Privacy policy

Controller

Proceture Association
Huobweid 4, 6333 Hünenberg See, Switzerland
Email: kontakt@proceture.ch

Data you provide yourself

• Account: email address and – if you log in with a password – your password. It is stored exclusively as a bcrypt hash, never in plain text.
• Profile (optional): display name, profile picture and time zone.
• Organizations and calendars: name, description, category, image and time zone.
• Events: title, location, description, times and recurrence rules.
• Follows: which calendars you follow and whether they are shown in your view.
• Invitations as an admin:if you invite someone to help manage your organization’s calendars, we store their email address together with yours so that the invitation can be sent and matched. Pending invitations expire after seven days and are then deleted; withdrawn invitations are deleted immediately. The invited person is told in the invitation who it is from. Accepting an invitation makes the person an admin of the organization with equal rights; the membership is visible to all other admins, including name and email address.
• Feedback (optional): what you send via the feedback form – the type and text of the message, the page from which you opened it, the language and, if you provide it, your email address for a reply. If you are logged in, the feedback is linked to your account. It is sent to the operator by email and is only visible to them. To curb abuse, we briefly count messages per account or per IP address; the counter expires after one hour.

What organizers see about you

For their calendars, organizations see only numbers: how many people follow them and how many have joined in recent weeks. They are not shown who exactly follows a calendar – not even the owner of the organization.

Data collected automatically

• Server and access data: when you use the application, technically necessary connection data is processed (IP address, time, page accessed, browser identifier).
• Security counters: failed login attempts and calendar password entries are counted for a short time in order to slow down password guessing.
• Origin at sign-up: the country from which you signed up (derived from the IP address by our hosting provider – we do not store the IP address itself) and the language you chose.
• Last use: the approximate time you last used CalFollow while logged in or your calendar feed was last fetched.
• Protection against automated sign-ups: during sign-up, Cloudflare Turnstile checks whether a human is filling in the form. Technical characteristics of your browser and your IP address are transmitted to Cloudflare for this purpose; no advertising cookies are set.
• Confirmation and reset tokens for email address and password. Only a hash of these is stored in the database; the actual value appears exclusively in the email sent.

Purposes and legal bases

The data is processed in order to provide you with an account, show you the calendars you follow, publish your own events, send system emails and keep operations technically secure. The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR) and the legitimate interest in secure, stable operation (point (f)). Country of origin, language and last use also serve to detect automated sign-ups, delete inactive accounts and understand, in aggregated form, how CalFollow is used (also point (f)). No processing for advertising purposes or analysis by third parties takes place.

Publicly visible content

Organization profiles and calendars with the visibility “public” can be accessed by anyone – without an account and findable via search engines. This applies to the name, description, image and all events published in them. Calendars set to “private” can only be reached via their secret link, optionally also protected by a password. Anyone who knows this link has access: only share it with people who are meant to see the calendar. Your user account itself and the list of calendars you follow are not visible to others.

Calendar feed

For adding to Google Calendar, Outlook or Apple Calendar, CalFollow provides a personal feed link. It contains a secret token and can be accessed without logging in – anyone who knows the link can see the events you follow. You can renew the link at any time under “My calendar”; the old one becomes invalid immediately.

Map “What's on?”

• Map images: when you open the map, your browser loads the map images directly from OpenFreeMap (tiles.openfreemap.org). As with any web page request, the provider sees your IP address and which map sections are loaded. CalFollow transmits no further data. The homepage only shows a picture of the map and loads nothing from OpenFreeMap.
• Place search: what you type into the search on the map or – as an organizer – into the place search is forwarded by our server to the Photon search service of komoot GmbH (Germany), without your IP address or account data. To curb abuse, we briefly count searches per account or per IP address; the counter expires after ten minutes.
• Your location: the location button asks for your location via the browser, only after you allow it there. The position is used solely to move the map in your browser; it is neither sent to CalFollow nor stored.
• Views and clicks: we count how often events are shown and clicked on the map – as a total per event and day, without IP addresses, without cookies and without any link to you. Organizers see these totals for their own calendars.
• Event locations: organizers can assign a point on the map to the locations of their events. Like the event itself, it is publicly visible.

Cookies and local storage

CalFollow does not use advertising, tracking or analytics cookies. Only the following are used:

• Session cookie for login – necessary so that you stay logged in.
• Unlock cookie for password-protected calendars – remembers that you entered the calendar password correctly.
• Local storage in the browser for your choice between light and dark appearance. This setting never leaves your device.

As all three are either necessary for operation or do not leave your device, no consent is required – which is why there is no cookie banner.

Fonts

The fonts used are delivered with the application itself. No connection to Google Fonts or any other external service is established when a page is loaded.

Disclosure to service providers

The following processors are used to operate the service. They receive data exclusively to provide their services and are contractually bound to confidentiality:

• Vercel Inc. (USA) – Hosting of the application and delivery of the pages. Data: Connection data such as IP address, page accessed, time and browser identifier.
• Neon Inc. (USA), database in the EU (Frankfurt) – Operation of the database containing account, calendar and event data. Data: All content and account data stored in the application.
• Vercel Blob (Vercel Inc., USA) – Storage of uploaded images (profile, organization and calendar images). Data: The uploaded image file.
• Resend (Resend Inc., USA) – Sending of system emails (email address confirmation, password reset). Data: Email address and content of the respective message.
• Cloudflare Inc. (USA) – Protection of the sign-up form against automated registrations (Turnstile). Data: IP address and technical browser characteristics during sign-up.
• Google Ireland Ltd. or Microsoft Ireland Operations Ltd. – Login with an existing Google or Microsoft account (only if chosen). Data: Account data transmitted by them: email address, name, profile picture.

Data may be transferred to the USA in the process. Such transfers are based on the standard contractual clauses of the European Commission or on the recognition of an adequate level of data protection. Data is neither sold nor disclosed for advertising purposes.

Retention period

• Account, calendar and event data: until you delete it or close your account.
• Unconfirmed accounts: deleted automatically seven days after sign-up.
• Inactive accounts: deleted after two years without use, with prior notice by email 30 days in advance. Accounts that manage an organization are exempt from both.
• When an account is deleted, your account, your organizations, their calendars and events, and your follows are removed.
• Confirmation and reset tokens as well as security counters: expire automatically after a short time.
• Feedback: deleted automatically after two years, or earlier on request; feedback you sent while logged in is deleted together with your account.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing. You can do much of this directly in the application: edit your profile and content, or delete your account completely under “My account”. For anything else, simply send a message to kontakt@proceture.ch.

The competent supervisory authority in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC/EDÖB). If you live in the EU, you can also contact the data protection authority of your country of residence.

Changes

This policy is updated when the application or the services used change. The version published here applies in each case.

Other legal documents

Legal notice · Terms of service