Privacy Policy

Who we are

Evenitto is the developer and operator of the Evenitto service. For privacy questions or requests, contact [email protected].

Analytics and tracking technologies

On the website, Google Analytics 4 and PostHog start when the website loads and use first-party identifiers. PostHog also records clicks, scrolling and page changes on our website, hiding everything typed into fields. You can turn this off at any time on the Cookie Policy page; then both run without cookies or local storage.

We measure listing discovery, listing-detail views, party and similar listing opens, and clicks that take you to an external registration provider. We record broad product context such as platform, language, discovery surface, listing and source identifiers, participation mode, free/paid status, registration hostname, the part of the site a page belongs to, the hostname of links that leave Evenitto, newsletter sign-ups, language changes and your analytics choice. We do not send raw search text, complete registration URLs or query strings, precise coordinates, event descriptions, or other free-form input to analytics.

PostHog uses an identifier stored on your device; if you turn analytics off, it tells visits apart with a daily code computed on its servers that cannot follow you from day to day. GA4 user-level data uses the nearest supported retention period. Visits from Evenitto staff are marked and left out of our reports.

The native mobile app collects anonymous Firebase Analytics and PostHog product events so we can understand installs, screen use, event discovery, and registration clicks. Advertising identifiers, advertising personalization, touch autocapture, and session replay are disabled. Analytics remains anonymous.

Read the Cookie Policy

Email alerts

When you sign up for an email alert, such as the ADE 2027 alert, we store your email address, the alert, your language, the page you signed up on, and when you confirmed. We email you about that alert only after you click the link in our confirmation email; without that click we send nothing else.

We send these emails through Amazon Web Services (Amazon SES). We keep your address while you are on the list and delete it 30 days after you unsubscribe; sign-ups nobody confirms are deleted after 30 days too. Every alert email has an unsubscribe link, or email [email protected].

Crowd: event chats, profiles and messages

Crowd is optional. If you never make a Crowd profile, nothing below is stored about you, except a report you send through our notice form.

What we store, and who can see it

• Profile: your handle, name, bio, profile photo (stored again without its metadata), birth month, settings and when you joined. Your handle, name, bio and photo are public on your profile page; profile pages are kept out of search engines. Your birth month is never shown.
• Follows and blocks: whom you follow, who follows you and whom you blocked. Follower lists are public; your blocks are visible only to you.
• Attendance: the events you are going to and went to, and whether each is public or hidden. Public attendance appears on your profile (Going, Been to) and in the event's crowd; hidden attendance only counts in the number and is visible to the other members inside that crowd's chat.
• Messages: crowd messages and direct messages, replies, reactions, edits, pins, read receipts and photos. Photos are stored again without their metadata and shown through signed links that expire. The members of that chat can see them.
• Notifications: your browser's push subscription (the push service address, its keys and your browser's user agent), what we last notified you about per chat, and whether you want emails. Only we see these.
• Safety: reports you send (with a copy of the reported content at that moment), reports about you, moderation decisions about you, statements of reasons and your appeals, and automated spam and photo assessments. Our moderators see these; you also see the statements and your appeals.

Sensitive events

Going to an event in a sensitive category (health, religion or belief, sexuality, politics, and events marked as explicit) can reveal special categories of personal data. Your attendance at such an event is hidden from others by default; you can show it per event. Explicit events never appear on profiles.

Age

Crowd is for people of 16 and older, and the crowd of an event marked 18+ (or with a higher minimum age) only for people of that age. We ask your birth month (not the day) once, to check this, and never show it. A profile of someone younger than 16 is not shown to anyone.

Moderation, spam and photo checks

To keep Crowd safe we process reports, the reported content and the history of moderation decisions; the Digital Services Act requires us to handle reports and explain decisions. When we restrict your content or account, we send you a statement of reasons by email and in Crowd, and you can appeal. A report about the safety of minors from a member whose account is at least a week old (or from two people) hides the reported profile from public pages until we have reviewed it, and we tell the person. We report child sexual abuse material to Offlimits and the police. Read our community guidelines.

To catch spam and scams, an automated check (Evenitto's decision model Jev, run by our AI providers, currently Surplus, with OpenRouter as a fallback) reads messages that contain a link, the first messages of a direct-message request, and messages from accounts younger than 7 days, and stores whether they look like spam, a scam or fine. This assessment is only recorded: it does not block or hide anything, and no decision about you is based on it alone. The providers receive the message text and the event's name, not your name or account.

Photos you send are checked by OpenAI's moderation service. It receives the image only, not your name or account, and we store its result. If a photo may show child sexual abuse, our moderators are alerted at once.

Some of these providers may process data outside the European Economic Area; where they do, we use the safeguards the GDPR requires for such transfers.

Push notifications and emails

If you allow it, we send web push notifications about new messages to your browser through its push service (Google, Mozilla, Apple or Microsoft, depending on your browser). The notification shows the sender's name and the start of the message. If you leave a direct message, a reply or a mention unread for 15 minutes we may email you (at most one email per chat every 6 hours) through our email provider (Amazon SES). Every email has a one-click link to turn these emails off; push is turned off in your browser or in Crowd.

How long we keep it

• Messages you delete are removed at once, for everyone; only their place in the chat's history (an id) stays for syncing.
• A crowd turns read-only 7 days after its event and is deleted, with its messages, 12 months after the event.
• Direct messages are kept until the people in them delete them or their accounts.
• The chat's change log, used to sync your devices, is kept for 30 days.
• Photos uploaded but never sent are deleted after 24 hours.
• Deleting your account removes your profile, attendance, follows, blocks and messages; your messages show as “Deleted account” for 30 days (so other people's apps stay in sync) and are then removed.
• Push subscriptions are deleted when your browser's push service says they are no longer valid, or when you turn push off.
• Reports, moderation decisions, statements of reasons and appeals are kept after the chat is deleted, so decisions stay traceable, for three years after the report is closed. When an account is deleted, its name, profile and message text are removed from them; the decision itself stays.
• Automated spam and photo assessments are kept for 90 days; the content of the emails we sent about moderation for 30 days.

Legal bases

• Providing Crowd (your profile, chats and the notifications you turned on): performance of our agreement with you (GDPR article 6(1)(b)).
• The age check: our legitimate interest in protecting minors (article 6(1)(f)), with 16 as the Dutch age for information society services (article 8).
• Reports, moderation and statements of reasons: our legal obligation under the Digital Services Act (article 6(1)(c)) and our legitimate interest in a safe service (article 6(1)(f)).
• Spam and photo checks: our legitimate interest in keeping Crowd free of fraud and abuse (article 6(1)(f)).
• Showing your attendance at a sensitive event, when you switch it on: your explicit consent (article 9(2)(a)), which you withdraw by hiding it again.

You can edit or delete your profile and messages yourself. For a copy of your data or any other request about Crowd, email [email protected].

Information we handle

Depending on the Evenitto feature you use, we may handle:

• Preferences. Language and appearance settings are stored on your device. On the website, preference cookies may be used to remember the same choices.
• Messages you send us. We receive the information you include when you contact Evenitto for support, privacy, or privacy-related requests.
• Technical information. Our infrastructure and security providers may process IP address, device and browser type, app or page requested, timestamps, and diagnostic information needed to operate and protect the service.

The current Evenitto mobile experience does not request your precise location, contacts, photos, microphone, or camera. It presents events for the selected city without reading your device location.

How we use information

We use information only as needed to:

• provide event discovery and remember your preferences;
• respond to support, privacy, and deletion requests;
• maintain service reliability, prevent abuse, and fix errors; and
• comply with legal obligations and enforce our rights.

Where applicable, our legal bases include performing the service you request, our legitimate interests in operating and securing Evenitto, consent when required, and compliance with law.

Sharing and service providers

We do not sell personal information and the current app does not show advertising. We may share information with service providers acting for us, including Google Firebase for application infrastructure, and hosting, security, and delivery providers. They may process data only to provide their services to Evenitto under appropriate safeguards.

We may also disclose information when required by law, to protect users or the service, or as part of a business reorganization with appropriate notice and protections. Providers may process data in countries outside your own; where required, we use recognized transfer safeguards.

Retention and deletion

Device preferences remain until you change them, clear the app data, or uninstall the app. Support messages and security logs are kept only for as long as reasonably necessary for support, security, dispute resolution, and legal obligations.

You can request deletion of your associated personal information by emailing [email protected]. We may retain limited records only when legally required or needed to prevent fraud, resolve disputes, or demonstrate compliance.

Security

We use reasonable technical and organizational measures designed to protect personal information, including encrypted network connections, access controls, and restricted production access. No method of storage or transmission is completely secure, so absolute security cannot be guaranteed.

Your choices and rights

You may ask to access, correct, delete, restrict, or receive a copy of your personal information, and you may object to certain processing or withdraw consent where those rights apply. You may also complain to your local data-protection authority.

To exercise a privacy right, email [email protected]. We may need to verify your identity before completing a request.

Children

Evenitto is not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has provided personal information, contact us so we can investigate and delete it.

Changes to this policy

We may update this policy as Evenitto changes. We will publish the revised version here and update the date above. If a change materially affects how personal information is handled, we will provide additional notice where appropriate.