Privacy Policy

In short: no accounts, no advertising cookies, as little data as possible, and EU hosting where feasible.

Controller

Georgi Kostov, Breitwiesenstraße 22, Tür 7, 4481 Asten, Austria
hello@okolo.events

What we process

• No user accounts. You can use Okolo without signing in.
• Server logs & abuse prevention. Our host necessarily receives your IP address when you visit. To limit spam in anonymous submissions, we store only a hashed IP value, never the IP address itself.
• Language. On your first visit, we use the approximate IP country code supplied by our host to select German, Bulgarian or English. We store your manual choice in a necessary first-party cookie and local storage.
• Usage analytics. We use PostHog (EU hosting) to understand Okolo through anonymous, aggregated statistics. Autocapture and session recording are disabled, and “Do Not Track” is respected.
• Newsletter. If you subscribe, we store your email address and — to select events for your region — the chosen locality label and its approximate centre coordinates (not your device location), your chosen categories, and your language. We use double opt-in: the subscription is only active after you click the confirmation link. As proof of your consent we store the time of sign-up, the version of the consent text, and a hashed IP value (never the IP itself). Unsubscribe anytime via the link in every email.
• Your submissions. If you add an event/place or scan a poster, we process the content you enter and the photo. The published listing is publicly visible on the map.
• Location. “Find my location” uses your browser’s permission to centre the map. The location is not sent to us unless you intentionally provide coordinates for a listing. Location searches are sent to the geocoding service.

Legal bases

• Operation, security, abuse prevention and language selection: legitimate interests (Art. 6(1)(f) GDPR).
• Anonymous usage analytics: legitimate interests (Art. 6(1)(f) GDPR), configured to minimise data.
• Newsletter and publication of your submissions: your consent (Art. 6(1)(a) GDPR), withdrawable at any time.

Recipients & processors

• Vercel — website hosting (USA; Standard Contractual Clauses) and provision of the approximate IP country code.
• Supabase — database, EU region.
• PostHog — anonymous usage analytics, EU hosting.
• Google (Gemini) or Anthropic (Claude) — only to recognise text in a poster you upload (USA; Standard Contractual Clauses). The photo is deleted immediately afterwards.
• OpenStreetMap / OpenFreeMap (map tiles) and Nominatim / Photon (geocoding) receive the data technically required for map and search requests.

Retention

Hashed IP values used for abuse prevention are retained briefly. Poster photos are deleted immediately after recognition. Published listings remain until they expire or are removed. Newsletter data remains until you unsubscribe; your language preference remains until you delete it or it is not renewed for 12 months.

Cookies / local storage

We use no advertising cookies. A necessary first-party cookie and local storage remember your manual language choice. An anonymous analytics identifier may also be stored locally.

Your rights

You have rights of access, correction, deletion, restriction, data portability and objection, and may withdraw consent at any time. Email hello@okolo.events. You may also complain to the Austrian Data Protection Authority (dsb.gv.at).

Last updated: July 2026