What we keep, and what we don't.

Browsing without an account

You can search and read every public page without signing in.

What stays in your browser

While you browse, the site keeps two things in your browser:

• Your settings: language, theme and time format.
• Your chosen location, if you set one.

Both live in your own browser rather than on the server, and clearing your site data removes them.

Your approximate location

Your approximate location is estimated from your network address so that “near you” and the times on the page mean something on a first visit.

That estimate is made per request and is not stored against you. Picking a city yourself replaces it, and that choice is what the site uses from then on.

With an account

What your account holds

An account stores:

• Your email address
• A display name
• A generated handle

How you sign in

• With GitHub, Google or Facebook: the site stores the fact that your account is linked to that provider. It never receives or stores your password there.
• With a password here: only a cryptographic hash of it is stored. The password itself is never written down, and cannot be recovered from what is.

Sessions

Signing in creates a session.

• Only a hash of the session secret is stored, so a copy of the database is not a copy of everybody's logins.
• Sessions expire after inactivity.
• Resetting your password ends every session on every device, including the one that asked.

What you do with it

What you do with an account is stored because it is the feature:

• The events you save
• The things you vote on
• The venues, performers, people and organizations you follow
• The events you publish

Your calendar feed

Your saved events can also be a calendar feed, and the feed's address is its key: anyone who has that address can read the list. That is why you can replace it with a new one at any time.

Email

Mail is sent for a small number of reasons, and only ones you triggered:

• Verifying an address
• Resetting a password
• Signing in by link

A link mailed to you expires, and asking for a new one cancels any earlier links of that kind.

Messages and reports

What you send through the contact form, and any report you make about something on the site, is stored:

• A message is stored with what you wrote, the address you gave and, if you were signed in, your account. It may also be forwarded by email to the site's own mailbox.
• A report is stored with what you chose and wrote, the address you left if you left one and, if you were signed in, your account. Whoever published what you reported does not see it.
• Both are included when you download your data, and deleted with your account.

The waitlist

While new accounts are closed, you can leave your email address on the sign-up page to be told when they open. It is stored with the language of the page and mailed once, when sign-up opens. It is deleted a month after that mail, or as soon as an account is made with it, whichever comes first.

Analytics and page views

• There is no third-party analytics here.
• Apart from the advertising described below, nothing this site stores is used to follow you anywhere else.
• Page views are counted per event so that popular listings can be ranked. The record of each individual view is deleted within a few days, and all that is kept is how many views each event had per day.

Maps

Map tiles are fetched by your browser directly from the map provider, so that provider sees your request, as it would on any site that shows a map.

Checking for bots

Where the site has it turned on, Cloudflare Turnstile checks that a person, not a bot, is signing up, asking for a sign-in or reset link, using the contact form, joining the waitlist or sending a report without an account. Your browser loads Cloudflare's check on those forms only, and Cloudflare sees your IP address and signals from your browser to decide. Most people never see it; now and then it asks you to tick a box.

What Cloudflare learns this way is used for that check, and this site only hears whether it passed.

Advertising

How the ads work

The column at the side of the page is advertising space, filled by Google AdSense. Google sets its own cookies through those slots and can use them to choose what to show you, here and on other sites carrying its ads.

That is a different arrangement from everything above: what Google learns is Google's, and Google does not tell this site who you are.

Consent in the EEA and the UK

Readers in the EEA and the UK are asked before a personalized ad is shown, through Google's own consent message. That message is also where you can change your answer later.

Your data

From the site itself, at any time, you can:

• Unfollow anything you follow
• Clear your saved events
• Download a copy of your data, from Settings. It holds your profile, preferences, saved events, votes, follows, organizations, messages, reports and notifications; it does not hold your password or your sign-in sessions.
• Delete your account, from Settings. Your account, saved events, votes, follows, messages and reports are deleted and cannot be restored; events you published stay with the organization that published them.