Privacy Policy

Kirtan Fi is a free record label, service and home for recorded Gurbani Kirtan in all genres and Katha. It is a trading brand of Sikh Music Records Ltd (SMR), a company registered in England & Wales. This policy covers Kirtanfi.com, Kirtan.Fi, Kir.tn, Kathafi.com & Katha.Fi — what is collected when you listen, save and write in, and what is done with it.

The honest summary: SMR collects the minimum needed to run a listening service, never sells your information, and builds no advertising profiles.

Your listener account. Sign-in is passwordless — SMR holds your email address and the display name you choose. There is never a password to store, and so never a password to leak.

Your Library. The releases and tracks you save, so your Library is there when you return.

Listening activity. What is streamed and for how long, in aggregate — so SMR knows what the Sangat is actually listening to and how well the platform serves them.

Site analytics. SMR uses Google Analytics to understand how the site is used — which pages are visited, how visitors arrive, approximate location derived from IP address, and device and browser type. Google sets its own cookies for this and assigns your browser a random identifier so repeat visits count as one visitor. It is not used to build advertising profiles.

Messages you send. If you use the contact form, SMR keeps your name, email, chosen topic and message for as long as is reasonably needed to respond.

Technical logs. The hosting provider records IP address, browser type and pages visited — used only to keep the site working and to defend it against abuse.

UK GDPR requires a clear legal basis for each use. SMR’s are:

• Contract — running your account, your Library and the streaming service you signed up for. Without the email address, sign-in is impossible.
• Consent — release-news and platform-update emails are strictly opt-in, never opt-out by default. Withdraw at any time with one click.
• Legitimate interest — site security, abuse prevention, and understanding aggregate listening patterns.

The infrastructure providers that make the service run: the platform that hosts the site and streams the audio, and the service that delivers sign-in codes and emails. Google also receives site-analytics data through Google Analytics. Each receives only what it needs to do its job.

SMR does not sell your information, does not share it with advertisers, and builds no advertising profiles. If the law ever compels a disclosure, only what the law requires is disclosed.

Account details and your Library: for as long as your account is open. Delete your account and they go with it. Contact-form messages: as long as reasonably needed to respond and keep an operational memory of the exchange. Technical logs: short-lived, on the hosting provider’s standard rotation.

Under UK GDPR you can ask SMR, at any time, to:

• Access — see a copy of what SMR holds about you
• Rectify — correct anything inaccurate
• Erase — delete your information (deleting your account does most of this instantly)
• Restrict or object — limit what SMR does with it
• Port — receive it in a machine-readable form

Exercising a right costs nothing and changes nothing about how you are treated. If you are unhappy with SMR’s answer you can complain to the Information Commissioner’s Office.

Some are strictly necessary: a session cookie keeps you signed in, bot-protection sets what it needs to tell humans from scripts, and the player stores your listening preferences and an identifier that lets guest listening work without an account. Google Analytics also sets analytics cookies, which are not strictly necessary. There are no advertising cookies and no ad profiles, and nothing is shared with data brokers.

Everything we store on your device, and how long each one lasts:

• kf_consent — first-party cookie — remembers your cookie choice — 180 days (re-asked on expiry or if our categories change)
• kf_session — first-party cookie — keeps you signed in — 30 days
• kf_guest — first-party cookie — guest listening session — 7 days
• _ga — Google Analytics — distinguishes users — 2 years (only set if you accept analytics)
• _ga_8H9HHQ6Y44 — Google Analytics — session state — 2 years (only set if you accept analytics)
• kf:consent-nudge — browser sessionStorage — remembers that you closed the cookie notice so we do not ask again in this visit — cleared when you close the tab
• kf:listen-gate — browser sessionStorage — free-listening allowance — cleared when you close the tab
• kf:listen-gate-resume and kf:player-state — browser sessionStorage — player state — cleared when you close the tab
• kf:spectrum-on — browser localStorage — remembers the spectrum visualiser toggle — stays until you clear browsing data

You are asked to choose on your first visit, and you can change that choice at any time. The Cookie settings link in the footer reopens the preferences dialog; turning analytics off there also removes the analytics cookies already on this device.

Bot protection. Sign-in and guest listening sessions are protected by Cloudflare Turnstile, which processes signals such as your IP address, user-agent and TLS fingerprint to distinguish humans from bots. Cloudflare’s Turnstile Privacy Addendum sets out what it collects and how it is used.

Privacy questions, or exercising any right above: email privacy@kirtanfi.com or write in through the contact form. Every message gets a reply.