Privacy policy

Who is responsible

Eveny is run by Felix Stenberg, a private individual in Stockholm, Sweden. For anything about your data, write to hej@eveny.app.

For a club's own guests and members, the club is the controller: it decides what to ask at sign-up, who becomes a member and who sees the guest list. Eveny processes that data on the club's behalf and under its instructions. For organiser accounts, the one identity per email across clubs, security and the product's own pages, Eveny is the controller.

What we store and why

Only what the service needs to work. No profiles are built for advertising, and nothing is sold.

• Organisers: your sign-in account with Clerk (email address, name), which clubs you belong to and your role in each. Needed to sign you in and show you your clubs.
• Guests and members: your name and email address, your sign-ups and their state (pending, confirmed, waitlisted, cancelled), your answers to a club's own questions at sign-up, your check-ins (that you were there), and your membership per club. If you sign up a friend, we keep the friend's name and email address as if they had signed up themselves, and the friend gets the mail about the sign-up. One identity per email address across clubs, so that one confirmation works everywhere and your own page shows every club in one place. A club only ever sees its own guests.
• Photos in an event's album: the photos you add from the event's start, as a guest with a confirmed spot or a check-in, kept as one large JPEG and a few smaller copies with every bit of metadata removed, a GPS position included, and tied to you so that you can remove them. Who sees them follows the club's guest-list setting; the club's organisers, and those of a club hosting the event with it, also see which photos you added. The files have long random addresses, and anyone given one can open that photo. They stay until you or the club remove them, and deleting your details deletes them too.
• Wall statistics: how many times a wall and its pins were viewed and pressed, counted per day and per club. The counter carries no cookie, no visitor id and stores no IP address; it sends nothing when your browser asks not to be tracked.
• Mails: every mail we send for a club carries a small first-open pixel. When the mail is first opened, the time is stamped on our record of that mail, so the club can see whether its mails reach people. Nothing else is measured, and a mail client that blocks images blocks the pixel.
• Mail from a club to its members: a club's organisers can write one mail to all the club's members, sent in the club's name to each member's address, with a picture and a sponsor's offer for members if the club adds them, and the same first-open pixel as the club's other mails. Every such mail carries a link that stops them with one click, and your own page has a box that does the same; either stops only these mails from that club, never the mails about events you sign up for. That you asked, and when, is kept with your membership of that club.
• Payments, when a club turns them on: what was paid, when and for what. Card details go to Stripe and never reach us.
• Technical traffic: IP addresses are used momentarily to limit abuse (rate limits) and are not stored with your data. Our hosting provider keeps ordinary request logs for a short time to run and protect the service.
• Page counts on eveny.app's own pages: the front page, the discovery calendar, these legal pages and the organiser admin use Vercel Web Analytics, which counts page views without cookies, visitor ids or stored IP addresses, and sends nothing when your browser asks not to be tracked (Do Not Track or Global Privacy Control). A club's event pages, your own page and the payment pages carry no analytics script at all; a club's wall carries no Vercel Web Analytics and no third-party script, only its own count described under Wall statistics.

Cookies

We set only the cookies of our own listed below and no third-party cookies.

• gb_viewer: set when you confirm a sign-up, open a login link, or open your sign-up from a mail about it while your spot, or your place on the waitlist, still holds; Log out everywhere stops those links signing you in. Signed, HttpOnly, one year. It remembers who you are so that event pages and your own page know you; a link that names someone else does not replace it unasked. On a club's own domain it is set for that domain only.
• gb_lang: the language you chose, one year.
• gb_checklist_hidden: organisers only; remembers that you hid the Set up your club list in the admin, one year.
• When an organiser signs in, Clerk sets the cookies its session needs. Stripe sets its own on its payment pages.
• The admin and the wall also keep a few small settings in the browser itself, such as where you were on the wall; they are never sent to us.

Who processes the data

These companies process data on our behalf, under written agreements, and only to do what is listed.

• Vercel: hosting, EU region (Frankfurt); uploaded pictures on Vercel Blob; the cookieless page counts on eveny.app's own pages (Web Analytics).
• Neon: the database, Frankfurt.
• Resend: sending mail.
• Clerk: organiser sign-in.
• Stripe: payments, when a club enables them.
• Meta: only when a club connects its Instagram account. We fetch the club's own posts; nothing about you is sent to Meta.

Maps on event pages

An event with a route shows it as a drawing of our own. When you press “Show the map”, your browser fetches map tiles from OpenFreeMap (tiles.openfreemap.org), which sees your IP address as any website you visit does and sets no cookies. When you press “Show Strava's map” on an event with a route on Strava, your browser loads Strava's map from strava-embeds.com, and Strava's privacy policy covers what it loads. Nothing is fetched from either until you press.

Who sees what

A club's organisers see the club's own guests and members: names, addresses, sign-ups and attendance. They never see another club's.

Guest lists on event pages follow the club's rule: shown to everyone, only to confirmed guests of that event, or only to organisers. How names are written (first name and initial, full name, or a count only) is the club's choice too.

Sponsors see numbers, never names: the monthly report counts wall views, views and presses of the sponsor's pin, views of the sponsored events' pages, sign-ups and check-ins on those events, and how many people they reached.

How long we keep it

Sign-ups and attendance are the club's guest book and are kept until you or the club removes them. When you erase yourself, your name and address disappear from every club; that someone came still counts, without a name.

Login links you ask for work for 30 minutes, and the welcome link you get when a club's organiser adds you as a member for seven days; each works once and is then deleted. Organiser invitations work for seven days. Organiser accounts stay until deleted. Records of payments are kept as long as bookkeeping law requires (in Sweden currently seven years). Wall statistics are aggregate counts and are kept as such.

Your rights

You may ask what we hold about you, have it corrected or deleted, restrict or object to how it is used, and take it with you. Under Your data on your own page you can download everything as a file, or erase yourself, without asking anyone. For anything else, write to hej@eveny.app.

If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (IMY), imy.se.

Legal bases

Organiser accounts and the sign-ups you make yourself: performance of a contract. The guest book, security, rate limits, aggregate statistics and the first-open stamp on mails: legitimate interest, the club's and ours, in running events and knowing whether mails arrive. Connecting an Instagram account: the club's consent, which it can withdraw in its settings. A club's mail to all its members: the club's legitimate interest in reaching its own members, which you can object to at any time with the link in every such mail or the box on your own page. We send no marketing mail of our own.

What we do not do

We do not sell data, show ads or let anyone track you on our pages. Every script on our pages is ours.

Changes

When this policy changes, the new version is published here with a new date. Changes that matter are also mailed to organisers.

Law and supervision

Swedish law applies. The supervisory authority is Integritetsskyddsmyndigheten (IMY).