Skip to content
Chi Rave
ArtistsAbout

Privacy

Effective November 4, 2026. What changed: public pages about an artist may be looked up to describe their genre, and MusicBrainz is asked which artist a public page belongs to; before that, a flyer's owner can take it down from under it (Is this your flyer?), and an email left on a problem report gets one more email when the problem is fixed; before that, the admin page lists accounts by username and display name, with when each last signed in; before that, the site opened to everyone, so the invite-only sign-in through Cloudflare is gone, and images from a submission we turn down now go within two days. Before that: Friends (what a friend can see, requests, blocks and reports), Going and For you. If this changes, the new version is posted here with its date.

Chi Rave (chirave.com) lists dance-music events in the Chicago area. It is run by an independent developer in Chicago. Questions or requests about your data: privacy@chirave.com

The short version. You can use the site without an account. If you make one, it holds your email, a username and a display name, nothing more about who you are. There are no ads, no analytics and no tracking across sites, and we don't sell or share anything about you. What you save, like, mark or rate is yours: nobody else sees it. You can download it and delete it yourself.

What we keep, and why

  • A device code. The first time you open the site, your browser gets a cookie named device_id holding a random code. It lasts two years. Until you sign in, it is what lets the site remember, for this browser only, the events you save, the artists you like, the nights you mark Going or “Been there” with your rating, and the events you submit. It isn't linked to your name, email or phone. When you sign in, what was under the device code moves into your account (the site shows you what will move first); after you sign out, this browser starts empty again. For you's suggestions are worked out from these same choices only, on the device code or in the account, and from nothing else: nothing you browse, search or filter is kept.
  • Counting, not showing. Nothing about what you saved, liked or went to is shown to anyone today. When the site starts showing what's popular, it will count saves, likes and nights across everyone: a number is never shown, and nothing appears until enough people share a choice, so no one person's choices can be read from it.
  • An account, if you make one. Your email address, the username and display name you chose (we never ask for your legal name, a photo or a phone number), the date you confirmed you are 18 or older, and the day the account was made. If you add a passkey, we keep its public key, the name you gave it and when it was last used. The check itself, Face ID, a fingerprint or your device's PIN, happens on your phone or computer and never reaches us: no fingerprint, face or other biometric data is sent to, or stored by, Chi Rave, and we never collect any. We keep the list of your signed-in sessions (a short device summary such as “iPhone, Safari 26”, when each began and was last used) so you can see them in Settings and sign any of them out. The nights you mark Going and Been there and your ratings, the events you save and the artists you like are kept in the account. A username you give up is held for 90 days so nobody can take it to pass as you. The admin page shows the site's owner your email, username, display name, when the account was made and last signed in, how many passkeys and sessions it has and whether it is suspended, to answer your requests and to act on reports. It lists accounts by username and display name, never with what anyone saved, went to or liked. Like every site, the person who runs it can also reach the database itself, and uses that only to answer your requests and keep the site working; sign-in codes and session tokens are stored hashed, so even there they can't be read. Your account is as safe as your email: anyone who can read your inbox can ask for a code and sign in, so keep that account safe too.
  • What you submit. A link, a caption and up to five images. Images are re-encoded when they arrive, which removes their hidden data (location, camera, comments). A person reviews every submission before anything from it is listed, and only the event details and the flyer are shown publicly, never the device code or your account.
  • A problem report. What you write on the Report a problem page, the kind and severity you choose, the page and event it's about, the short device summary shown on the form (such as “iPhone, Safari 26”, never your browser's full identification), your email if you give one (used only to answer this report), and a screenshot if you add one (re-encoded, which removes its hidden data). A report isn't tied to your device code, so Clear my data doesn't touch it; to have one deleted, email privacy@chirave.com with its ticket number. Reports never change the site by themselves. An email left on a report is used to reply to it, including one email to say it's fixed.
  • Your address on the network (IP). Our server uses it, in memory only, to limit how fast one address can ask for sign-in codes, send submissions, problem reports or wrong admin passwords. We don't store it. Cloudflare, which carries every request to the site, sees it too (below).
  • Server logs. Our server records which pages and data were requested, including what you searched for, without your IP address, to find faults. They're kept until they roll over, usually days. Mail we send is logged with the address hashed, never in clear; sign-in attempts are logged without the address. If the bot check can't finish in your browser, the page reports Cloudflare's error code, and the log keeps it with your browser's name and version (its user agent), never your IP address.
  • Email you send us. Mail to contact@, admin@ or privacy@chirave.com reaches the person who runs the site. We keep it only as long as we need to answer.
  • Email we send you. Only the mail an account needs: your sign-in code, a notice when a passkey is added, and a confirmation when your account is deleted. Never newsletters or promotions. It comes from no-reply@chirave.com; replies go to contact@. We will never email you a link to sign in: the code is typed on chirave.com, and only in the browser where you asked for it.
  • Events from Instagram. The site reads public posts by promoter, venue and artist business accounts through Instagram's official API. That's about events, not about visitors.

What a friend can see

Nothing, until you add a friend, and then only what you choose. A friend is someone who asked and you accepted, or the other way round; people find each other by exact username or by an invite link you sent, never by email, and nobody can browse a list of users. A friend sees your display name and username, and the upcoming nights you marked Going, except the ones you marked private. If you turn on the switches in Settings, a friend also sees the nights you marked Been there and the artists you like, again except the private ones. A friend never sees what you saved, your ratings, your For you, your other friends, your email or your sessions. On an event page, your friends see that you're going, by name; nobody else does, and the count is never public. A secret or RSVP night shows a friend exactly what the public page shows and nothing more. Removing a friend, blocking someone or flipping a switch takes effect at once. One thing we can't undo: a friend who already saw something may have taken a screenshot of it, so share what you'd be fine being passed on. If you report someone, we keep your report with your account on it, and the person reported is never told who reported them.

Who else handles it

  • Cloudflare carries every request, protects the site, stores our encrypted backups (R2) and forwards our email. It gets every request, including your IP address; the backups; and email to our addresses. On Submit, Report a problem and when you ask for a sign-in code, its Turnstile check looks at your browser for signs of a bot before anything is sent; we ask Cloudflare to confirm the result, without your IP address, and keep nothing from it.
  • DigitalOcean runs the server, in the US. It holds everything the site stores.
  • Postmark (ActiveCampaign, LLC, United States) sends our sign-in codes and account notices. It gets your email address and the message we send, keeps both for 45 days, in the US, under a data-processing agreement that stops it using your address for anything else. If a message to you bounces, Postmark keeps your address on its suppression list for our account so we don't keep sending to a dead address, and we can remove it on request. We don't send marketing email.
  • Anthropic reads posts and submissions to pull out event details (an AI model). It gets their text and images. Public pages about an artist may be looked up through its web search to describe their genre; the site shows the page each such genre comes from. By default Anthropic deletes what it receives through its API within 30 days (longer only for something flagged under its usage policy), and its commercial terms say it doesn't train its models on it. The site never sends problem reports to its AI model. To fix a problem, the site's developer may paste a report's text, page and device summary (never your email or screenshot) into an AI coding assistant, Anthropic's Claude Code, under the same terms.
  • Meta (Instagram) is the source of the public posts. It gets nothing about you.
  • Discogs gives artist information. It gets artists' names.
  • MusicBrainz tells us which artist an Instagram, SoundCloud, Resident Advisor or Bandcamp page belongs to. It gets those artists' public page addresses, never anything about you.
  • OpenStreetMap (Nominatim) turns a venue's public address into a map position. It gets addresses printed in posts, never yours.
  • OpenFreeMap provides the map's tiles. Your browser loads them directly from it, so it sees your IP address and the map area you look at.
  • Healthchecks.io and ntfy.sh alert the site's owner when something breaks. They get nothing about you.
  • GitHub holds the site's code. It gets nothing about you.

How long

  • What's under your device code: until you clear it (below), or until the cookie runs out after two years.
  • Your account: until you delete it. A deleted account is removed from the live database at once (its email, names, passkeys, sessions, and everything you saved, liked, marked and rated) and leaves the backups within six months, as they roll off. The only things kept are the text of problem reports you sent, with your account removed from them, and your username on its 90-day hold.
  • A sign-in code: it stops working after 10 minutes or when used, and its record is deleted within two days. The copy of the email at Postmark is gone after 45 days.
  • A session: 30 days after it was last used, 180 days at most, or when you sign it out.
  • A friend request nobody answered: 30 days, then it's gone and can be sent again.
  • Friendships and blocks: until you remove or lift them, or one of you deletes their account. A person who comes back with a new account is a stranger to everyone.
  • A suspended account: kept, with sign-in refused, until we resolve the report or you ask privacy@ to delete it; we delete it ourselves after a year if neither happened.
  • Submissions: the details of a listed event stay in the archive. Images from a submission that isn't listed are deleted within two days once we turn it down or nothing in it was an event, and after 30 days in any case. Their web address is never shown to anyone before an event uses one as its flyer. The device code is removed from every submission after 30 days.
  • What the AI read from a post: deleted 90 days after it read it, so never later than 90 days after the event.
  • Problem reports: the email and the screenshot are deleted 30 days after the report is closed. The rest of the report is kept, to keep track of the fix.
  • Backups: kept up to six months, then rolled off. Something you delete leaves the backups within that time.

Your choices

  • Clear my data (on Me, when you're not signed in) deletes everything under this browser's device code from our server at once (saves, likes, Been there, ratings) and from this browser. Delete my account (signed in, under Settings) deletes the account and everything in it at once, on every device; the backups roll it off within six months. Your past submissions stay listed if they were, but no longer point to you.
  • Sign out everywhere (under Settings) ends every session at once, including this one.
  • Download my data (on Me, or under Settings when you're signed in) gives you one file with everything under your device code or, when you're signed in, everything in your account: profile, sessions, passkeys' names, Going, Been there, ratings, saves and liked artists.
  • Anything else (a submission you want gone, a question): email privacy@chirave.com. We answer within 30 days.
  • Promoters, venues and artists can ask us to take down a post, a flyer or an event: privacy@chirave.com (see the Terms).
  • Is this your flyer? Under every flyer on an event page, “Remove it” takes that flyer off the site at once; the night's other details stay up. It opens a problem report with the event, what you write and your email if you give one (used only to reply), kept like any other report, and a person checks it and can put a flyer back if the request wasn't genuine. The same bot check as Report a problem runs on it.

Do Not Track and Global Privacy Control

We don't track you across sites and no one else does on chirave.com, so the site works the same whether or not your browser sends these signals.

Children

Chi Rave is for adults; most events are 18+ or 21+. It isn't meant for children under 13, and we don't knowingly collect their information. An account needs you to confirm that you are 18 or older; if you say you aren't, nothing is made and the code we sent you is deleted from our side (our email provider keeps the sent email for its 45 days). If you think a child has sent us something or made an account, email privacy@chirave.com and we'll delete it.

Security

Everything goes over HTTPS, backups are encrypted, and the admin pages need a long password. Sign-in codes and session tokens are stored only as hashes, there are no passwords to steal, and a passkey's secret never leaves your device. A passkey is quicker and can't be phished; anyone who can read your email can still sign in with a code. If your information were ever exposed, we'd tell you by email from no-reply@chirave.com and on this page, and tell the authorities as the law requires. We will never email you a link to sign in; go to chirave.com yourself.

Back to the events