Psyversum
Sign in

Privacy policy

This is a translation for your convenience. The German version is legally binding.

Who is responsible

Sabrina Kus, Heinz-Kühn-Str. 43, 51067 Köln, Germany
Email: allehin.com@gmail.com

The essentials

Hosting and server logs

The site is hosted by Vercel Inc. (USA). When you visit it, Vercel processes technically necessary data, for example your IP address, date and time, the address requested, browser and operating system, and the page you came from. This serves to deliver the site and to fend off attacks.

The legal basis is our legitimate interest in a secure and working service (Art. 6 (1) (f) GDPR). We have a data processing agreement with Vercel. Vercel is certified under the EU-US Data Privacy Framework, so transfers to the USA are covered by the European Commission's adequacy decision (Art. 45 GDPR). The logs are only kept as long as necessary for operation and security.

Visitor statistics

To see how Psyversum is used and to recognise requests from bots, we keep our own visitor statistics per portal, without services of other providers. For this we evaluate what your browser sends anyway when you open a page: the address requested without additional details, the host of the page you came from, the device type, operating system and browser derived from the browser identifier (we do not store the identifier itself), the language and your approximate location derived from your IP address, which our host Vercel provides to us (country, region, city). We do not store invitation codes or identifiers of private areas such as crews and rides.

We do not store your IP address. From it and the browser identifier we only form a checksum with a random value that we delete every day. This lets us recognise the requests of one day as one visit, but we cannot link visits on different days. Once the day is over, we also replace the checksum itself. When a page loads and when you switch pages in the app, the page sends a count signal that only transmits the address, and for an access link of our team also its code, solely to classify the request as internal (the code is not stored). It reads nothing from your device and stores nothing on it, and no cookie is used for it. We do not count the pages for confirming and unsubscribing from Psyversum Mail. The counting stays without your account. Separately, for signed-in accounts we record on which days and with which features you use Psyversum (see “Use with an account, helping out and feedback”).

We count actions such as signing in, signing up for Psyversum Mail, rides, crew and clicks on the ticket button, as well as started sign-ins, shared invitation links and app errors (without their content), in these statistics without any link to your account and without a time of day. If a sign-in cookie (ah_sitzung) is present, these statistics only use it for the note “logged in” and to classify the request as internal, and do not store your account. That you were active on a day and which features you used is recorded separately, without any link to this counting (see “Use with an account, helping out and feedback”).

We keep individual visits for 90 days and requests from bots for 14 days. After that only daily totals without any personal reference remain. The data is stored in the database at Supabase in Frankfurt am Main (see “Account and sign-in”). The legal basis is our legitimate interest in measuring the use of our own service (Art. 6 (1) (f) GDPR). The count signal reads nothing from your device and stores nothing on it. Your browser only sends the sign-in cookie when you are signed in; we only read it for this in requests that contain it anyway.

You can object to the visitor statistics at any time by emailing allehin.com@gmail.com. As we do not store any identifier of yours, however, we cannot assign individual entries to a person.

Use with an account, helping out and feedback

Use of your account

When you are signed in, we record per portal and day that you used Psyversum and which features: which area you open the app in (map, list, calendar, single parties, crews, rides, profile, Artist Galaxy, organisers, account) and what you did (saving and sharing parties, ticket button, sharing invitations, joining a crew or planning for a party in it, offering, looking for or requesting a ride, connecting, showing your mandala code, styling your profile, sending feedback). We do not store single pages, addresses or times, and there is no link to the visits in the visitor statistics. Days on which you acted as an admin are marked as internal; they do not count in the evaluations.

For this we read the sign-in cookie (ah_sitzung) that your browser sends anyway when you are signed in: when the app loads, when your notifications are fetched, with actions such as saving or rides and with feedback. We do not use the count signal of the visitor statistics for this, so we do not record which areas you switch between inside the app. Some features, for example whether you planned for a party in a crew or connected with someone, are added once a day from the details you stored there anyway.

We keep the details per day for 180 days, after that only totals without personal reference remain. We keep the first and last day of your use and the number of your active days until 2 years after your last use; they are deleted with your account. You see your own values (“last active” and active days) in your account.

Who sees what. The portal's admins see in a list your display name, roughly when you were last active (for example “last week”), the number of your active days and whether you help out or are a beta tester. We only show figures across all users from 5 people, also for every day and week that goes into an average, and over at least 7 days, so that they do not reveal what a single person did on a day.

The legal basis is our legitimate interest in improving Psyversum and seeing whether it brings people together (Art. 6 (1) (f) GDPR). You can object at any time (Art. 21 GDPR): in your account with the switch “Analysis of my usage” or by emailing allehin.com@gmail.com. We then delete the details per day right away and record nothing more until you switch it on again.

Help make Psyversum better

Only if you switch on “Help make Psyversum better” in your account and agree do we store your history in the app: which views you open, in which order, when and for how long, and where you stop a process. As the opened entry we only store public identifiers, for example the number of a party, never invitation codes and never profiles of other people. The switch is off from the start.

Who sees what. Your history is seen by the team that runs Psyversum technically (responsible: Sabrina Kus, see “Who is responsible”), and by the Psyversum admins only if the team has enabled this for the portal. Both see your history with your email address and the exact date; every view is logged in the admin area.

We keep the history for 90 days. The legal basis is your consent (Art. 6 (1) (a) GDPR). You can withdraw it in your account at any time (Art. 7 (3) GDPR); we then delete your history right away, including the steps in your feedback. If we change the consent text, we ask you again and store nothing until then. As proof we keep the version, a checksum of the text shown and the times of your consent and withdrawal for as long as your account exists.

Beta test

With an invitation link or a personal invitation from the admins (as a notification in the app) you can become a beta tester forPsyversum; you only become one once you agree yourself. “Help make Psyversum better” needs to be on for this, and you agree to it when you join. You send feedback via the bar “Beta tester · ✎ Feedback” at the top of the app. If you switch it off, the beta test ends right away. You can also end it yourself, and the team can end it. We store since when you take part, via which invitation, and when and why the test ended. For your first feedback that is put into practice you get the badge “Beta pioneer”, and the next level from 5 and from 10 pieces of feedback put into practice. For this we count how many of your feedback items were dealt with (declined ones do not count). The number stays even after the feedback itself has been deleted at the end of its period, and is deleted with your account.

If the portal has opened the beta test to everyone, you can also become a beta tester without an invitation: with the checkbox “I want to become a beta tester” in the first notice of the app or with the button “Become a beta tester” at the top of the app. For this you allow everything (see “Notices in the app and ‘Allow all’”), sign in and agree to “Help make Psyversum better”; the link “What beta testers send along” shows the text. We then store that you joined without an invitation. If you are not signed in yet, we remember your wish only in this browser tab (session storage, entry “pa-<portal>-beta-wunsch”) until you have signed in; then we delete it. The team can end a beta test at any time.

Who sees what. The portal's admins see your name, since when you take part and the number of your feedback messages in the beta test management.

Feedback and reports

Beta feedback and reports about rides, people, messages, parties, pages, crews and profiles go through one shared system. We store the type, reason, your text, the time and your account, for reports about a profile also a reported photo. Reported people never learn who reported them.

With beta feedback we automatically send: app version, which view is open and the opened entry (as a public identifier; for profiles of other people and for invitations only the type of view, never name or code), the spot you tapped (as position and name of the element, not as text), device type, operating system, browser and screen size, design, language, your role (beta tester or team) and app errors from the last 10 minutes (shortened, without email addresses and long numbers). Your last 20 steps in the app are only included if “Help make Psyversum better” is on. We only send a picture if you attach one yourself or choose the picture of the view. Your device blacks out the picture of the view automatically where names, photos, contact details and messages of others and invitation codes are shown; you see it before sending and can black out more. The picture without black-outs never leaves your device. We store pictures without metadata in non-public storage.

Who sees what. Feedback is seen by the team that runs Psyversum technically and by the portal's admins; the steps in it are only seen by the portal's admins with the same approval as the history. Depending on their type, reports are seen by the platform's moderation or by the portal's admins. Of the person who sends a report or feedback, the admins only see the name; only those responsible for the platform see the email address. Once your feedback has been dealt with, you get a notification in the app.

We delete pictures and steps 90 days after closing (done or declined), and closed reports and feedback 6 months after closing. For reports from before this shared system, these periods start no earlier than the day of the switch. We close open cases after 12 months without change at the latest. If you delete your account, we delete your feedback and your reports about profiles right away; other reports remain without your name.

The legal basis is our legitimate interest in protection and moderation (Art. 6 (1) (f) GDPR); for feedback you send yourself, our legitimate interest in finding bugs and improving Psyversum, for text, picture and context. For the steps your consent from “Help make Psyversum better” applies; if you withdraw it, we also delete the steps from your feedback.

What became of your feedback

Under “My feedback” in your account you see each of your feedback items with its type, the spot in the app, your text and the status (new, in progress, planned, done or declined), plus its history: when it arrived, when the team first read it, since when it is in progress or planned, and when it was done (with the app version) or declined. The team can reply to you there; only you and the team see the reply. You do not see the team's internal notes. You only get a notification in the app when your feedback is done; replies and other changes are shown on the page and as a number in the bar at the top of the app. For this we store the reply, the version, these times and when you last looked. If you add something with “Add something”, we store which feedback it belongs to. If the team enters a change with an internal tool, we note this with the code of the task.

What has changed. Beta testers and the team see a list of improvements that the team describes itself (title and one sentence): put into practice (with version), in progress and planned. The team can link your feedback to an entry. Others then only see how many feedback items an entry came from, never your text or your picture, and your name only if you allow it with a suggestion (see below); you see “also from you”. If linked feedback is deleted, we only keep counting it as a number without any link to you.

Your name with suggestions. With a suggestion you can tick that your name may be mentioned when the suggestion is put into practice. This tick is off from the start and only applies to this suggestion. Only with this tick does a completed entry show “Suggested by” with your display name (never your account name or email address), visible to beta testers and the team. You can remove the tick at any time with the feedback under “My feedback”; your name then disappears there right away. If your beta test ends (you end it, an admin ends it or you switch off “Help make Psyversum better”), we remove the tick from all your suggestions. If we later show completed suggestions publicly, they appear as “Suggestion from the beta test”; we only name you publicly with your consent, which we will then ask for separately. The legal basis for naming you is your consent (Art. 6 (1) (a) GDPR), which you can withdraw at any time (Art. 7 (3) GDPR).

View by admins. Portal admins who may handle feedback in the inbox can view the pages “My feedback” and “What has changed” the way you see them, to answer questions and find errors on the page. This only works for people who have sent feedback in this portal. They cannot change anything there and see nothing they do not see in the inbox anyway, not your email address either. Every such view is logged in the admin area. In the inbox the team also sees whether and when you last looked at a reply or change.

The periods for feedback apply to these details (see above): we delete the reply, times, version, link and tick together with the feedback 6 months after closing; we close open and planned feedback after 12 months without change at the latest. We keep the number of your feedback items that were dealt with, for the levels of the badge, until your account is deleted. Unless stated otherwise above, the legal basis is our legitimate interest in showing you what became of your feedback and in improving Psyversum (Art. 6 (1) (f) GDPR).

Sign-up form

When you sign up, we process your name, your email address, the name of your event, series or organisation and, if provided, the website and your message. We use this information to get in touch with you about Psyversum. We also add your email address to our interest list as an unconfirmed entry so that the confirmation link works. You only get Psyversum Mail if you expressly confirm it (see “Psyversum Mail and interest list”).

The legal basis is your request and the preparation of a possible collaboration (Art. 6 (1) (b) GDPR) as well as our legitimate interest in answering requests (Art. 6 (1) (f) GDPR).

The information is processed on Vercel's servers and sent as an email to allehin.com@gmail.com. We send a short confirmation of receipt to your email address, which does not contain your other details. As an organiser, it also contains a link to sign up for Psyversum Mail (double opt-in, see “Psyversum Mail and interest list”). For sending we use the email service Emailit, which sends the emails from its own data centre in Prague (Czech Republic, EU). Opens and clicks in these emails are not tracked. The mailbox is operated by Google (Google Ireland Limited, Ireland). We delete your information as soon as it is no longer needed for getting in touch and no statutory retention obligations apply.

Psyversum Mail and interest list

When you sign up for Psyversum Mail, the news from Psyversum by email, or register your interest as an organiser, we store your email address, whether you signed up as a guest or as an organiser, the language of the page, which form you used, the wording and version of your consent, and the times of signing up, confirming and, if applicable, unsubscribing. We do not store your IP address for this. As a guest you sign up with the checkbox when signing in or later via “✉ Mail” at the top of the app, in both cases with the email address of your account.

We use the double opt-in procedure: after signing up you receive an email with a link. Only when you confirm your sign-up on the linked page are you on the list and receive Psyversum Mail. As an organiser, you find this link in the confirmation of receipt of your request. If you don't confirm, we'll still get back to you personally, but won't send you Psyversum Mail. We automatically delete unconfirmed entries after 7 days. We only store the codes in the links as a checksum (hash).

You can unsubscribe at any time using the link in every email or by emailing allehin.com@gmail.com. After that you won't receive Psyversum Mail any more. We keep the entry with the times of consent and unsubscribing as proof for up to three years and then delete it.

The legal basis is your consent (Art. 6 (1) (a) GDPR), which you can withdraw at any time with effect for the future. We store the unconfirmed entry of an organiser (until confirmation, at most 7 days) on the basis of your request (Art. 6 (1) (b) GDPR) and our legitimate interest in offering you the sign-up for Psyversum Mail (Art. 6 (1) (f) GDPR). We keep the proof after unsubscribing based on our legitimate interest in being able to demonstrate consent (Art. 6 (1) (f) in conjunction with Art. 7 (1) GDPR). The data is stored in the database at Supabase in Frankfurt am Main (see “Account and sign-in”). We send the emails via Emailit (see “Sign-up form”), opens and clicks are not tracked.

Account and sign-in

You can use an account for features such as rides or crews. To do so, you enter your email address and receive a sign-in code by email (sent via Emailit, see above). In your account we store your email address and, if you enter them, your name, display name, ways to reach you, payment link and your confirmation that you are at least 18 years old. Others only see your contact details and payment link once you have connected with each other, and only the ones you share.

After you sign in, the site sets a cookie (ah_sitzung) that keeps you signed in for up to 90 days. It is technically necessary and only contains a random identifier. We only store codes and identifiers as a checksum (hash). Signing out deletes the cookie. Our visitor statistics only use an existing sign-in cookie for the note “logged in” or “internal” (see “Visitor statistics”). On which days and with which features you use your account is recorded separately (see “Use with an account, helping out and feedback”).

When you first sign in with a code, we store the time as confirmation of your account. We also store a base form of your email address (without anything after “+”, for Gmail without dots). We use it to limit the number of sign-in codes per address and to count each address only once for wishes (see “Artist Galaxy”).

Your display name. When you first sign in, we ask for a display name, you can't continue without it. A nickname is fine. If an older account doesn't have one yet, we ask once, and you can skip that question with “Later”. For this we store when we asked. Everyone who uses the portal sees your display name, for example on your profile, in “Find people”, with rides and in Crews, and so do the portal's admins. If you have no display name, we show your name from the account there instead. You can change both at any time in your account. We delete this data with your account.

Your city. In portals with artist pages we ask for your city once after you sign in. You pick it from a list. We store it on your account so you can bring acts to your city and the map starts near you, also in other portals you use with this account. We count wishes by city only and show totals only, never people. You can skip the question with “Later”, then we won't ask again. You need a city to make a wish. You can change it in your account, at most once a month. For this we store when you last changed it and whether we have asked. We delete this data with your account.

“Allow all”. If you chose “Allow all” in the app (see “Notices in the app and ‘Allow all’”), we store the version of the notices and the time of your choice on your account. If you withdraw it, we delete the version and only keep the time of the withdrawal so that it also applies on your other devices. We store the choice “Essential only” the same way: without a version, only with its time.

Blocking accounts. If an account is misused, for example for fraud or when someone pretends to be another person, an admin of the portal can block the account, permanently or until a date. We store the time, the duration, the reason, who blocked it and in which portal. The block applies to all portals. Running sign-ins are ended, signing in again is not possible and the account's wishes no longer count. Content of the account (for example crews, rides, requests) is kept and marked as “account blocked” for admins. These details are only visible in the admin area. The legal basis is our legitimate interest in protecting users and content (Art. 6 (1) (f) GDPR). The block details are deleted when the block is lifted; every block and every lifting is recorded in the admin log.

Profile picture and city on your profile. Once you have saved your profile, everyone who may see your profile header can see your profile picture, by default everyone signed in to the same portal (see “Profile”). The city from your account appears on your profile while “Show my city on my profile” is ticked under “Style your profile”. It is ticked from the start, and you can remove it at any time. For places with fewer than 10,000 inhabitants we show the nearest town with at least 10,000 inhabitants within 30 km instead, so your exact home town does not appear on your profile.

The data is stored in a database at Supabase (Supabase Inc., USA) in a data centre in Frankfurt am Main, Germany. The legal basis is the use of your account (Art. 6 (1) (b) GDPR). You can change your details in your account at any time and request the deletion of your account by email.

Rides

When you offer a ride, post a request or ask for a seat, we store the details: event, direction, start or destination (shown publicly only rounded to about 1 km), departure, seats, luggage, notes, the exact meeting point, how far you can travel to it, the status of the request, messages, ratings, reports and blocks. Others only see your display name, your rides and ratings. Contact details, payment link and meeting point are only visible to the people you are bindingly connected with. We do not store any cost contribution; the cost helper only runs in your browser. We delete messages after 30 days. Place searches go through our server to OpenStreetMap (Nominatim), which only receives the search term. To prevent abuse we count searches per account or, without an account, per checksum (hash) of your IP address and delete this count after one day. “Share location” in an emergency only runs on your device. The legal basis is arranging the ride (Art. 6 (1) (b) GDPR); for reports and blocks it is our legitimate interest in safe rides (Art. 6 (1) (f) GDPR). We delete reports 6 months after they have been dealt with (see “Use with an account, helping out and feedback”).

Crew

With an account you can start a crew or join one through an invite link. A crew is a lasting group in which you create parties for individual events. Only members see the crew. They see your display name, your role, your profile picture, what you post on the board, which events you suggest and which suggestions you say “I'm in” to. For a party, everyone taking part sees whether you're coming, whether you have a ticket, how you're getting there, a linked ride, your pledges on the packing list, pins on the map and what you share. A member only sees your name and the contact details you share in your account once you have connected with each other.

Through a party's guest link you join just this party as a guest without becoming a member. As a guest you only see this party; the members and the other guests see your details there as described above. The invitation page only shows the name, picture and design, the event and the number of members or of people who are in, no names of people. Your browser creates the invitation QR code itself, without an external service.

Picture and design. Admins of the crew choose a picture from the portal's templates (drawn motifs or pictures the portal provides) and design the page and preview image with the portal's design kit. Your own photos, including photos of people, can't be uploaded for this. We only store the chosen settings, no finished images.

Shared previews. When you share the invite link, the link preview (for example in WhatsApp) and the images for Instagram only show the name, picture and design of the crew and the name of the portal: no number of members, no names, no cities. The preview image can only be retrieved with a valid invite link. Services such as WhatsApp or Facebook load the image when you share the link and may store it for a while; their privacy policies apply.

Profile picture. You can upload a profile picture if you want to. Only members of your crews and people at your parties see it; without a profile picture we show a drawn portrait. We store it like the other images in our storage until you remove it or delete your account.

If you place a pin with “My location”, your browser asks for permission. The location is only sent when you save the pin and is then visible to everyone at this party. The group chat link leads to WhatsApp, Telegram or Signal; their privacy policies apply once you open it.

A party stays active for a while after the event (1 month by default). Admins can extend it, up to a fixed limit (6 months after the event by default). After that it is read-only. We delete a party's data (attendance, map, packing list, posts) after the set period (24 months after the event by default), never while it's active. The crew itself doesn't end with a party; we delete it when there have been no new entries and no party for that long (24 months after the last activity by default). We delete suggestions once the event is over. The portal sets these values; the periods that apply are shown in the settings and on every party.

You can leave a crew at any time; your details for upcoming parties, your pledges for them and your votes on suggestions are deleted when you do. As a guest you can leave a party. If an admin removes you, we keep a note of this until the crew is deleted so that you can't join it again.

Reports. On the invitation page you can report a crew, for example because of an offensive name or picture. We store the reason, text, time and your account. The portal's admins see the report and can reset the name or picture. The legal basis is our legitimate interest in protecting users (Art. 6 (1) (f) GDPR). We delete closed reports 6 months after closing (see “Use with an account, helping out and feedback”).

Connections between two members remain in place even if the crew is deleted, until one side removes them. We keep a note of a declined request so that it can't be sent again. The legal basis is the use of your account (Art. 6 (1) (b) GDPR).

Profile

When you style your profile, we store for this portal: an address made from your display name (without one, from the name in your account) that you can change, the design of your profile header, styles, motto, a weekend frequency (hidden after 72 hours and deleted by the following day at the latest), your “About me” text, your energy, your answers to up to three questions, links to up to six sets from the “Artist Galaxy” area, whether your city should appear on your profile and who sees which sections of your profile. Others only see your profile once you have saved it under “Style your profile”; sets you keep before that are only visible to you.

While “Detect topics from my text” is ticked, we automatically pick up topics from “About me” (for example nature or the cosmos). It is ticked from the start. We never detect topics about health, politics, religion or beliefs. Only you see the topics; we will use them later for features that show people who match you. If you remove the tick, we delete them the next time you save. Only write in “About me” what you want to share, in particular no details about health, religion or beliefs.

Under “Style your profile”, in “Who sees your profile?”, you decide who sees your profile: only you, people who share a crew with you and people you're connected with, everyone signed in to this portal (default), or everyone, even without signing in. With “Custom” you choose this for each section. No section is more visible than your profile header (name, profile picture, city, motto, frequency). Your profile header includes your display name (without one, the name in your account), your profile picture and your city (if you show it). Your wristbands (parties you attended according to your location, see “Wristbands”) are a section of their own. Nobody sees your wishes (“Want to hear”) until you choose who may see them. We still count wishes by city only. Only you see all your crews and upcoming parties; others only see crews they are members of themselves, and the upcoming parties of those crews with your answer (going or maybe). Upcoming parties are visible to your crew at most, never to connections and never public.

Points and badges. You get points (some portals give them their own name) and badges for joining in: when you design your profile for the first time, add sets to your profile, found a crew, went to a party with your crew (after the party has ended, if you said you were going) and for rides you offer or share. For this we store the occasion, the points, the time and the reference (for example the party or the ride), and which badges you have had since when. Your profile shows the total, the occasions and your badges. You choose who sees them in “Who sees your profile?” (default: everyone signed in). Only you see badges you have not earned yet. Badges in levels (for example “Beta pioneer”) are shown as one badge with the level reached; only you see what is missing until the next level. If you remove your profile or an item, your points stay; they are deleted with your account.

Wristbands. You get a wristband in your profile when you have demonstrably been at a party. While a party you saved or signed up for in a crew is running, the app asks once when you open it whether you want to get a wristband. Only if you agree does your browser ask for your location. Your device sends the location and the time of the measurement to us once; we check whether you were within the radius of the party (about 1 to 5 km depending on how precise the party location is, set by the portal) and discard the location immediately. We only store that you were there, the party and the time, never your location. Without a connection the location stays on your device until the check and is then deleted there. The wristband appears after the party has ended, first in the party's colours; if the organiser uploads their original design, it shows that and you get a notification. You choose who sees your wristbands under “Who sees your profile?”. So that we know which parties to ask about, we store your saved parties with your account. Wristbands and saved parties are deleted with your account; a wristband also when the party is deleted. The legal basis for the location check is your consent (Art. 6(1)(a) GDPR), which you give by tapping “Get wristband” and allowing it in your browser and can withdraw in your browser at any time; for wristbands and saved parties it is the performance of the user agreement (Art. 6(1)(b) GDPR).

Crew DNA and crew badges. In your crew we show a mix of the members' styles and energy (the “DNA”) and badges for the crew as a whole, for example for parties together, a shared ride or many different styles. The DNA is calculated from the members' saved profiles each time it is shown and is not stored. It only appears from three profiles on and only shows shares and averages, never the values of a single person. Only profiles whose “My world” is visible to the crew are counted, on the invitation page only those you may see anyway. For the badges we store which badges the crew has had since when; the members get a notification. They are deleted with the crew.

Own pictures. If the portal allows it, you can show up to six photos in the section “My pictures”, each with a short caption if you like. Your device makes each picture smaller first; we check that it really is a picture, remove all metadata (for example camera, place and time of the shot) and store two smaller versions in non-public storage, together with caption, order and time. You choose who sees your pictures separately in “Who sees your profile?”; at first only your crew and your connections see them, at most everyone. People you blocked or who blocked you never see them. Only upload pictures you hold the rights to and that show nobody without their consent, no pictures from the dance floor. Others can report a picture; the report then points to the picture. The portal team sees newly uploaded and reported pictures and can remove one; you then get a notification, and we only store who removed it and when, not the picture. You can delete any picture at any time; all of them are deleted with your profile or your account, and we remove the files from storage by the following day at the latest.

Own header picture. If the portal allows it, you can upload your own picture for your profile header instead of the drawn backgrounds. Your device makes it smaller first; we check that it really is a picture, remove all metadata (for example camera, place and time of the shot) and store two smaller versions in non-public storage, together with the time, the chosen crop, the darkening and the softening. Anyone who may see your profile header (according to your choice in “Who sees your profile?”) sees the picture; without signing in only if your header is set to “Everyone”, then also in the preview image when the link is shared. Only upload pictures you hold the rights to and that show nobody without their consent, no pictures from the dance floor. The portal team sees newly uploaded pictures and can remove one; you then get a notification, and we only store who removed it and when, not the picture. You can delete the picture at any time; it is deleted with your profile or your account, and we remove the files from storage by the following day at the latest.

Mandala code and short code. Under “My code” we show you a mandala with a rotating ring and a short code of 6 characters. Both stand for your profile in this portal. For this we only store the short code, whom it belongs to, since when and when you last showed it (for “Connect”, see below). If someone scans your code or enters the short code, your profile opens, showing only what that person may see according to your choice in “Who sees your profile?”. Without signing in, only a profile you set to “Everyone” opens. With “Create a new code” you get a new code at any time; the old one then leads nowhere. A crew can have a code as well; it leads to the invitation to the crew. When scanning, the page uses the camera only on your device and only if you allow it: the images are read there and neither stored nor transmitted. Only the short code that was read is sent to us. If you scan someone's code in the app while signed in, this becomes a request or connection with the meeting (see “Connections”). Beyond that we do not store who scanned which code; to prevent mass guessing we briefly count attempts (two days at most) per account or as a checksum of the IP address. So that a scan connects straight away, we store the times you showed your code for 24 hours. Your codes are deleted with your account.

Offline. So that “My code” and scanning also work offline, we store on your device (not with us): your code with what is needed to show it (mandala code, shape, styles, visibility, code variant, life mandala in rough levels and your account ID), the times you showed it offline (24 hours at most), and offline scans with the code, time, party and your account ID (7 days and 50 scans at most). As soon as you're back online, the app sends them and then deletes them. When you sign out or your sign-in ends, we delete all of it from the device.

Scene. The app has a “Scene” tab. It shows what's new with your connections and in your crew: free seats in a ride to an upcoming party, a crew with an open invite, which of your connections are going to a party of your crew, new sets in profiles and new badges from the last 14 days. This activity is put together on each visit from data we store anyway; we store nothing extra for it. Others only see about you what they may see in your profile anyway (“Who sees your profile?”), your upcoming parties only members of the same crew. Blocked people see nothing about you. With “Show my activity in the scene” (on by default) you can turn this off at any time; then no cards about you appear. To prevent mass requests we briefly count visits per account (two days at most).

Scene and notifications. The scene shows all your notifications from the app together with the activity of your connections. We also create a few notifications ourselves: a reminder the day before a party you said you're going to; recommendations for upcoming parties that match the styles in your profile or that people you're connected with are going to in a shared crew (at most as many per day as the portal allows); and ticket hints when a price tier of a saved party or a party you're going to ends soon. We store saved parties with your account (see “Wristbands”); the scene uses them for these hints. Clicks on the ticket button are only counted without any link to you; we never learn whether you buy a ticket. Under ⚙︎ you can choose per area (messages, connections and requests, badges and points, reminders, recommendations, tickets, activity of your connections, feedback) whether notifications show up in the scene and under the bell; reminders, recommendations and ticket hints are then not created at all. We store this choice, when you last marked everything as read or looked at your requests, and the notifications themselves like all others under the bell; everything is deleted with your account. Legal basis is the performance of the user agreement.

Life mandala. Your profile shows a mandala that grows with what you experience here. It is calculated each time from information we store anyway: how many parties you had with your crew, your badges, connections, styles and sets, and how long you have been here. We don't store the picture itself. Only you see the numbers behind it. You choose who sees the mandala in “Who sees your profile?” (default: everyone signed in); others only see the shape in rough levels, and anything they may not see on your profile (for example your connections) is grouped together. If you show your life mandala in your mandala code, the same applies to everyone who sees the code.

Connections. On another person's profile you can choose “Connect”. They get a notification with your name and can accept or decline the request; if they decline, you are not told, and no new request from you reaches them. If the person showed their code within the last 10 minutes and you scan it, you are connected straight away without a request. For this we store who asked whom, the status (requested, connected, declined), where the connection was made (profile or crew) and the times. Only you see your connections and open requests, on your profile. Connected people see the sections you open to “Crew and connections”, never your upcoming parties. Connections made on the profile only see your contact details if you share them in your account and switch on “Also show shared contact details to my connections” (off by default). You can remove a connection or withdraw a request at any time; the entry is then deleted. We keep declined requests so that no new request from the same person arrives. All your connections and requests are deleted with your account. You get points once for each new connection.

Meeting when scanning. If a connection is made because one of you scans the other's code (in the app), we also store on the connection that you met this way, when, and at which party, if the time fits a party on whose page the scan happened or which the scanning person saved. Only the two of you see “Met at [party]”. For the first meeting when scanning in the app you both get bonus points once (the portal sets how many), and the “Meetings” layer appears in your life mandala. We delete this data with the connection.

Blocking and reporting. On another person's profile you can block them via “…”. After that you no longer see each other's profiles, not even via the mandala code or the short code, and you can't connect; an existing connection and open requests between you are deleted. The blocked person gets no notification; they see your profile like any profile that isn't visible. Shared memberships (section “Crew”) stay as they are. For this we store who blocked whom and when. Only you see your “Blocked” list, under “Style your profile”; there you can unblock someone (an earlier connection stays ended). You can also report a profile, with a reason from a list and optionally a text of up to 500 characters. Only the admins of this portal see the report, with your name; the reported person never learns who reported them. The admins can close a report without action, hide the profile from others (the person then sees a note under “Style your profile”) or block the account; these steps are logged without the text of the report. We delete closed reports 6 months after closing (see “Use with an account, helping out and feedback”). Your blocks and reports are deleted with your account. The legal basis is the use of the app (Art. 6(1)(b) GDPR) and our legitimate interest in a safe community (Art. 6(1)(f) GDPR).

Moderation by the team. The admins of this portal get a notification when new pictures were uploaded to profiles (without the picture and without names). They can also hide a profile from others without a report and show it again, for example because of a new picture; the person then sees a note in “Style your profile”. Each of these steps is logged with time and admin. The legal basis is our legitimate interest in a safe community (Art. 6(1)(f) GDPR).

Find people and conversation starters. If the portal has switched it on, “Find people” suggests other guests with a saved profile. To order the suggestions we only compare what you may see on their profile anyway: shared styles, shared past parties (only if their wristband arm is visible to you), the city shown, a shared membership (section “Crew”) and, only if both of you have ticked “Detect topics from my text”, the detected topics. We never show the topics themselves; the card says at most “Similar interests”. There is no search by name, and profiles only visible to their owner, blocked and hidden profiles never appear. We calculate the comparison anew for each request and don't store it. Under “Design profile” you can untick “Suggest me in ‘Find people’” (on by default); then you won't appear as a suggestion for anyone. With “Reply to this” you can send one sentence of up to 200 characters about an answer in the questions section of another profile (text only, links are made unclickable). It goes to the person as a connection request, or as a notification if you're already connected. We store the latest sentence with the question, who wrote it and when on your connection, plus the notification for the person. The sentence is deleted when the request is declined or withdrawn, the connection is removed or one person blocks the other, and with your account; the notification stays with the person until they delete their account. Whoever receives a sentence can include it in a report to the portal's admins. Legal basis is the use of the app (Art. 6(1)(b) GDPR).

Questions and your own question. In the questions section of your profile you pick up to three questions from the portal's list or write a question of your own (up to 80 characters, text only, links are made unclickable). We store your answers together with the wording of the question as you picked it, so it stays the same even if the portal changes its list later. Your own question is free text like “About me”: it is visible like your questions section and is deleted when you remove it, remove your profile or delete your account. Legal basis is the use of the app (Art. 6(1)(b) GDPR).

If you set sections to “Everyone”, anyone with the link to your profile can see exactly those sections without signing in. Your profile picture only appears there if you choose “Also show my photo without signing in”; otherwise a drawn portrait. If your profile header is set to “Everyone”, messengers and social networks show a preview with your name, your motto and – only with that choice – your profile picture when the link is shared. Without “Everyone” for the header there is no preview with your data. We ask search engines not to include profile pages. The portal can switch public profiles off entirely; “Everyone” then counts as “Signed in”. You can remove your profile at any time under “Style your profile”; it is deleted with your account.

The legal basis is the use of the app (Art. 6 (1) (b) GDPR); for detecting topics our legitimate interest in suggesting people who match you (Art. 6 (1) (f) GDPR). You can object at any time by removing the tick (Art. 21 GDPR); for special categories of data that you write in “About me” yourself, your consent (Art. 9 (2) (a) GDPR), which you can withdraw by changing or deleting the text.

App with map (test view)

In the app at /app we show events on a map. Your browser loads the map images directly from OpenFreeMap (openfreemap.org). The map service learns your IP address and which part of the map you are viewing. The legal basis is our legitimate interest in a working map view (Art. 6 (1) (f) GDPR). Map data from OpenStreetMap (© OpenStreetMap contributors).

Your app settings (appearance, background strength, start place, saved places, radius, time period and saved search presets) are stored only in your browser's storage. They are not sent to us, and you can delete them in your browser at any time. Saved parties are also kept in your browser; if you're signed in, we also store them with your account (see “Wristbands”). If you choose “My location”, your browser asks for permission. Your location is only used in your browser to show events near you and is not sent to us. What the list and calendar show is calculated by your browser from the visible part of the map.

Country for choosing a place. When you open the app, our hosting platform (Vercel) tells us which country your device is in. It derives this from your IP address. We only use this country code so that your country appears as a button in “Where”. We don't store it and don't determine a more precise location. The legal basis is our legitimate interest in a suitable starting area for the map (Art. 6 (1) (f) GDPR).

When you type a place or a country in “Where”, we show matches from our own list of places on our server (GeoNames, see legal notice). Nothing goes to third parties, and we do not store the search term. To prevent abuse we briefly count these requests in the server's memory per checksum (hash) of your IP address. If the list finds nothing and you start the search, we query the OpenStreetMap place search (Nominatim) through our server. The service only receives the search term, not your IP address. To prevent abuse we count these searches per account or, without an account, per checksum (hash) of your IP address and delete this count after one day.

The events come from goabase.net and are loaded through our server, including the flyers. Viewing them does not connect your browser to goabase.net, only clicking a link to it does. The ticket button leads through our server, which counts the click (see “Visitor statistics”) and forwards you to the organiser's shop without passing on where you came from.

Embedded players in the line-up and on artist pages

In the line-up of an event and on artist pages you can play samples directly in the app. The player from SoundCloud, Mixcloud, YouTube (privacy-enhanced mode, youtube-nocookie.com) or Spotify only loads when you tap the provider's button. Before that, there is no connection to these services, and covers and images are delivered by our own server. After that, your browser connects directly to the provider. The provider learns your IP address, technical details of your browser and device and which track you play, may set cookies and may also transfer data to the USA. The privacy policy of the respective provider applies: SoundCloud Global Limited & Co. KG (Berlin), Mixcloud Ltd (London), Google Ireland Limited (YouTube, Dublin) and Spotify AB (Stockholm).

SoundCloud plays in our DJ player. After your tap, the app loads SoundCloud's control script (w.soundcloud.com) and SoundCloud's player in a hidden frame. Your browser then connects to, among others, w.soundcloud.com, api-widget.soundcloud.com, widget.sndcdn.com, i1.sndcdn.com and playback.media-streaming.soundcloud.cloud. SoundCloud sets its own cookies (for example an anonymous identifier and bot protection). For the waveform the app fetches a file with the track's volume levels from wave.sndcdn.com.

YouTube plays in a video window with the player in privacy-enhanced mode (www.youtube-nocookie.com). The app does not load any script from YouTube for this; it controls the player through messages between the page and the frame. After your tap, your browser connects to YouTube and Google servers, including youtube-nocookie.com, googleapis.com, gstatic.com, google.com and googlevideo.com for the video.

Mixcloud and Spotify: after your tap the app loads the provider's player in a frame (Mixcloud: player-widget.mixcloud.com, Spotify: open.spotify.com/embed). From that moment your browser connects to the provider's servers, and the provider may set its own cookies.

One player. Only one player plays at a time, at the bottom of the app: the DJ player for SoundCloud, the video window for YouTube, or the Mixcloud or Spotify player. If you start another one, the app closes the previous one including its frame. The app keeps volume, position and size only in the memory of the open page, not on our servers and not in the browser.

Providers per portal. Each portal decides which providers play in the app. If a provider is switched off, the app only shows a link to its page, without a player. Bandcamp always opens the provider's page in a new window.

Above the line-up and above the samples on an artist page, a note names the providers whose player will load before you tap for the first time, with a link to this section. The legal basis is your consent by tapping the button (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). It only applies to that player. You can withdraw it at any time by closing the player. It will then not load again until you tap again. Data already transferred remains with the provider. Links to the acts' Bandcamp, Instagram, Facebook and websites open the provider's page in a new window.

Notices in the app and “Allow all”

On your first visit to the app, a sheet asks for your okay for music and videos. “Let’s go” is the same as “Allow all”. “Essential only” keeps the notices below; you can still choose “Allow all” at any of them later. We store both choices as described below so that the sheet does not come back.

Before you tap a player for the first time, for the city on your account and for wishes, the app shows short privacy notices. “Allow all” (in one of these notices, in the app settings or in your profile) hides these notices. Players still only load when you tap them.

We store your choice in your browser (local storage, entry “pa-<portal>-zustimmung” with the version and the time). If you are signed in, we also store it on your account (version and time) so it applies on your other devices. If we change the notices in a new version, the app shows them again until you agree again. You can withdraw your choice at any time in your profile under “Privacy” or in the app settings. Then “Essential only” applies: your browser stores “notwendig” with the time instead of the version, and we delete the version on your account. Only the time of the withdrawal stays on your account, so that an older choice on another device no longer applies. This privacy policy is always available from your profile and the app settings.

The legal basis for storing your choice is our legitimate interest in respecting your decision (Art. 6 (1) (f) GDPR). The browser entry is strictly necessary for this function you requested (Section 25 (2) no. 2 TDDDG).

Organisers, following and widget

Organisers have a profile in the portal. We create profiles from the details in public calendars (name, website, social media pages). If you follow an organiser or an artist, we store this in your account. For organisers, new dates then appear in your notifications. You can unfollow at any time. If you report an event, we store the report with your account until 6 months after it has been handled (see “Use with an account, helping out and feedback”). If an artist asks you as an organiser to confirm their set at your party, you only see the name of their page and the shared party in the Space Editor, not their email address (see “Artist Galaxy”).

When an organiser claims their profile, we store the proof: the email address on their website to which we send a code (sent via Emailit, the code only as a checksum), the address of their social media page with a public code, or their message to us. Images uploaded by organisers and artists (flyers, logos, profile pictures) are stored at Supabase (data centre in Frankfurt am Main) and delivered through our server. Your browser redraws them before uploading, and our server also removes embedded data such as location (GPS), camera and time on every upload (EXIF, XMP, IPTC and text blocks). If a file cannot be cleaned safely, we don't accept it. The legal basis is the use of the Space Editor (Art. 6 (1) (b) GDPR). Graphics that a portal's admins upload for app backgrounds are redrawn in their browser first; embedded details such as the location or camera are dropped in the process. They are stored with name and artist at Supabase (data centre in Frankfurt am Main) and delivered only through our server. The background patterns don't load any data from third parties.

Organisers can embed a widget on their own website. It is loaded from our server, which, as with every page request, learns your IP address (see “Hosting and server logs”). The widget sets no cookie. Our visitor statistics count loading the widget like any other request, with the embedding website as the source (see “Visitor statistics”). If you click a button in it, we still only count how often that happened per widget, without any link to you. To suggest colours for a widget, our server fetches the organiser's website once.

Blocking organisers. An admin can block an organiser for a portal. Their parties then no longer appear in this portal and are no longer imported when syncing with sources such as goabase. For this we store the organiser's name in normalised form, the reason, who blocked it and which parties are affected.

Parties in the Space Editor. Anyone who claims a profile or creates parties enters the party's details for this (name, times, place, line-up, prices, texts, flyer). We store the roles you choose when signing up (organiser, artist, label) with your account to show you suitable paths. For your parties you see numbers: views in the last seven days, how often the party was saved and shared, how many crews want to go, how many rides are offered and how often a ticket button was tapped (separately for the party page, crew and list). These numbers are created without any link to people; values under 5 are only shown as “under 5”. In the line-up you see, for artists with their own page, how many wishes there are, in total and within the radius around the party's place, never from whom.

Artist Galaxy

Pages from line-ups. Anyone listed in the line-up of a party in the app can get their own page. Each portal decides whether new pages are created: none, only selected names, or every new name. For this we process the name of the act, the role (for example DJ, live, decoration), additions such as label or country, and the links in the line-up. The source is the parties in the app, i.e. details from organisers or public party calendars such as goabase.net. We assign the same names to one page automatically. If a match is based on the name only, an admin reviews it. Until an artist takes over their page, it shows no photo and a note that the details come from line-ups and public sources.

Names without a page. Names from the line-ups of published parties that don't have a page yet are kept in an internal list. It only contains the name as written in the line-up, the stated role and the parties it appears on. Only administrators of the portal see the list. It is used to create pages in a controlled way or to exclude names. An excluded name gets no page. We collect no further data about the people behind the names. In the line-up, a name without a page stays plain text without a link.

Public sources. We only read pages linked to the act in the line-up (SoundCloud, Bandcamp, own website, YouTube channel, Mixcloud). We only read a provider's pages if that provider is switched on in one of the artist's portals, and always the artists' own websites. We don't search for names and don't follow links we find there. We take public details about the music: description, city and country, tracks, videos and sets with date, duration and thumbnail. An AI provider writes a short text in German and English from this (see “AI preparation”). We store the sources with every text. We don't take anything about private life.

Archive of past parties. From the public archive of goabase.net we take date, place, country, location, the organiser's name, the flyer and the line-up of past parties, with a link to the source. These parties only appear on artist pages (archive, numbers, map), not in the app's list, map or calendar.

Labels and their origin. On artist pages we show labels an artist has released on or belongs to. A label is an entry like an organiser profile and has its own page. The link comes from three sources: the note an organiser added to a line-up (for example “(Iboga Records)”), public sources linked in the line-up, or the artist themselves. For each link we store where it came from and which party supports it. People who manage an artist page can add and remove labels. We remember a removed label so it doesn't come back through new parties; we store who removed it only internally for traceability. Label pages only show artist pages that are public anyway, and no people, email addresses or wishes.

Similar artists. At most once a day our server compares the public details of a page (shared labels, shared tracks and remixes) with other artist pages in the portal and stores the result with the page. Shared parties don't count. No guest data is used.

The legal basis for pages, sources, archive, labels and similar artists is our legitimate interest in making artists of the scene visible and finding parties where they play (Art. 6 (1) (f) GDPR). This concerns public details published for this purpose by the artists themselves or by organisers.

Request removal. If a page is wrongly assigned or should disappear, use “Request removal” on the page. You need an account for this. We store your request with your account (email address), who you say you are (for example the artist themselves, a representative or management, an organiser or someone else, optionally with a short description), the reason you chose, your text and the time. Only the admins of the portal see these details in their review list, to check the request and reply to you by email. The artist, organisers and other people don't see them. We delete the request 6 months after it is settled (see “Use with an account, helping out and feedback”). Without an account, you can still write to allehin.com@gmail.com. You can object to a page at any time (Art. 21 GDPR). We then hide it. We keep the name so that new parties with your name don't create a new page. We never restore assignments that were separated. Legal basis: Art. 6 (1) (f) GDPR (correct and lawful content, protecting the people concerned).

Identity. Anyone who pretends to be someone else in a request, a claim or when adding themselves may have their account blocked (see “Account and sign-in”).

Search. When you type in the app's search field, your browser sends the search term to our server from the second character on to find matching artist pages. We do not store the search term. To prevent abuse we briefly count requests to the search and to artist pages in the server's memory per shortened checksum (hash) of your IP address (at most one minute, not in a database). The legal basis is our legitimate interest in a working and secure search (Art. 6 (1) (f) GDPR).

Wishes. With an account you can wish to hear an artist at a party. We store that your account wished for this artist in this portal, the time and the city from your account. You can take the wish back at any time (second tap or “My wishes” in your account); we then delete it. If you change your city, your wishes count for the new city from then on. The legal basis is the use of the app (Art. 6 (1) (b) GDPR).

What others see. Nobody sees who wished for an artist, not the artist, organisers or our admins. Only totals are public: the number of all wishes for an artist, the number of cities, and a city only from a minimum number of wishes set by the portal; below that only the country. If a portal sets the minimum to 0 or 1, a city appears with a single wish, as the city's name with the number 1. Even then we never show who wished. In the artists overview, artists can be sorted by their number of wishes, overall and per region, again with a number only from the minimum. Such an order never appears on an artist's page.

Popular in your region. If you're signed in and have set a city, we count wishes from cities within 100 km of it for this sort order. Without an account, the app uses the starting area of your map (for example a place you saved, or the portal's country). Only this map area goes to our server, never your location. Your chosen sort order is remembered only by your browser until you close the tab.

How we count. To keep totals and order fair, only confirmed accounts that are not blocked count, and only one wish per artist and base form of the email address (see “Account and sign-in”). From the same email domain at most five wishes per artist count, except for large email providers. We do not accept addresses of known disposable email providers for wishes. For this we only check the domain of your email address against a list that the portal can extend or switch off in single entries, and we store nothing extra. We limit changes to wishes and checks when taking over a page per account and hour. For this we count in our database with your account ID and delete these counters after two days. If wishes for an artist rise unusually fast, we create a review entry with numbers only (period, count, number of new accounts), without people. An admin can decide that the wishes from this period do not count. The legal basis is our legitimate interest in counting free of manipulation (Art. 6 (1) (f) GDPR). We keep wishes until you take them back or your account or the artist's page is deleted, and review entries until the page is deleted.

Taking over a page. To take over your artist page you sign in with your email address and choose a way to prove it is yours. With a code on your own page, you put a code on a SoundCloud, Bandcamp or website page that is already linked on your artist page. When you tap, our server fetches this one public page and looks for the code. We store the code, the address, the result and the time, not the content of the page. With a confirmation by an organiser, you pick a party you played. The organiser's team only sees the name of the page and the shared party, not your email address or any other identifier of yours, and can confirm or decline the request. We tell you this before you send it. Only the portal administrators who review your claim see your email address. Our team then hands over the page. The other ways (code to an email address of the website, code on Facebook or Instagram, message to us) are the same as for organisers. We keep requests and their result as long as the page exists, as proof of who may manage it. The legal basis is your wish to manage the page (Art. 6 (1) (b) GDPR) and protecting artists against takeover by others (Art. 6 (1) (f) GDPR).

Editing your page. What you enter on your page (display name, roles, country of origin, texts, links, samples, image) is public in the portal's app. Links and samples you remove stay stored as “removed” so that new line-ups don't bring them back. We only accept a new image if you confirm that you hold the rights to it and name the photographer. We show the name below the image and store the time of your confirmation as proof. For metadata in images see “Organisers, following and widget”.

Deleting your page. You can delete your page at any time. It is then hidden: it no longer appears in the app, in search or in shared images, the wishes for your page are deleted and reading public sources stops. Your name stays in the organisers' line-ups, but without a link. The assignment of your name stays stored so that the next line-up with your name does not create a new page. Without an account you can ask for deletion by email to allehin.com@gmail.com.

Adding your own page. Signed-in people can create a page for themselves as an artist or for their label. For this we store the name, the chosen roles and the details you add afterwards (links to your pages, origin with country and optionally city, labels, a short text, an image with a statement on the rights and “photo by”). We also store which account created the page and when. The page is not public at first. It only becomes visible once you show that it is yours: with a code on your own SoundCloud, Bandcamp or website page (we read this one page once), with a code on your Instagram or Facebook page, or through a review by the portal team. Until then only you and the portal's admins see the page. You can delete a waiting page at any time, it is then removed completely. The legal basis is providing the service you asked for (Art. 6 (1) (b) GDPR) and our legitimate interest in protecting pages against false information and identity misuse (Art. 6 (1) (f) GDPR).

Sharing. Our server creates the share image of an artist page from the public details of the page (name, image, next party) and from totals: number of wishes and the city with the most wishes, a city only from the minimum. The image never contains people, email addresses or IDs. We cache it for at most five minutes. To prevent overload we count requests per IP address for one minute in the server's memory without storing the IP address. The buttons for WhatsApp, Telegram, Facebook and X are plain links: only when you tap one does the service open and receive the page address. “More apps” uses your device's share menu, “Copy link” the clipboard. When you share the address of an artist page, social networks fetch the share image from us to show a preview.

Connections. Covers of samples are delivered by our own server. Before you tap a sample there is no connection to SoundCloud, YouTube, Mixcloud, Spotify or Bandcamp (see “Embedded players in the line-up and on artist pages”). The map on an artist page only loads once it is visible and uses the same map images as the app (see “App with map”). Links to the source of a party only lead to goabase.net after a tap.

AI preparation

We have events from public calendars and texts that organisers enter themselves prepared to be readable (title, short description, sections, line-up, German and English). For this, our server sends the text of the event to an AI provider: Anthropic PBC or OpenAI, L.L.C. (both USA). Only the details of the event are transferred, for example name, date, place, line-up and description. If they contain names or contact details, these are included. For the short texts of artist pages our server sends the name and role of the act and the texts of the public pages linked in the line-up (see “Artist Galaxy”). The portal sets which of the two providers is used. We do not transfer data of visitors to the site, your IP address or details from your account. The transfer to the USA is based on the EU Commission's standard contractual clauses or the EU-US Data Privacy Framework. The legal basis is our legitimate interest in readable events (Art. 6 (1) (f) GDPR), for organisers the use of the Space Editor (Art. 6 (1) (b) GDPR).

Prefilling a party. If you paste an announcement, speak it or have a flyer read, we only send this text or image to the configured AI provider, never your account details. You see the result in the form and check it yourself; only what you save is stored. At most 20 prefills per account and day. Speaking uses your browser's speech recognition. Depending on the browser, it sends the recording to its maker for this (for example Google for Chrome, Apple for Safari); we only receive the recognised text. Without speech recognition in the browser, the button is not shown.

Checking new parties. Before the portal team releases a new party, the AI can look at the flyer and point out advertising with no connection to the scene. Only the image of the flyer is sent to the configured AI provider. The team always decides.

Checking shop listings. Before a shop listing goes public, the AI checks its texts (name, short text, note on opening hours, benefit for guests), its links and up to five images for content that is not allowed in the portal. Only this content of the listing is sent to the configured AI provider, never account or personal data. If the result is unclear, the portal team decides. We store the latest result with the listing. The legal basis is the use of the Space Editor (Art. 6 (1) (b) GDPR) and our legitimate interest in listings without inadmissible advertising (Art. 6 (1) (f) GDPR).

Shops

Shops and online shops from the scene can have a listing with their own page in the portal, shops with a pin on the map. The portal team creates the listing; the shop claims it with a code and then maintains it itself in the Space Editor. We store the details of the business (name, short text, logo and pictures, address or country, opening hours, categories, website and links) and who manages the listing. You look up a shop's address via the OpenStreetMap place search (see “Locating events”); only the address you enter is sent there.

Emails to shops. Whoever manages a shop receives emails about their own listing: after claiming it, after a listing has been checked, and one week before and on the last day of the trial. Without a manager we send no email. Visits as a total. We count views of the shop page like all pages, without reference to a person (see “Visitor statistics”). The shop only sees the total number of visits during its trial; below five it says “under 5”. A shop never receives names, accounts or other details of guests. The legal basis is the use of the Space Editor(Art. 6 (1) (b) GDPR).

Locating events

So that events appear in the right place on the map, we determine their location from the event details: from the data of goabase.net and the description, then via the OpenStreetMap place search (Nominatim, run by the OpenStreetMap Foundation in the United Kingdom). If it finds no reliable location, we show the approximate location from the event details.

Only location details of public events are transferred: name of the venue, street, postcode, town and country. If this is the address of a private person, it is included. We do not transfer data of visitors to the site, your IP address or details from your account. Events that organisers enter themselves are not located this way. The legal basis is our legitimate interest in a correct map display (Art. 6 (1) (f) GDPR).

Your rights

You have the right to access your stored data (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interest (Art. 21). An email to allehin.com@gmail.com is enough.

You can also lodge a complaint with a data protection supervisory authority. The competent authority is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia in Düsseldorf, Germany.

Last updated: October 2026