In short: the map remains usable without an account. An account is required only for submissions and cross-device saved events. No advertising cookies, as little data as possible, and EU hosting where feasible.
Controller
Georgi Kostov, Breitwiesenstraße 22, Tür 7, 4481 Asten, Austria hello@okolo.events
What we process
Account & sign-in. You can browse Okolo without signing in. If you use an account, Supabase processes your email address, an account ID, your chosen sign-in provider, and necessary session data. If you choose “Continue with Google”, Google receives the technically required sign-in request. Alternatively, Supabase emails you a magic link.
Server logs & abuse prevention. Our host necessarily receives your IP address when you visit. To limit spam in submissions, we store only a hashed IP value, never the IP address itself.
Language. On your first visit, we use the approximate IP country code supplied by our host to select German, Bulgarian or English. We store your manual choice in a necessary first-party cookie and local storage.
Usage analytics. Only with your optional consent do we send basic page and button statistics to PostHog (EU hosting). No recordings, search text, account details or precise location. Do Not Track and Global Privacy Control are respected. Reject or withdraw at any time through Privacy settings.
Newsletter & city notification. If you sign up, we store your email address, selected newsletter edition or locality with its approximate centre coordinates (not your device location), and language. For an available edition you receive the weekend newsletter; for a city not yet available you receive only one notification when an edition launches there. Both use double opt-in and become active only after you click the confirmation link. As proof of consent we store its time and wording version plus a hashed IP value (never the IP itself). Change your selection or unsubscribe through the link in every email.
Your submissions. If you add an event/place or scan a poster, we process the content you enter and the photo and link the submission to your account ID. The published listing is publicly visible on the map; your email address and account ID are not published.
Saved events. Without signing in, your saved list stays only in this device’s local storage. When signed in, we store the IDs of your saved events with your account ID so the list is available across devices.
Location. “Find my location” uses your browser’s permission to centre the map. The location is not sent to us unless you intentionally provide coordinates for a listing. Location searches are sent to the geocoding service.
Legal bases
Operation, security, abuse prevention and language selection: legitimate interests (Art. 6(1)(f) GDPR).
Optional usage analytics: your consent (Art. 6(1)(a) GDPR), withdrawable at any time.
Account, sign-in, saved events, and publication initiated by you: performance of the requested account functions (Art. 6(1)(b) GDPR).
Newsletter: your consent (Art. 6(1)(a) GDPR), withdrawable at any time.
Recipients & processors
Vercel — website hosting (USA; Standard Contractual Clauses) and provision of the approximate IP country code.
Supabase — database and authentication, EU project region.
Google — sign-in provider, only if you choose “Continue with Google” (USA; Standard Contractual Clauses).
PostHog — anonymous usage analytics, EU hosting.
Google (Gemini) or Anthropic (Claude) — only to recognise text in a poster you upload (USA; Standard Contractual Clauses). The photo is deleted immediately afterwards.
OpenStreetMap / OpenFreeMap (map tiles) and Nominatim / Photon (geocoding) receive the data technically required for map and search requests.
Retention
Account and session data remains until you request account deletion or the session expires. Your saved list remains until you remove an item or request account deletion. The link between your account and submissions remains until a deletion request; published listings may remain independently until they expire or are removed. Hashed IP values used for abuse prevention are retained briefly. Poster photos are deleted immediately after recognition. Newsletter data remains until you unsubscribe; your language preference remains until you delete it or it is not renewed for 12 months.
Cookies / local storage
We use no advertising cookies. Necessary first-party cookies maintain your sign-in session and language choice. Local storage remembers your language and saved list; we also remember your statistics choice. A random analytics identifier stays only in memory until reload or withdrawal and is not linked to your account.
Your rights
You have rights of access, correction, deletion, restriction, data portability and objection, and may withdraw consent at any time. Email hello@okolo.events. You may also complain to the Austrian Data Protection Authority (dsb.gv.at).