Privacy Policy

Effective: September 29, 2026

About this policy

GetLitKCMO is a Kansas City nightlife guide. You can browse every venue, deal, and event without an account. You can also create an account to set up alerts.

This policy describes what the site actually does today, not just how it is supposed to work. Short version: browsing sends the usual hosting and analytics data to Vercel, Supabase, and Google. Accounts need a username and a password, never an email address. A lost password cannot be reset. We do not sell your data.

Browsing: what leaves your device

You do not need an account to browse.

Google's script loads on your first tap or key press, or about a second and a half after the page loads, whichever comes first. There is no cookie banner and no switch in the app to turn analytics off. See Your choices below.

This is what leaves your phone or computer when you browse.

Hosting: every page and request goes through Vercel, which hosts the site. Like any web host, Vercel receives your IP address, your browser details, and the pages you request.
Venue data: your browser loads listings straight from Supabase, our database provider. Supabase receives your IP address and browser details with each request, plus the filters used, such as the neighborhood you are looking at.
Google Analytics: every page you visit is reported with its address (including any text after the question mark), its title, the address of the page you came from, and the kind of page it is, such as a venue page or the calendar. Google's script also reports when you scroll most of the way down a page and the address of any link you tap that leads off the site. When you tap a venue's directions, call, website, tickets, menu, reservation, or Instagram link, or another link the venue lists, the venue's name and ID and the kind of link are sent as an event. On a venue page, a directions event also says which of the page's two directions links you used. We also send an event when you create an account, sign in, share a page, apply a filter, open a venue from a list or the map, build a crawl, or tap Report incorrect info on a venue page. That one sends the venue's name and ID, never anything you write in the email. The events we send never include your username, your password, anything you type in a search box, your crawl answers, or your coordinates. Google's script sets its own cookies in your browser and receives your IP address and browser details.
Google Ads: the same Google script reports the pages you visit to Google Ads, and reports arriving on the homepage as a conversion. This tells us whether ads bring people to the site. Third party vendors, including Google, may show our ads on other sites and use cookies to choose them based on your past visits here. You can opt out in Google's Ads Settings or on the Network Advertising Initiative's opt out page.
Vercel Analytics and Speed Insights: two small Vercel scripts run on every page, including error pages. They report page views and page speed measurements to Vercel.
Google Maps on venue pages: a venue page with an address shows a small Google map. Loading it sends your IP address, browser details, and any Google cookies to Google, along with the venue name and address being shown.
CARTO map images: the map page and the homepage map preview load their background map from CARTO. CARTO receives your IP address and the map area you are viewing.

Browsing: your location

The site asks for your location only when you tap a button that needs it. That is Deals near me on the home page, Near Me on Explore, Locate me on the crawl builder, or Show my location on the map.

Your coordinates stay in your browser. They are used to sort venues by distance, pick the nearest neighborhood, build a crawl, and center the map. They are not sent to our servers or to Google Analytics, and they are not saved. They are gone when you leave the page. Your browser may reuse a position it found in the last five minutes.

A few things can still reveal roughly where you are:

After Deals near me, the site loads deals for the neighborhood nearest you. That neighborhood name goes to Supabase as part of the request. Your exact coordinates do not.
If you then tap Start your Crawl, that neighborhood becomes part of the page address. Page addresses are reported to Google Analytics.
After Show my location, the map zooms to street level on your position, so the map images CARTO serves match your area.
If you tap Locate me on the crawl builder and build a crawl, the neighborhood nearest you goes to Supabase to load that neighborhood's venues. This works the same way as Deals near me. Your exact coordinates do not go to Supabase.
The crawl builder's Open in Maps link carries only your crawl's stops, never your coordinates. Google Maps may use your device's location to start the route, if you have allowed it to.

Browsing: what stays on your device

Some things never leave your browser.

Search text: the search boxes on the home page, Explore, and the map filter lists that are already in your browser. What you type is not sent anywhere.
Crawl builder answers: end time, number of stops, what you want, walking or driving, and how far you will go stay in your browser. Only the neighborhood you pick is sent to Supabase, to load that neighborhood's venues.
Text the Group Chat: this button hands the current page address to your phone's share sheet, or copies it to your clipboard. Where it goes from there is up to you. Google Analytics only learns that you shared the page, and whether you used the share sheet or copied the link.

Accounts

You can create an account on the Join page. It asks for four things: a username (3 to 30 letters) and a password (8 to 200 characters). It also needs a tick on the box that says I'm 21 or older, and a quick Cloudflare Turnstile check that you are human.

We never ask for, or store, a real email address. Sign in runs on Supabase Auth, which needs an email shaped value, so we make one up from your username: yourusername@u.getlitkcmo.com. That address cannot receive mail, and no confirmation email is sent. It is fixed at signup and never changes.

Your username, display name, and avatar emoji are the public part of your profile. No page shows them to other users yet, but the database lets any signed in account look them up by account id. Anyone, signed in or not, can check whether a username is taken, and can look up the made up sign in address for a username.

There is no way to change your username in the app.

Here is what your account holds. All of it is stored with Supabase.

Your username, your made up sign in address, and the time you created the account.
A copy of your username inside the Supabase Auth record.
The time you ticked I'm 21 or older. We do not collect your birthdate or your age.
An optional display name (up to 60 characters) and an optional avatar emoji, if you add them on the Account page. You can change or clear them there.
A profile visibility setting: it is set to friends for everyone. There is no control for it and no feature uses it yet.
Your sign in session: after you sign in, your browser keeps a session token in local storage so you stay signed in. It is sent to our server with every account request and to Supabase. Sign out removes it.

Your password

There is no password reset. No email is on file, so nothing can be sent to you. If you forget your password, the account cannot be recovered. You would need to create a new account with a new username. Keep your password somewhere safe.

At signup your password is sent to our server, which passes it to Supabase Auth. Supabase stores it as a hash. Our code does not store it, log it, or write it to any table. When you sign in later, your browser sends it straight to Supabase Auth.

On the Account page, Generate a new passphrase creates a new random passphrase in your browser and sends it to Supabase Auth. A recovery card then shows your handle and new passphrase with copy and download buttons. Copying or downloading puts them on your clipboard or in a file on your device, which we cannot see or remove.

When you press Continue on that card, your handle and new passphrase are saved in plain text in your browser's local storage on that device. That lets the Account page show it again with Reveal. Signing out does not remove it. Only deleting your account, or clearing the site's data in your browser, removes it. If you share a device, keep this in mind. The password you chose at signup is never saved this way.

Alerts and push notifications

Signed in users can set up alerts on the alerts settings page at /account/alerts. The first time you open that page, a settings row is created for you with default values.

Nothing in the app sends alerts yet. Your settings are stored so they apply when alerts launch.

The code also has room for features that are not built: friends, check ins, followed venues, and a notifications inbox. None of them collects anything today. When they launch we will update this policy.

Stored settings: which kinds of deals you want (happy hour, drink specials, food specials, live music). We also store which nights, whether Friends can ping you (on by default), whether push is on, and when you last changed a setting. The row also holds a default send hour and empty quiet hours, which have no controls yet.
Push notifications: Buzz this device only works once push is switched on for the site. When it is, turning it on first asks your browser for notification permission. Then it registers a small service worker and asks your browser's push service (Google, Apple, or Mozilla, depending on your browser) to create a subscription. We then store the subscription address, two encryption keys the browser generates, and the first 500 characters of your browser's user agent string. This is linked to your account. That is what a future sender would need to reach this device.
Turning Buzz this device off unsubscribes in your browser first, then deletes our copy if the browser still had the subscription to report. If that second step fails, or if you turn off notifications in your browser settings instead, our copy can remain until you delete your account. The service worker stays registered until you clear the site's data.
If a different account signs in on the same browser and turns push on, the stored subscription for that browser moves to the new account.

Abuse prevention

Two things happen when you try to create an account, whether or not it succeeds.

IP address log: our server records your IP address and the time of every account creation attempt, including attempts that fail. It uses that log to allow at most five attempts per IP address per hour. The log is not linked to your account and is not deleted when you delete your account. We do not currently have a schedule for clearing it.
Cloudflare Turnstile: the create account form loads Cloudflare's Turnstile widget in your browser. Cloudflare's script receives your IP address and browser details and runs its own checks to tell people from bots. When you submit, our server sends the widget's token and your IP address to Cloudflare to confirm the result. We do not store the token.

Venue owners and staff

Venue listings (names, addresses, hours, specials, events) are business information, not personal data. We publish them for everyone to see.

Our staff sign in to an admin area with a shared password. That sign in sets a cookie that holds only an expiry time, lasts up to eight hours, and is cleared on sign out. It also saves a marker in that browser's local storage that tells our analytics to treat the browser as staff, so its visits are left out of our reports. The marker stays until the browser's site data is cleared. Neither is ever set for visitors.

Who receives your data

We do not sell your data.

We do not control how long these services keep what they receive. Their own privacy policies apply.

We do not share it with anyone except the services that run the site, listed here with what each one gets.

Vercel: hosts the site and runs our server code. Receives your IP address, browser details, and every page and request. That includes the contents of account requests, such as your password at signup, your push subscription, and your alert settings. Also receives page views and speed measurements through Vercel Analytics and Speed Insights.
Supabase: stores accounts, profiles, alert settings, push subscriptions, and the signup IP log. Handles sign in. Receives your IP address and browser details when your browser loads venue data or signs in.
Google Analytics: receives the address, title, previous page and page type of every page you visit, scroll and outbound link events, the events listed under Browsing above, your IP address, browser details, and Google's own cookies.
Google Ads: receives the pages you visit and a homepage conversion event, your IP address, browser details, and Google's own cookies.
Google Maps: receives your IP address, browser details, and the venue shown when a venue page loads its map. Receives venue names, addresses, and locations when you tap a maps link. The site never sends it your coordinates.
CARTO: receives your IP address and the map area you view, including your own area after Show my location.
Cloudflare Turnstile: receives your IP address and browser signals on the create account form, and the verification token plus your IP address from our server.
Your browser's push service (Google, Apple, or Mozilla): creates and holds the push subscription for your browser when you turn on Buzz this device.
Gmail: holds any email you send us.

How long we keep data, and how to delete it

We keep account data until you delete your account. There is no automatic expiry and no inactivity purge.

To delete your account, open the Account page, scroll to Delete my account, and type your username to confirm. This permanently deletes your sign in record, and with it your profile, your alert settings, your push subscriptions, and any notification rows. It also removes the saved passphrase from that device and signs you out. There is no undo.

Separately: signing out removes your session token from that browser but does not remove a saved passphrase. See Your password above.

Some things are not removed by deleting your account:

The signup IP address log, because it is not linked to your account. Nothing clears it on a schedule today.
The push subscription inside your browser and the service worker. Turn off Buzz this device before deleting, or clear the site's data in your browser.
A saved passphrase or session on any other device you used. Sign out there, or clear the site's data.
Anything you emailed us.
Data already sent to Vercel, Supabase, Google, CARTO, or Cloudflare. Their retention rules apply.

Your choices

Here is what you control.

Browse without an account: every listing works without one.
Location: the site only looks when you tap a locate button. You can deny the browser's permission prompt, or never tap those buttons.
Analytics and ads: the app has no opt out switch and no cookie banner. Content blockers and browser privacy settings can block Google and Vercel scripts.
Profile: change or clear your display name and avatar emoji on the Account page.
Password: generate a new passphrase on the Account page. Remember that this saves it on that device.
Alerts: change any setting on the alerts settings page. Turn Buzz this device off to try to remove this device's push subscription. It usually works right away, but see Alerts and push notifications above for when our copy can stick around.
Sign out: clears your session token from that browser. Find it on the Account page.
Delete your account from the Account page at any time.

Age

GetLitKCMO is about bars and nightlife. Accounts are for people who are 21 or older. Creating an account requires ticking I'm 21 or older. We record the time you ticked the box, not your birthdate. If you are under 21, do not create an account.

Changes to this policy

When the site changes what it collects, we will update this page and change the effective date at the top. The version posted here is the one that applies.

Contact

Questions about this policy or your data? Email getlitkcmoupdates@gmail.com. There is no other way to reach us, and no in app request form.

Every contact link on the site, including Report incorrect info on venue pages, opens your own mail app addressed to the same address. Whatever you send there, including your email address, your message, and any photos, lands in that Gmail inbox. Google is the mailbox provider. The app itself does not store it. Tapping Report incorrect info also tells Google Analytics which venue the report is about, as described above, but nothing you write.