Privacy Policy

Interpretation and Definitions

Interpretation

The words whose initial letters are capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

• Account — A unique account created for You to access our Service or parts of our Service.
• Application — Refers to Yesandi, the software program provided by the Operator.
• Cookies — Small files that are placed on Your computer, mobile device or any other device by a website, containing the details of Your browsing history on that website among its many uses.
• Country — Refers to Australia.
• Device — Any device that can access the Service such as a computer, a cell phone or a digital tablet.
• Operator — (referred to as "We", "Us" or "Our" in this Privacy Policy) means the individual who builds and runs Yesandi as a personal project: Augusto Jacquier, based in Australia. Yesandi is not a company, partnership or other legal entity.
• Personal Data — Any information that relates to an identified or identifiable individual. We use "Personal Data" and "Personal Information" interchangeably unless a law uses a specific term.
• Service — Refers to the Application or the Website or both, including the pages that can be viewed without an Account.
• Service Provider — Any natural or legal person who processes the data on behalf of the Operator. It refers to third-party companies or individuals engaged by the Operator to facilitate the Service, to provide the Service on behalf of the Operator, to perform services related to the Service or to assist the Operator in analyzing how the Service is used.
• Usage Data — Data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).
• Website — Refers to Yesandi, accessible from https://yesandi.app.
• You — The individual accessing or using the Service, or the company, or other legal entity on behalf of which such individual is accessing or using the Service, as applicable.

Collecting and Using Your Personal Data

Types of Data Collected

Personal Data

While using Our Service, We may ask You to provide Us with certain personally identifiable information that can be used to contact or identify You. Personally identifiable information may include, but is not limited to:

• Email address
• Display name
• Username
• Profile photo (avatar)
• Usage Data

User Accounts

To use Yesandi You must create an account. When You register, We collect Your email address, a display name and a password. We create a username from Your email address, which You can change. You may optionally upload a profile photo. Your password is stored by Supabase only in scrambled (hashed) form, so We never see it. When You choose a password, the first five characters of a scrambled version of it are checked against the Have I Been Pwned list of passwords exposed in data breaches, so We can ask You to pick another; the password itself is never sent. Your account information is stored securely via Supabase and is used solely to provide You with the Service. You can update or delete Your account information at any time from Your account settings.

User-Generated Content

Yesandi allows You to create and share content including events (titles, descriptions, dates, venue details, and images), messages sent to other users, and wishlist entries. Content You create may be visible to other users of the Service depending on your privacy settings: an event set to "All friends" is seen by Your friends and by anyone already on its guest list; "Close friends" by the friends You have marked as close; "Just me" by You alone. Pictures for events that come from venue websites or emails may be copied into Our own storage at a smaller size, so they load quickly. We store this content on Our servers and those of Our Service Providers. You retain ownership of content You create, but by posting it You grant Us a non-exclusive, royalty-free licence to store, display, and distribute it as necessary to operate the Service.

Usage Data

Usage Data is collected automatically when using the Service.

Usage Data may include information such as Your Device's Internet Protocol address (e.g. IP address), browser type, browser version, the pages of our Service that You visit, the time and date of Your visit, the time spent on those pages, unique device identifiers and other diagnostic data.

When You access the Service by or through a mobile device, We may collect certain information automatically, including, but not limited to, the type of mobile device You use, Your mobile device's unique ID, the IP address of Your mobile device, Your mobile operating system, the type of mobile Internet browser You use, unique device identifiers and other diagnostic data.

Information Collected while Using the Application

While using Our Application, in order to provide features of Our Application, We may collect, with Your prior permission:

• Pictures and other information from your Device's camera and photo library
• Approximate location (city-level) from your Device's GPS or network positioning

We use this information to provide features of Our Service, to improve and customise Our Service. You can enable or disable access to this information at any time through Your Device settings.

Location data: The first time You open the feed or Discover after signing in, We will ask for permission to access Your device's approximate location. This is used solely to determine which city (Melbourne or Sydney) to show You events for. Only the resulting city name is stored on Your profile — Your precise coordinates are never retained or transmitted beyond Your device. You can change Your city at any time in Settings. Location data is not shared with third parties and is not used for advertising or tracking purposes.

Calendar Sync

If You paste a calendar's secret iCal link in Settings, We store it and fetch the calendar once a day. Each upcoming entry's title, date, time, place and notes is saved to Your account for You to review; no one else sees it unless You post it. The title and notes of new or changed entries that mention tickets or prices are sent to Google Gemini to find the price and seating. Entries You delete are remembered so they don't come back. Remove the link in Settings to stop.

Booking Emails You Forward

Your account has its own Yesandi email address. If You forward a booking or ticket email to it from the email address on Your account, the email is received through Cloudflare Email Routing and its text is sent to Google Gemini to pull out the event details. We save the event to Your account as "Just me"; the email itself is not kept.

Tracking Technologies and Cookies

We use a small number of Cookies, and Your browser's local storage, to keep You signed in and remember a few choices. We do not use them for advertising or to follow You around the web.

A cookie is a small file placed on Your Device. You can instruct Your browser to refuse all Cookies or to indicate when a Cookie is being sent. However, if You do not accept Cookies, You will not be able to sign in.

We use both Session and Persistent Cookies. Session Cookies are deleted as soon as You close Your web browser. Persistent Cookies remain on Your device when You go offline.

• Sign-in Cookies

  Type: Persistent Cookies · Administered by: Us

  Purpose: These keep You signed in (set by Supabase) and remember that Your account is active. They are essential: without them You cannot use the Service.

• Sign-up Cookie

  Type: Persistent Cookie, up to a day · Administered by: Us

  Purpose: After You sign up, this keeps Your email address so "Check your inbox" can show it and send the link again. It is deleted when You confirm Your email.

• Local storage

  Type: Stored on Your Device · Administered by: Us

  Purpose: Remembers small choices such as light or dark mode, and that You dismissed a prompt. It never leaves Your Device.

Analytics

We do not use any analytics or visitor-tracking product, and We do not record how You move through the Service. On the public What's On pages We count clicks on ticket links and sign-up buttons (the page, the city and the referring website's name), with no user, cookie, IP address or device details attached.

Our hosting provider processes standard server request logs in the ordinary course of serving the Service, as described under Vercel below.

Email Communications

We send transactional and notification emails to users of the Service. These emails may include:

• Account verification and password reset emails
• Activity involving You: messages, group chats, ticket offers, friend requests, friends joining Your plans, event changes, reminders, spare-ticket alerts and wishlist suggestions
• New events from friends, only if You turn these on
• Service-related announcements (e.g. changes to these policies)

Alerts come as push notifications on devices where You have turned them on, and by email when there is no device to send to. You can switch any type off in Settings, and mute any friend. Push notifications are delivered through Your browser's push service (for example Apple, Google or Mozilla).

If You invite someone who isn't on Yesandi to an event by email, We send them one invitation on Your behalf. To stop Yesandi being used to send junk, You can invite up to 10 people at a time and 30 a day.

We use Resend (Resend, Inc.) to deliver outbound emails. Resend may process Your email address and delivery metadata in accordance with their privacy policy at https://resend.com/legal/privacy-policy

We will not send You unsolicited marketing emails. If You believe You have received an email from Us in error, please contact us at hello@yesandi.app

Use of Your Personal Data

The Operator may use Personal Data for the following purposes:

• To provide and maintain our Service — including to monitor the usage of our Service.
• To manage Your Account — to manage Your registration as a user of the Service. The Personal Data You provide can give You access to different functionalities of the Service that are available to You as a registered user.
• To contact You — To contact You by email or other equivalent forms of electronic communication regarding updates, security notices, or informative communications related to the Service.
• To provide You with news and updates — about other goods, services and events which We offer that are similar to those that you have already used or enquired about, unless You have opted not to receive such information.
• To manage Your requests — To attend and manage Your requests to Us.
• If Yesandi changes hands — To hand the Service over to a new operator, on the terms described under Sharing Your Personal Data below.
• For other purposes — We may use Your information for other purposes, such as data analysis, identifying usage trends, and to evaluate and improve our Service, products, services, and your experience.

Sharing Your Personal Data

We may share Your Personal Data in the following situations:

• With Service Providers — We may share Your Personal Data with Service Providers to monitor and analyse the use of our Service and to contact You.
• If Yesandi changes hands — Yesandi is a personal project. If it is ever handed over to a new operator, Your Personal Data may be transferred to that operator on the condition that they honour this Privacy Policy. We will tell You before that happens, and You will be able to delete Your Account first if You prefer.
• With other users — When You create events or interact with other users, certain information (such as your username, profile photo, and event details) may be visible to other users of the Service. When You share an event link, it carries Your invite code: if someone signs up from it, You become friends once they confirm their email.
• With Your consent — We may disclose Your Personal Data for any other purpose with Your consent.

Detailed Information on the Processing of Your Personal Data

The Service Providers We use may have access to Your Personal Data. These third-party vendors collect, store, use, process and transfer information about Your activity on Our Service in accordance with their Privacy Policies.

Retention of Your Personal Data

The Operator will retain Your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use Your Personal Data to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our legal agreements and policies.

• User Accounts: retained for the duration of your account relationship plus up to 24 months after account closure.
• Usage Data: up to 24 months from the date of collection.
• Support correspondence: up to 24 months from ticket closure.

Transfer of Your Personal Data

Your information, including Personal Data, is stored in Australia (Our database and file storage run in Supabase's Sydney region) and is processed by the Service Providers named in this policy, some of which are located outside Australia, in particular in the United States and the European Union. This means Your data may be transferred to, and maintained on, computers in a jurisdiction where the data protection laws differ from those of Your own. We will take all steps reasonably necessary to ensure that Your data is treated securely and in accordance with this Privacy Policy.

Delete Your Personal Data

You have the right to delete or request that We assist in deleting the Personal Data that We have collected about You. You may update, amend, or delete Your information at any time by signing in to Your Account and visiting the account settings section. Deleting Your Account there removes Your profile, Your profile photo and the event pictures You uploaded. You may also contact Us to request access to, correct, or delete any Personal Data that You have provided to Us.

Please note, however, that We may need to retain certain information when we have a legal obligation or lawful basis to do so.

Disclosure of Your Personal Data

Under certain circumstances, the Operator may be required to disclose Your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency). The Operator may also disclose Your Personal Data in the good faith belief that such action is necessary to comply with a legal obligation, protect and defend the rights or property of the Operator, prevent or investigate possible wrongdoing in connection with the Service, protect the personal safety of Users of the Service or the public, or protect against legal liability.

Security of Your Personal Data

The security of Your Personal Data is important to Us, but remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. While We strive to use commercially reasonable means to protect Your Personal Data, We cannot guarantee its absolute security.

Australian Privacy Law

We are based in Australia and handle Personal Data in line with the Australian Privacy Principles set out in the Privacy Act 1988 (Cth), whether or not that Act strictly applies to a project of Yesandi's size. This section applies to everyone who uses the Service, wherever You are.

• Access and correction. You can ask Us what Personal Data We hold about You, and ask Us to correct it. Most of it is visible and editable in Your account settings; for anything else, email Us.
• Overseas disclosure. Some of the Service Providers named in this policy store or process data outside Australia, in the United States and the European Union. By using the Service You consent to that disclosure. Each of those providers publishes its own privacy commitments, linked above.
• Data breaches. If Personal Data is lost, or accessed or disclosed without authorisation, in a way that is likely to result in serious harm, We will tell affected users promptly and notify the Office of the Australian Information Commissioner (OAIC) where required.
• Complaints. If You think We have mishandled Your Personal Data, email hello@yesandi.app and We will respond within 30 days. If You are not satisfied with Our response, You can complain to the OAIC at oaic.gov.au.

GDPR Privacy Rights (EU Users)

If You are located in the European Union, You have certain data protection rights under the General Data Protection Regulation (GDPR). We aim to take reasonable steps to allow You to correct, amend, delete, or limit the use of Your Personal Data.

If You wish to be informed about what Personal Data We hold about You and if You want it to be removed from Our systems, please contact Us. In certain circumstances, You have the following data protection rights:

• The right to access, update, or delete the information We have on You.
• The right of rectification — the right to have Your information corrected if it is inaccurate or incomplete.
• The right to object to Our processing of Your Personal Data.
• The right of restriction — the right to request that We restrict the processing of Your Personal Data.
• The right to data portability — the right to receive a copy of Your Personal Data in a structured, machine-readable format.
• The right to withdraw consent at any time, where We rely on consent to process Your Personal Data.

Please note that We may ask You to verify Your identity before responding to such requests. You have the right to complain to a Data Protection Authority about Our collection and use of Your Personal Data. For more information, please contact Your local data protection authority in the European Economic Area (EEA).

CCPA / CPRA Privacy Rights (California Residents)

Under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), California residents have specific rights regarding their personal information.

• Right to Know: You have the right to request that We disclose what personal information We collect, use, disclose, and sell.
• Right to Delete: You have the right to request that We delete any personal information We have collected from You, subject to certain exceptions.
• Right to Correct: You have the right to request that We correct inaccurate personal information We maintain about You.
• Right to Opt-Out: You have the right to opt-out of the sale or sharing of Your personal information. We do not sell Your personal information.
• Right to Non-Discrimination: We will not discriminate against You for exercising any of Your CCPA rights.

To exercise any of these rights, please contact Us at hello@yesandi.app. We will respond to Your request within 45 days as required by law.

Children's Privacy

Our Service does not address anyone under the age of 18. We do not knowingly collect personally identifiable information from anyone under the age of 18. If You are a parent or guardian and You are aware that Your child has provided Us with Personal Data, please contact Us. If We become aware that We have collected Personal Data from anyone under the age of 18 without verification of parental consent, We take steps to remove that information from Our servers.

Links to Other Websites

Our Service may contain links to other websites that are not operated by Us. If You click on a third-party link, You will be directed to that third party's site. We strongly advise You to review the Privacy Policy of every site You visit. We have no control over and assume no responsibility for the content, privacy policies or practices of any third-party sites or services.

Changes to this Privacy Policy

We may update Our Privacy Policy from time to time. We will notify You of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. We will let You know via email and/or a prominent notice on Our Service prior to the change becoming effective. You are advised to review this Privacy Policy periodically for any changes.

Contact Us

If you have any questions about this Privacy Policy, You can contact us by email at hello@yesandi.app