Privacy Policy

Privacy Policy

This Privacy Policy explains how Koder Ltd collects, uses, stores, shares, and protects personal data when you use Shindig.

In this Privacy Policy, "we", "us", and "our" mean Koder Ltd. "Shindig" means the Shindig application and related services.

By using Shindig, you acknowledge the practices described in this Privacy Policy.

1. Who we are

Shindig is operated by:

Koder Ltd
Company number: 15178678
United Kingdom

Contact email: info@getshindig.app

2. Age requirement

Shindig is intended for users aged 13 and over. We do not knowingly provide the service to children under 13.

3. The personal data we collect

Depending on how you use Shindig, we may collect the following categories of personal data.

Account and identity data

• name
• email address
• account identifier
• authentication provider data such as Google profile details where you sign in with Google
• profile image information where available

Profile and app data

• profile details you provide or edit
• contacts and related contact-management data
• event memberships and RSVP states
• event content you create, including titles, descriptions, locations, links, FAQs, polls, tasks, messages, and related participation data
• gallery uploads, captions, and image-related metadata needed to operate the gallery
• notification and preference data
• shared ledger records relating to expenses and off-platform settlement tracking
• subscription, purchase, and billing status data associated with paid features, such as transaction identifiers, subscription status, purchase status, and related records received from Polar

Partnership enquiries

• your name, company, email address and company website
• any group details or questions you choose to include in an enquiry
• campaign labels associated with the link you used to reach the partner page

Technical and session data

• information required to maintain authentication and secure sessions
• basic technical information generated through normal use of the app, such as request and device/browser context that may appear in server or infrastructure logs
• first-party usage events, such as page visits, button clicks and accepted enquiries, with browser/device information and approximate location where supplied by our infrastructure providers
• a randomly generated analytics identifier and session identifier stored in your browser, used to count unique visits and understand how visitors move through Shindig. These identifiers do not contain your name or email address. If you sign in, they may be linked to your account so we can understand how people discover and start using Shindig

Connected-app and API data

When you connect an app or AI assistant, we process records identifying the connected app and your account, the permissions you grant, authorization credentials needed to maintain the connection, and security records of API activity. Security audit records contain account and app identifiers, the operation and outcome, relevant event or resource identifiers where applicable, and the time of the operation. To prevent duplicate changes when an app retries a request, we also temporarily store a request fingerprint and the response to an accepted write, which may contain event, poll, task or other information returned by that operation.

We do not intentionally collect more personal data than is reasonably necessary to operate the service.

4. How we collect data

We collect personal data:

• directly from you when you create or update information in the app or submit a partnership enquiry
• from apps or AI assistants you authorize, when they send requests and information to Shindig on your behalf
• from supported identity providers when you sign in, such as Google
• through the normal technical operation of authentication, hosting, storage, payment, and email systems
• through first-party usage analytics stored in our backend

We use first-party analytics to understand how people use Shindig and whether our partner pages are useful. Analytics data is stored with our infrastructure provider (Convex) and is not shared with advertisers or third-party analytics companies. Partner-page analytics do not include the name, email address, company website or message submitted in the enquiry form. We do not use advertising trackers or marketing cookies. You can switch off usage analytics at any time in the analytics preferences at the bottom of this page.

5. How we use personal data

We use personal data to:

• create and maintain your account
• authenticate you and keep the service secure
• maintain connections you authorize, carry out permitted requests from connected apps or AI assistants, and prevent duplicate actions and unauthorized access
• operate core app features such as events, invitations, chat, tasks, contacts, gallery features, notifications, and the shared ledger
• send essential service communications such as sign-in links or service-related emails
• detect abuse, protect users, and maintain the integrity of the platform
• comply with legal obligations
• improve and maintain the service
• respond to partnership enquiries, help interested companies get started, and understand the effectiveness of our outreach

Submitting a partnership enquiry does not subscribe you to a marketing mailing list. We may email you in response to your enquiry and to discuss the partnership you have asked about. We do not currently send marketing newsletters.

6. Legal bases for processing

Where UK GDPR or similar laws apply, we rely on one or more of the following legal bases:

• performance of a contract: to provide the service you ask us to provide
• legitimate interests: to operate, secure, and improve Shindig, provided those interests are not overridden by your rights
• legal obligation: where we must process data to comply with applicable law
• consent: where consent is required for a specific activity

7. Authentication and email

Shindig currently supports authentication using Google OAuth and email sign-in codes. Password sign-in is also available for specifically enabled reviewer accounts; it is not a general sign-up method.

If you use Google sign-in, we may receive profile information from Google such as your name, email address, and avatar data.

If you use email sign-in codes, we process your email address in order to send a sign-in code and authenticate you.

For an enabled reviewer account, we process the password to authenticate the account and store a password hash rather than the plaintext password. Password setup and reset links are delivered by email. Sign-in credentials are entered in Shindig's authentication flow, not through its AI tools.

We may also use your email address to send essential account, security, or service-related communications.

Connected apps and AI assistants

Where a connection is available, you can authorize an app or AI assistant to access Shindig on your behalf. The authorization screen identifies the app and the permissions it requests. Depending on the permissions you grant, the app may receive identity or profile information, details of events you belong to, aggregate poll results, or information returned when it creates or updates event content. Publishing and access to event invite links require the relevant permission and event-host access. Your existing event permissions and plan limits continue to apply.

Shindig's current event-planning AI tools support event drafts and updates, polls, tasks, useful links and FAQs, and explicitly requested publication and invite-link retrieval. They do not provide access to event chat, gallery photos, ledger records or payment details. Authorized changes can have the same member-notification, reminder or service-email effects as the corresponding Shindig features.

Connecting an assistant does not by itself give Shindig access to your entire conversation history. We receive the information the connected app sends in its requests, including any event content you ask it to submit.

You can review granted permissions and disconnect an app in Settings → Connected apps when connected-app access is enabled. Disconnecting revokes the connection's further authorized access to Shindig. It does not delete events or other content already created, undo completed actions, cancel work already scheduled, or erase information the app or its provider has already received. Reconnecting requires authorization again.

8. Gallery privacy and uploads

Shindig processes event photo uploads to operate the gallery feature.

As part of the current app design, uploaded images are processed on the client before upload, including removal of EXIF metadata. This is intended to reduce unnecessary embedded metadata such as location or device details.

Event gallery images are treated as event content and may remain associated with an event even if the original uploader later deletes their account.

9. Shared ledger and payments

The shared ledger feature only records event-related expenses and off-platform settlement claims between users. Any actual payment or transfer between event participants takes place outside the app.

If you purchase a Shindig subscription or a paid event upgrade such as Super Shindig, checkout and payment processing are handled by Polar or its payment partners.

We may receive limited payment-related information needed to manage purchases and access to paid features, such as transaction identifiers, purchase status, subscription status, billing period information, and related records.

Payment card details are collected and processed by Polar or its payment partners rather than directly through Shindig.

10. Cookies, local storage and similar technologies

We do not use advertising cookies, marketing cookies or third-party tracking technologies.

We use essential session-related technologies required for authentication, security, and basic service operation.

We also store a small number of items in your browser's local storage. These include two analytics identifiers, shindig_visitor_id and shindig_analytics_session, which we use solely to collect statistical information about how Shindig is used so that we can improve it. We rely on the statistical purposes exception in the Privacy and Electronic Communications Regulations (as amended by the Data (Use and Access) Act 2025), which is why we do not show a cookie banner.

You can object to this at any time, free of charge:

• switch off usage analytics in the analytics preferences at the bottom of this page, or in Settings when signed in
• enable Global Privacy Control in your browser, which we treat as an objection

When you object, the analytics identifiers are deleted from your browser and no further usage analytics are sent from it.

11. Sharing personal data

We do not sell your personal data.

We may share personal data with service providers that help us operate Shindig, such as Convex for backend infrastructure and authentication, Polar for payment processing and subscription management, and providers involved in:

• hosting and infrastructure
• storage
• email delivery
• payment processing and subscription management

When you authorize a connected app or AI assistant, we share the information needed for its permitted requests with that app and its provider, such as OpenAI when you use a ChatGPT connection. This may include information about other participants contained in event content you are permitted to access. Review what you share and the permissions requested before connecting.

The connected provider's own terms and privacy policy govern its handling of information it receives, including its retention and any use for model training. Shindig does not control those practices, and disconnecting in Shindig does not delete copies held by that provider.

We may also disclose data where required by law, to enforce our terms, or to protect rights, safety, and the integrity of the service.

12. International access and transfers

Shindig is operated by a UK company and is accessible globally.

Shindig currently uses Convex infrastructure for backend, database, and authentication-related services, and that infrastructure is currently hosted in Northern Virginia, United States.

Where personal data is processed by providers or systems located outside the UK, including in the United States, we will take reasonable steps to ensure an appropriate lawful basis and safeguards are in place where required.

13. Data retention

We keep personal data for as long as reasonably necessary to operate Shindig, comply with legal obligations, resolve disputes, maintain security, and preserve legitimate event records where appropriate.

Retention periods may vary depending on the type of data, the feature involved, and our legal or operational obligations.

For connected-app and API records, the current automated cleanup rules are:

• Security audit records: records older than 90 days are eligible for deletion.
• Duplicate-action response caches and pagination records: records older than 24 hours are eligible for deletion. The response cache is used to make retries safe within a 24-hour window.
• OAuth access and refresh-token records: records with a finite expiry time are eligible for deletion when that expiry is more than 30 days in the past. Records without a finite expiry are not covered by this timed cleanup rule.

These cleanup jobs are scheduled daily and process records in batches; deletion is not guaranteed at the exact eligibility cutoff. Disconnecting removes the authorization grant, and associated stored token records are then cleaned up separately. Access revocation does not depend on that background deletion finishing.

Authorization grants are retained to maintain connections until disconnected or otherwise removed. Client registration records are not automatically deleted by the expiry cleanup. These rules do not delete the underlying event content or set retention periods for infrastructure logs, backups, or information held by a connected provider.

We retain partnership enquiries while handling the enquiry or maintaining the resulting partnership, and review enquiries that are no longer needed. You can contact us to request deletion of your enquiry. Enquiries are stored in Convex and an email notification is sent to our team through Resend.

Some account, transaction, and billing-related records may be retained for longer where reasonably necessary for legal, tax, accounting, fraud-prevention, or subscription-administration purposes.

14. Account deletion and anonymisation

Where account deletion features are used, some data may be deleted and some may be anonymised rather than fully erased, where that is necessary to preserve event history or system integrity.

For example, event-related records such as messages, memberships, or uploads may in some cases remain as part of the historical event record in anonymised form.

15. Your rights

Depending on the laws that apply to you, you may have rights to:

• access your personal data
• correct inaccurate personal data
• request deletion of personal data
• object to or restrict certain processing
• request a copy of your data
• lodge a complaint with a relevant supervisory authority

To make a privacy-related request, contact info@getshindig.app.

16. Security

We take reasonable technical and organisational measures to protect personal data, but no system can be guaranteed to be completely secure.

17. Changes to this Privacy Policy

We may update this Privacy Policy from time to time.

When we do, we will update the "Last updated" date on the page. Continued use of Shindig after an updated version takes effect means you acknowledge the revised Privacy Policy.

18. Contact

If you have questions about this Privacy Policy or want to make a privacy request, contact:

Andrew James Bingham
Koder Ltd
info@getshindig.app