Privacy Policy

1. Scope and who we are

This Privacy Policy applies to Kandipal’s website, progressive web app, native mobile apps, and related account, planning, sharing, and support services (the “Service”). “Kandipal,” “we,” “us,” and “our” mean the operator of the Service, responsible for the personal information described here. Features vary by platform and release; the descriptions below apply when you use the relevant feature.

You can use many planning features without an account. Creating an account, syncing, joining a Crew, and sharing information involve additional processing described below. Send privacy questions and requests through our contact form.

2. Information we process

Information comes from you, your browser or device, sign-in providers, and people who invite you, send you content, or share a Crew with you. The web planner does not request live GPS location or upload your address book. Map pins and home-base text are information you enter, and may still reveal sensitive places or plans. Network providers may infer an approximate location from an IP address.

3. How we use information

• Provide schedules, plans, maps, downloads, exports, and account sync.
• Authenticate accounts and deliver account verification or recovery messages.
• Carry out invitations, sharing, Crew contributions, and the visibility settings you choose.
• Resolve conflicting edits, recover pending requests, and prevent duplicate actions.
• Answer support and privacy requests, diagnose faults, and maintain the Service.
• Prevent spam, fraud, unauthorized access, and other abuse; enforce our terms; and meet legal obligations.

Where data-protection law requires a legal basis, we process account, sync, and sharing data to provide the services you request under our agreement with you. We rely on legitimate interests for proportionate security, abuse prevention, troubleshooting, and legal-claim handling, balanced against your rights; legal obligations where applicable; and consent where required for optional processing. If required information is not provided, we may be unable to provide that feature or verify a request. You can still use available local planning features.

4. Local-first storage and optional cloud sync

We use browser or app storage for plans, preferences, sessions, cached festival assets, drafts, and pending actions. Device-only content is not sent to us merely because it is saved locally. Loading the website, festival downloads, remote images, or online features still sends ordinary network requests to the systems serving them.

After account setup and any required plan review, supported changes can sync automatically while you are signed in. A separate Send action is not needed for each synced edit. Pending sync, friend requests, or sharing actions may be saved locally and retried when connectivity and your account session allow. Review the app’s pending, failed, and sent states; an offline action is not proof of delivery.

Cloud account data and device data are separate. Signing out, removing a festival download, or deleting an account does not necessarily erase local plans, drafts, exports, or copies on other devices. Clearing browser/app storage can remove device-only data and pending actions; it does not itself delete cloud data. Keep exports of important plans, and clear local data separately before giving someone else your device.

5. When information is disclosed

Friends, Crews, and people you share with

• Profile and friend requests. Your display name, photo, and account identifier may appear to people involved in friend requests, your friends, Crew participants, and recipients of shared cards. A friend code or invitation link can be forwarded by its holder. Older friend-code subscription features also reveal your display name and home-base text to a signed-in person with your code without requiring a mutual friendship. Avoid putting an exact address or private meeting location in your home base.
• Priorities and attendance. Enabling priority sharing makes your synced priority sets visible to eligible accepted friends, subject to your account and per-friend settings. Marking that you are going to a festival makes that choice visible to accepted friends. Friendship alone does not expose your entire personal plan or private notes.
• Crew participation. Crew participants can see the profile, membership, contributions, shared events, images, and places made available to their role. Owners and other authorized participants can review or change shared content and manage access. Sharing with selected members sends private copies; adding to a Crew makes content available in that Crew according to its permissions. A Crew owner can include confirmed contributions from other members in a public Crew Plan view link.
• Public share links. Anyone with a valid Crew Plan view link can see the Crew name, festival, and frozen selection of cards, including their notes and locations, without joining the Crew or signing in. Later source edits do not update that snapshot. Revoking a link stops future access through that link, but cannot recall screenshots, downloads, or copies already made.
• Copies and exports. Sending cards, copying text, exporting files, or using your device’s share menu can disclose titles, notes, times, and locations included in your selection. Recipients can keep, edit, and forward independent copies. Editing or deleting the source, leaving a Crew, removing a friend, or deleting your account does not automatically delete those copies.

Providers and other disclosures

• Service providers. Our service setup uses Cloudflare for web delivery and abuse protection, DigitalOcean for API hosting, and Supabase for authentication, database/storage, and live update infrastructure. Providers process information needed for those functions. Authorized staff and contractors may access relevant data for support, security, and operations.
• Other services you use. Google sign-in, external festival and artist links, map services, remote image hosts, app stores, and apps you select for sharing process information under their own policies. Loading a remote image sends network information to its host; following an external link sends a request to that site.
• Legal and safety reasons. We may disclose relevant information to comply with lawful requests, establish or defend legal claims, investigate abuse, or protect people, rights, and the Service.
• Business changes. Relevant information may be disclosed to advisers and prospective or actual successors in a financing, merger, reorganization, or sale, subject to appropriate safeguards, this policy, and applicable law.

Public contact forms use Cloudflare Turnstile. Cloudflare processes network and browser signals, including IP address and browser headers, to detect bots and improve its protection. We send the verification token and requesting IP address for verification, and use a protected IP-derived identifier for abuse limits. See the Cloudflare Turnstile Privacy Addendum.

6. Advertising, sponsorships, and tracking choices

Kandipal does not currently display third-party ads or include behavioral advertising SDKs. We do not currently sell personal information or share it for cross-context behavioral advertising. Storage used for sign-in, offline planning, sync, and abuse protection serves those functions rather than advertising.

We may introduce advertising, sponsorships, or affiliate links to fund the Service. Before introducing new advertising-related data uses, we will update this policy and provide applicable notices, consent, and opt-out controls, including recognition of Global Privacy Control where required. This policy is not advance consent to future tracking. Required platform permissions would also apply. Declining optional personalized advertising will not block core planner features.

We will not use passwords or authentication tokens for advertising. Private notes, personal landmarks, friend-plan details, and support messages will not be used to target third-party ads without a separate, clear opt-in. Paid placements and affiliate relationships will be identified as required. You can restrict cookies and local storage in your browser, but this may prevent sign-in, offline storage, or other features from working.

7. Retention and account deletion

Local data remains until removed through available controls or cleared by you, your browser, or your device. Cloud profile, plan, and social records are kept while needed to provide the relevant account or shared feature. Support, security, request, and audit records may be kept longer when needed to resolve an open issue, prevent abuse, establish or defend a claim, or meet a legal obligation. Retention depends on the record’s purpose, whether an issue remains open, applicable legal periods, and backup cycles; it is not an unlimited right to keep personal information.

Signed-in attendees can request cloud account deletion in Profile under Account. The flow requires fresh authentication. It removes the active account profile, uploaded profile photo, personal cloud plans, and friend relationships, and removes or replaces account identifiers in retained shared and operational records. Linked Support message bodies and attached device details are removed from active conversations. Staff accounts require administrator-assisted offboarding.

Crew contributions and independent copies held by recipients may remain, with account attribution removed or replaced where supported. Names or other personal information you wrote inside shared text or images are not automatically removed from every copy. A Crew you own may pass to another eligible member or be archived. Public contact messages submitted outside your account are not automatically matched to account deletion; identify them in a privacy request if needed.

Limited copies may remain in protected backups until the applicable backup cycle completes, and records needed for legal or security reasons may be retained with restricted use. Replacing an account identifier is not a guarantee that every retained record is anonymous. Deletion does not erase local guest plans or files you exported, and we cannot remotely erase another person’s downloaded copy. Contact us about personal information in retained shared content so we can assess the request under applicable law.

8. Your privacy choices and rights

Use available Profile, Friends, Crew, and plan controls to edit your information, change sharing, remove relationships, revoke links where your role allows, or delete an account. Existing recipient copies may remain as explained above. You can use local planning without an account.

Depending on the law that applies, you may have rights to know about, access, correct, export, or delete your personal information; restrict processing; withdraw consent; appeal a denied request; or complain to your data-protection authority. You may also object to processing based on legitimate interests, and to direct marketing. Withdrawing consent does not change the lawfulness of earlier processing.

California residents may have rights to information about the categories, sources, purposes, and recipients of personal information, and applicable rights to correct, delete, limit certain uses of sensitive information, and opt out of sale or sharing. We do not currently use sensitive personal information to infer characteristics about you. We will not discriminate against you for exercising applicable privacy rights.

Send requests through our contact form, choosing Privacy. We may request information reasonably needed to verify your identity and any authorized agent’s authority. Do not send passwords or unnecessary identity documents. We will respond within the period required by applicable law and explain any refusal and available appeal process. You can submit an appeal through the same form. These rights may be subject to lawful exceptions and the rights of other people.

9. Security

We use safeguards designed to protect the information we process, including access controls, authenticated online features, and encrypted transport for hosted services. Cloud sync and sharing are not end-to-end encrypted: authorized systems and personnel may process their contents for the purposes in this policy. No system guarantees that access, loss, or disclosure can never occur.

Protect your account, device, and share links. Do not put passwords, authentication tokens, ticket barcodes, payment details, or unnecessary sensitive information into notes, images, shared plans, or support messages. Report suspected misuse or security issues through our contact form.

10. Children

The Service is not directed to children under 13, and children under 13 may not use it. We do not knowingly collect their personal information. Where local law sets a higher minimum age for using the Service or consenting to a feature, that requirement applies. Eligible minors must have a parent or guardian’s permission. If you believe a child has provided personal information in violation of these rules, contact us so we can investigate and remove it as required.

11. International processing

Kandipal and its providers may process information in the United States and other countries where they operate, whose privacy laws may differ from those where you live. Where required, international transfers must use a valid legal mechanism, such as an applicable adequacy decision or approved contractual safeguards. Contact us for information about safeguards applicable to your data. Using the Service does not waive your local privacy rights.

12. Changes to this policy

We may update this policy as the Service changes. We will revise its date and version and provide additional notice of material changes as required by law. If a new use requires consent, we will seek that consent before the new use. A policy update alone does not authorize materially different uses of previously collected data where law requires additional notice or consent.

13. Contact

Submit privacy requests, questions, and security concerns through our contact form. Include the feature and account or shared item involved so we can locate relevant records.