# Privacy Policy **Last updated: March 26, 2026** This Privacy Policy explains how we collect, use, store, and share your personal data when you use our application ("Service"). As a company based in France, we are subject to the **General Data Protection Regulation (GDPR)** and comply with French data protection law enforced by the **CNIL**. Please read this policy carefully. By using the Service, you acknowledge that you have read and understood it. --- ## 1. Data Controller The data controller responsible for your personal data is: **Alex LK** Address: 3B Impasse barnabé, 34000 Montpellier, France Email: lrzalexandre@gmail.com --- ## 2. Data We Collect ### 2.1 Account Data When you create an account, we collect: - Your name or username - Your email address - Your authentication credentials (managed securely via Auth.js / NextAuth) We do not store your password in plain text. Authentication is handled by Auth.js using secure, industry-standard protocols. ### 2.2 Profile Data You may voluntarily provide: - Links to your social media profiles (Twitter/X and any other social networks you choose to add) This information is **visible to other users** who join the same events as you. You are entirely in control of what you share and can update or remove it at any time. ### 2.3 Location Data To generate local events, we collect your approximate city-level location. Specifically: - We detect which of our supported cities (~40,000 worldwide) you are located in - Location is accessed only when you are actively using the Service - We do not track your location continuously in the background **Legal basis:** Your explicit consent, given when you enable location access. You may withdraw this consent at any time via your device settings. ### 2.4 Usage Data We may collect basic technical data generated by your use of the Service, including: - Events you have joined - Timestamps of actions (joining, leaving events) - Device type and browser/app version - IP address (used for city detection and security purposes) **Legal basis:** Our legitimate interest in operating and improving the Service. --- ## 3. How We Use Your Data We use your personal data for the following purposes: | Purpose | Legal Basis | |---|---| | Creating and managing your account | Performance of contract | | Detecting your city to generate relevant events | Consent | | Displaying your profile to other event participants | Consent | | Ensuring the security and integrity of the Service | Legitimate interest | | Responding to your support requests | Legitimate interest | | Complying with legal obligations | Legal obligation | We **do not** sell, rent, or share your personal data with third parties for advertising or commercial purposes. --- ## 4. Visibility of Your Information to Other Users This is an important aspect of how the Service works. When you **join an event**, the following information becomes visible to other participants of that same event: - Your username or display name - Your social media profile links (Twitter/X and any others you have added) You consent to this visibility by actively joining an event. You can manage what social information is visible by editing your profile at any time. Removing information from your profile will prevent it from being shown in future events, but we cannot retroactively control what other users may have already seen. --- ## 5. Third-Party Service Providers We use the following third-party services to operate the platform. These providers act as **data processors** on our behalf and are contractually bound to protect your data: ### Supabase - **Purpose:** Database storage (user accounts, events, profile data) - **Location:** United States (AWS infrastructure, `us-east-1` by default) - **Safeguard:** Standard Contractual Clauses (SCCs) under GDPR Article 46 for data transfers outside the EU - **Privacy policy:** [https://supabase.com/privacy](https://supabase.com/privacy) ### Auth.js (NextAuth) - **Purpose:** Authentication and session management - **Data processed:** Email address and session tokens, stored in Supabase - **Privacy policy:** [https://authjs.dev](https://authjs.dev/) ### Vercel - **Purpose:** Application hosting and deployment - **Location:** Global CDN (may include non-EU servers) - **Safeguard:** Standard Contractual Clauses - **Privacy policy:** [https://vercel.com/legal/privacy-policy](https://vercel.com/legal/privacy-policy) We do not currently use any third-party analytics or advertising services. --- ## 6. International Data Transfers Because Supabase stores data on AWS infrastructure in the United States, your data may be transferred outside the European Economic Area (EEA). We ensure that such transfers are protected by **Standard Contractual Clauses (SCCs)** as approved by the European Commission, in accordance with GDPR Article 46. > If you wish to keep your data within the EU, you can self-host Supabase or contact us to discuss options. --- ## 7. Data Retention We retain your personal data for as long as your account is active. If you delete your account: - Your profile data and social media links are deleted within **30 days** - Your email address is deleted within **30 days**, unless we are required to retain it for legal or fraud-prevention purposes - Aggregated or anonymised data (e.g. city-level event statistics with no personal identifiers) may be retained indefinitely --- ## 8. Cookies and Local Storage We use strictly necessary cookies and local storage for: - Maintaining your authenticated session (via Auth.js) - Storing your preferences We do not use any tracking, advertising, or analytics cookies. No cookie consent banner is required for strictly necessary cookies, but we inform you here in the interest of transparency. --- ## 9. Children and Minors The Service is strictly intended for users **18 years of age or older**. We do not knowingly collect personal data from minors. If we become aware that a user is under 18, we will immediately suspend and delete their account and associated data. If you believe a minor has created an account, please contact us at lrzalexandre@gmail.com. --- ## 10. Your Rights Under GDPR As a user, you have the following rights regarding your personal data: - **Right of access** — You can request a copy of all personal data we hold about you - **Right to rectification** — You can ask us to correct inaccurate or incomplete data - **Right to erasure** — You can request deletion of your personal data ("right to be forgotten") - **Right to restriction** — You can ask us to temporarily limit how we process your data - **Right to data portability** — You can request your data in a structured, machine-readable format - **Right to object** — You can object to processing based on legitimate interest - **Right to withdraw consent** — Where processing is based on consent (e.g. location), you can withdraw it at any time without affecting the lawfulness of prior processing To exercise any of these rights, contact us at: **[your-email@example.com]** We will respond within **30 days**. We may ask you to verify your identity before processing your request. --- ## 11. Right to Lodge a Complaint If you believe we have processed your personal data in violation of the GDPR, you have the right to lodge a complaint with the French data protection authority: **CNIL (Commission Nationale de l'Informatique et des Libertés)** Website: [https://www.cnil.fr](https://www.cnil.fr/) Phone: +33 1 53 73 22 22 --- ## 12. Data Security We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure, including: - Encrypted connections (HTTPS / TLS) for all data in transit - Row-Level Security (RLS) on Supabase to ensure users can only access their own data - Secure session management via Auth.js - Regular review of access permissions No system is 100% secure. If you believe your account has been compromised, please contact us immediately. --- ## 13. Changes to This Policy We may update this Privacy Policy from time to time. We will notify you of significant changes by updating the "Last updated" date and, where appropriate, by sending an email notification. Continued use of the Service after changes are posted constitutes your acceptance of the updated policy. --- ## 14. Contact For any questions, requests, or concerns about this Privacy Policy or your personal data: **Alex LK** Email: lrzalexandre@gmail.com Address: 3B Impasse barnabé, 34000 Montpellier, France --- _This Privacy Policy was last updated on March 26, 2026._