregated, anonymized numbers — never you individually.

Your defaults & your dials

Attendance visibility is yours per show (public / private). Your precise location is never collected in the background. Everything you share has an off switch that works.

Your rights

Export or delete your data any time — email privacy@kefi.show and we handle it within 30 days (usually much faster). Deleting your account removes your data, including derived data, from our systems. We honor GDPR, UK-GDPR, and CCPA/CPRA rights regardless of where you live.

Where your data lives

On AWS in the United States (Oregon), encrypted in transit and at rest. Third-party processors: AWS (hosting, email), Clerk (sign-in), Spotify/Google (only what you connect), setlist.fm and public event sources (show data, not personal data).

Google API disclosure

Kefi's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.