Privacy Policy
Effective date: July 14, 2026
chi·feed (https://chi-feed.subastra.dev) is a free, independently operated guide to events in Chicago. This page explains — in plain language, grounded in what the software actually does — what information we handle and what we never do with it.
The short version
- You can browse everything without an account. We run no analytics, no tracking scripts, and no advertising cookies.
- If you sign in with Google, we store your email, display name, profile-picture link, and your saves, follows, and preferences — that's it.
- We never sell or share your information for marketing.
- You can export or permanently delete everything yourself, from the account menu, at any time.
What we collect
If you just browse (no account): nothing is stored about you in our database. Like every website, our servers and our hosting provider (Cloudflare) briefly process standard request data — your IP address, browser type, and the pages requested — to deliver the site, prevent abuse, and keep short-lived operational logs.
If you sign in with Google: we receive your email address, name, profile-picture link, and Google account ID through Google's standard sign-in (scopes: openid, email, profile). We never see your Google password, and we don't request access to anything else in your Google account — no contacts, no calendar, no Drive.
Sign-in sessions: when you sign in we create a session that lasts up to 60 days. For security, the session record includes the IP address and browser type at sign-in and a rough device label (e.g. "Chrome on Windows"). The session token itself is stored only as a one-way hash. You can sign out of one device or all devices at any time; session records are removed when you delete your account.
Your activity in the app: events you save, neighborhoods/categories/venues you follow, your preferences (theme, notification settings), and your in-app notifications. Saving as a guest lives only in your own browser (see the storage table below).
Event submissions: if you submit an event, everything you enter — including the optional "your name" field — may be published with the listing if it's approved.
Problem reports (flags): if you report a wrong listing, we store the reason and your note. If you're signed in, the report is linked to your account. Your IP address is used briefly, in memory only, to limit repeat reports — it is not saved to the reports database, though it may appear in short-lived server logs.
What we don't do
- No analytics or behavioral tracking of any kind — no Google Analytics, no pixels, no fingerprinting.
- No selling, renting, or sharing your information for marketing.
- No third-party ad networks and no advertising cookies — the only promotional tiles are our own, clearly labeled "Sponsored" (see "Advertising" below).
- No requesting your device location. The map shows Chicago; we never ask where you are.
- No storing your photo — we only keep a link to the profile image Google provides.
How we use your information
To run the service: keep you signed in, sync your saved events across devices, show your follows, and send in-app notifications when something you follow has a new event. The "For You" feed is ranked only from things you chose explicitly — your follows and your saved events — plus how soon an event starts. There is no hidden behavioral profile; you could reconstruct the ranking yourself from your own saves and follows. We also use request data (IP addresses) to prevent abuse.
Cookies and browser storage
We use only what's needed to run the site — nothing for advertising or analytics.
| Name | Kind | What it does | How long |
|---|---|---|---|
| chi_session | Cookie (essential) | Keeps you signed in. Set only when you sign in; HttpOnly and Secure. | 60 days |
| chi_oauth_tx | Cookie (essential) | Protects the Google sign-in handshake against forgery. | 10 minutes, then deleted |
| chi-feed:favorites | localStorage (preference) | Your saved events while browsing as a guest. | Until you clear it |
| chi-feed:favorites-migrated | localStorage (preference) | Remembers that guest saves were merged into your account. | Until you clear it |
| chi-feed:theme | localStorage (preference) | Your day/night theme choice. | Until you clear it |
| chi-feed:onboarded | localStorage (preference) | Hides the one-time welcome message. | Until you clear it |
| chi-feed:admin-token | sessionStorage (admin only) | Admin dashboard access token; only ever set for site administrators. | Until the tab closes |
Third parties
Google Sign-In. Signing in uses Google's OAuth service under Google's own privacy policy (https://policies.google.com/privacy). Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
Cloudflare. The site and its API are delivered through Cloudflare, which processes request data (including IP addresses) to route traffic and protect against attacks (https://www.cloudflare.com/privacypolicy/).
Map tiles. If you open the Map view, map imagery loads from CARTO (based on OpenStreetMap data); CARTO's servers receive your IP address and the map areas requested, like any image on the web.
Event images and links. Event photos load directly from the original source (for example Ticketmaster, SeatGeek, Eventbrite, Choose Chicago, Do312, the City of Chicago, or a venue's own site), so that source's servers see your IP when the image loads. Ticket links take you to the source's site, which has its own privacy policy.
Event data sources. We gather listings from public event APIs and feeds. That's outbound only — none of your information is sent to those sources.
Advertising
chi·feed occasionally shows a house promotion — a tile in the feed for chi·feed itself or something we operate, always labeled "Sponsored." House tiles are first-party: they are served by us, set no cookies, use no identifiers, and involve no tracking or ad networks of any kind.
We do not currently serve third-party ads (such as Google AdSense), and no advertising cookies or identifiers are used. If we ever introduce third-party advertising, we will update this policy first: the effective date will change, this section will describe exactly which ad provider is used, and — where required by law — you will be asked for consent before any advertising cookies are set. Ad providers typically use cookies or device identifiers to measure and, unless configured otherwise, personalize ads; if that ever applies here, this section will say so plainly and link to the provider's opt-out tools.
How long we keep things
- Sign-in sessions: expire after 60 days (or immediately when you sign out); session records are removed when you delete your account.
- Your account, saves, follows, and preferences: kept until you delete your account.
- News articles: deleted from our database 60 days after publication.
- Past events: archived (kept so your saved history still works), not tied to browsing behavior.
- Problem reports: kept for moderation history. If you delete your account, reports are no longer linked to any identifying information about you.
- Server logs: short-lived and rotated; used only for operations and abuse prevention.
Your rights and controls
Everything is self-serve, in the account menu (your avatar, top right):
- Export my data — downloads a JSON file of your profile, preferences, saved events, follows, sign-in providers, and device history.
- Delete account — permanently deletes your profile, sessions, saved events, follows, notifications, and preferences, immediately. There is no grace period and no soft copy.
- Sign out / sign out everywhere — ends the current session or all sessions.
If you're in a jurisdiction with additional privacy rights (such as the GDPR or the California Consumer Privacy Act), the tools above cover access, portability, and deletion; for anything else — correction, questions, or a request you can't complete in the app — email us and we'll handle it directly. We do not sell personal information, so there is nothing to opt out of selling.
Children
chi·feed is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has created an account, contact us and we'll delete it.
Security
Everything is served over HTTPS. Session tokens are stored only as one-way hashes, so they can't be replayed even if the database were exposed. We never store passwords — sign-in is handled entirely by Google.
Changes to this policy
If we change this policy, we'll update the effective date at the top. For material changes (like introducing third-party advertising), we'll also note it in the app.
Contact
Questions or requests: jamesprince2156@gmail.com
chi·feed is independently operated in Chicago, Illinois, USA.