Privacy Policy

Last updated: March 26, 2026

This Privacy Policy explains how we collect, use, store, and share your personal data when you use our application ("Service"). As a company based in France, we are subject to the General Data Protection Regulation (GDPR) and comply with French data protection law enforced by the CNIL.

Please read this policy carefully. By using the Service, you acknowledge that you have read and understood it.

1. Data Controller

The data controller responsible for your personal data is:

Alex LK Address: 3B Impasse barnabé, 34000 Montpellier, France Email: lrzalexandre@gmail.com

2. Data We Collect

2.1 Account Data

When you create an account, we collect:

Your name or username
Your email address
Your authentication credentials (managed securely via Auth.js / NextAuth)

We do not store your password in plain text. Authentication is handled by Auth.js using secure, industry-standard protocols.

2.2 Profile Data

You may voluntarily provide:

Links to your social media profiles (Twitter/X and any other social networks you choose to add)

This information is visible to other users who join the same events as you. You are entirely in control of what you share and can update or remove it at any time.

2.3 Location Data

To generate local events, we collect your approximate city-level location. Specifically:

We detect which of our supported cities (~40,000 worldwide) you are located in
Location is accessed only when you are actively using the Service
We do not track your location continuously in the background

Legal basis: Your explicit consent, given when you enable location access. You may withdraw this consent at any time via your device settings.

2.4 Usage Data

We may collect basic technical data generated by your use of the Service, including:

Events you have joined
Timestamps of actions (joining, leaving events)
Device type and browser/app version
IP address (used for city detection and security purposes)

Legal basis: Our legitimate interest in operating and improving the Service.

3. How We Use Your Data

We use your personal data for the following purposes:

| Purpose | Legal Basis | |---|---| | Creating and managing your account | Performance of contract | | Detecting your city to generate relevant events | Consent | | Displaying your profile to other event participants | Consent | | Ensuring the security and integrity of the Service | Legitimate interest | | Responding to your support requests | Legitimate interest | | Complying with legal obligations | Legal obligation |

We do not sell, rent, or share your personal data with third parties for advertising or commercial purposes.

4. Visibility of Your Information to Other Users

This is an important aspect of how the Service works. When you join an event, the following information becomes visible to other participants of that same event:

Your username or display name
Your social media profile links (Twitter/X and any others you have added)

You consent to this visibility by actively joining an event. You can manage what social information is visible by editing your profile at any time. Removing information from your profile will prevent it from being shown in future events, but we cannot retroactively control what other users may have already seen.

5. Third-Party Service Providers

We use the following third-party services to operate the platform. These providers act as data processors on our behalf and are contractually bound to protect your data:

Supabase

Purpose: Database storage (user accounts, events, profile data)
Location: United States (AWS infrastructure, us-east-1 by default)
Safeguard: Standard Contractual Clauses (SCCs) under GDPR Article 46 for data transfers outside the EU
Privacy policy: https://supabase.com/privacy

Auth.js (NextAuth)

Purpose: Authentication and session management
Data processed: Email address and session tokens, stored in Supabase
Privacy policy: https://authjs.dev

Vercel

Purpose: Application hosting and deployment
Location: Global CDN (may include non-EU servers)
Safeguard: Standard Contractual Clauses
Privacy policy: https://vercel.com/legal/privacy-policy

We do not currently use any third-party analytics or advertising services.

6. International Data Transfers

Because Supabase stores data on AWS infrastructure in the United States, your data may be transferred outside the European Economic Area (EEA). We ensure that such transfers are protected by Standard Contractual Clauses (SCCs) as approved by the European Commission, in accordance with GDPR Article 46.

If you wish to keep your data within the EU, you can self-host Supabase or contact us to discuss options.

7. Data Retention

We retain your personal data for as long as your account is active. If you delete your account:

Your profile data and social media links are deleted within 30 days
Your email address is deleted within 30 days, unless we are required to retain it for legal or fraud-prevention purposes
Aggregated or anonymised data (e.g. city-level event statistics with no personal identifiers) may be retained indefinitely

8. Cookies and Local Storage

We use strictly necessary cookies and local storage for:

Maintaining your authenticated session (via Auth.js)
Storing your preferences

We do not use any tracking, advertising, or analytics cookies. No cookie consent banner is required for strictly necessary cookies, but we inform you here in the interest of transparency.

9. Children and Minors

The Service is strictly intended for users 18 years of age or older. We do not knowingly collect personal data from minors. If we become aware that a user is under 18, we will immediately suspend and delete their account and associated data.

If you believe a minor has created an account, please contact us at lrzalexandre@gmail.com.

10. Your Rights Under GDPR

As a user, you have the following rights regarding your personal data:

Right of access — You can request a copy of all personal data we hold about you
Right to rectification — You can ask us to correct inaccurate or incomplete data
Right to erasure — You can request deletion of your personal data ("right to be forgotten")
Right to restriction — You can ask us to temporarily limit how we process your data
Right to data portability — You can request your data in a structured, machine-readable format
Right to object — You can object to processing based on legitimate interest
Right to withdraw consent — Where processing is based on consent (e.g. location), you can withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at: [your-email@example.com]

We will respond within 30 days. We may ask you to verify your identity before processing your request.

11. Right to Lodge a Complaint

If you believe we have processed your personal data in violation of the GDPR, you have the right to lodge a complaint with the French data protection authority:

CNIL (Commission Nationale de l'Informatique et des Libertés) Website: https://www.cnil.fr Phone: +33 1 53 73 22 22

12. Data Security

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure, including:

Encrypted connections (HTTPS / TLS) for all data in transit
Row-Level Security (RLS) on Supabase to ensure users can only access their own data
Secure session management via Auth.js
Regular review of access permissions

No system is 100% secure. If you believe your account has been compromised, please contact us immediately.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by updating the "Last updated" date and, where appropriate, by sending an email notification.

Continued use of the Service after changes are posted constitutes your acceptance of the updated policy.

14. Contact

For any questions, requests, or concerns about this Privacy Policy or your personal data:

Alex LK Email: lrzalexandre@gmail.com Address: 3B Impasse barnabé, 34000 Montpellier, France

This Privacy Policy was last updated on March 26, 2026.