Privacy Policy
Last updated: August 8, 2026
This policy explains what we collect, why, who we share it with, and how you can get it deleted. We have tried to describe what the software actually does rather than reserve every right imaginable.
1. Who we are
Event Synoptic is an independent event-discovery service for the Los Angeles area, operated by Kirill Hatkovoy. For any privacy question or request, email ki.kolxoz@gmail.com — that address reaches the person who runs the service.
2. What we collect
If you just browse the website, we log each page view: the page path, the referring page, your browser's user-agent string and whether it belongs to a known crawler. We store a one-way hashed form of your IP address — used only to spot abusive automated downloading. We do not store your raw IP address in our analytics, and we do not use advertising trackers or third-party analytics scripts.
If you sign in (Telegram or Google), we receive and store your account identifier, display name and profile photo URL from that provider. Google sign-in also gives us your email address. We never receive your password. If you message our bot on WhatsApp, we receive the phone number you message from; on Instagram, your account identifier — in each case that is how the platform addresses replies.
If you fill in your account settings, we store exactly what you enter — any of: first name, last name, date of birth, gender, phone number, email. All of these fields are optional and you may leave them blank or clear them at any time.
As you use the Service, we record which events you save, which categories and artists you follow, your searches and which listings you open or click. This is what powers personal recommendations and reminders.
If you share your location for the "near me" feature, we round your coordinates to roughly a one-mile grid before storing them, so we know your neighbourhood, not your address. Sharing location is always an explicit action and you can clear it at any time.
If you use the AI concierge, the text of that request is sent to OpenAI to interpret it (see section 4).
We do not collect payment details: we never process payments. Ticket purchases happen entirely on the seller's own website.
3. Why we use it
- to show you events, prices and recommendations, and to run features you asked for (saved events, reminders, price-drop alerts, artist alerts);
- to operate and secure the Service — including detecting scraping, abuse and outages;
- to understand which pages and categories are useful, in aggregate, so we can improve coverage;
- to attribute clicks to our partners so we can be paid a commission (see the Terms);
- to comply with legal obligations.
We do not sell or rent your personal information, and we do not share it for cross-context behavioural advertising.
4. Who we share it with
We use a small number of service providers, and only for the purposes described:
- Telegram — delivers the bot and its messages, if you use it.
- Meta Platforms — delivers WhatsApp and Instagram messages, if you use the Service through those channels; Meta processes your messages under its own terms, as it does for any WhatsApp or Instagram conversation.
- Google — sign-in, if you choose it.
- OpenAI — receives the text of AI-concierge requests to interpret them. Requests are sent via the OpenAI API, which does not use them to train its models. Do not put sensitive personal information into concierge messages.
- Cloudflare — serves and protects the website; processes connection data (including your IP address) as part of delivering it.
- Hetzner — hosts our servers and database, located in Germany.
- Ticket sellers, venues and affiliate networks — when you click an outbound link, they receive the fact of the referral (and standard web request data). What they collect is governed by their own policies.
We may disclose information if required by law, or to protect our rights, users or infrastructure.
5. Cookies
We use a single cookie, es_web, to keep you signed in. It is cryptographically signed, contains your
account identifier and display name, and expires after 90 days. A short-lived cookie is also used during Google sign-in
to prevent request forgery. We use no advertising, profiling or third-party tracking cookies, which is why you are
not greeted by a cookie banner.
6. How long we keep it
- Account profile and saved events — until you delete your account.
- Bot sessions — 30 days of inactivity.
- Reminder and alert bookkeeping — 60 days.
- Web page-view logs (path, hashed IP, user-agent) — 40 days.
- Interaction analytics (searches, impressions and clicks, tied to a pseudonymous channel user id — no IP, no message text) — kept while we operate the Service to understand long-term usage; removed on account deletion or on request.
- Price history — 180 days. This is event pricing, not personal data.
7. Your rights and how to use them
Wherever you live, you can ask us to show you the personal data we hold about you, correct it, or delete it. Email ki.kolxoz@gmail.com from your registered address, or message the bot. You can also edit or clear most of your data yourself in account settings, and clear your saved events at any time.
California residents (CCPA/CPRA). You have the right to know what we collect and why, to request deletion or correction, and to not be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined by the CCPA, so no "Do Not Sell or Share" opt-out is required — but you may still contact us with any request.
EEA/UK residents (GDPR). Our legal bases are: performance of a contract (running features you asked for), legitimate interests (operating, securing and improving the Service, and affiliate attribution), consent (location sharing and optional profile fields), and legal obligation. You may object to processing, request portability, or complain to your local supervisory authority. Our servers are in Germany; if you are outside the EEA your data is processed there.
8. Children
The Service is intended for adults. We do not knowingly collect personal information from children under 13. We list family and children's events for parents and guardians. If you believe a child has given us personal information, email us and we will delete it.
9. Security
Traffic is encrypted in transit (HTTPS). Session cookies are signed and HTTP-only. Access to the database and administrative dashboard is restricted. No system is perfectly secure, but we keep the data we hold deliberately minimal — which is the most effective protection of all.
10. Changes
If this policy changes materially, we will update the date above and announce it on the site. Please check back occasionally.
11. Contact
Privacy questions and requests: ki.kolxoz@gmail.com.