Privacy
Controller
Daniel Schuster
c/o COCENTER
Koppoldstr. 1
86551 Aichach, Germany
Email: tanuel.mategi@gmail.com
Website: https://openstage.one
This notice describes what the software actually does (as of August 2026).
No data protection officer has been appointed (the statutory appointment duty does not apply here).
Hosting
Servers and uploads run at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, as a processor (Art. 28 GDPR). Access data (IP address, time, user agent) may appear in server logs where needed for operations, security and abuse prevention. Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in a stable, secure service). Logs are kept only as long as operations and security require, typically a few days to a few weeks.
Data we process
Account
Email sign-up: email address, password hash, optional display name, optional profile bio, optional Instagram/YouTube links, optional profile photo (first-party upload), email confirmation timestamp and timestamps for accepting the terms and acknowledging this privacy notice. Google sign-in (only after you click): Google ID, email, display name; the email is treated as verified. We do not store Google profile photos. Scopes: email, profile.
An email address is required for an account. Without it the user agreement is not concluded.
Events
Hosts store title, description, address, dates and an optional cover. The address is geocoded server-side via OpenStreetMap Nominatim (coordinates). Public event pages are visible without signing in. When content moderation is enabled, title, description and cover may be sent to the OpenAI Moderation API.
Uploads
Profile and cover images are stored as WebP under /uploads/… and, in production, served through the Cloudflare edge (object storage R2); during development they are served directly from the server. There are no third-party image CDNs. A JPEG for link previews (Open Graph) may be generated from covers.
Contact form
You can contact us via /kontakt (question, abuse report or other). We store type, name, email, subject, message and an optional related URL. If you are signed in, we attach the request to your account on the server. The request sits in the admin inbox, and the admins receive a notification (Reply-To = your sender address). There is no confirmation email to you. Requests are not deleted in v1.
Collaborator invitations
Hosts can invite others by email to co-organise an event series, even if that person has no account yet. We store the invited email address on the series and send an accept link (valid for seven days). After acceptance the email stays with the membership; the token is removed. Pending invitations are not public. The address may be a third-party detail provided by the host.
RSVP (“I’m going”)
Signed-in users can mark “I’m going” per occurrence or withdraw it. We store the account ↔ occurrence link. The count of RSVPs is visible on the public occurrence page. The name list (display name, public handle, avatar) is visible only to the host, admins and accepted co-organisers of the series – not to the general public. Attendee email addresses are not exposed through this feature. Deleting the account or the occurrence removes the RSVPs.
In-app notifications
While signed in you see an in-app inbox (bell) for updates about saved event series and platform announcements. Entries are stored on the account, last 90 days and are then deleted. Under preferences you can store channel settings (email and push per type). Push uses Web Push to your devices (service worker). The email channel is stored; sending for favorites/platform comes later.
Technically required browser storage
- JWT access token as an HttpOnly cookie (
openstage_access) while you stay signed in - UI language as a cookie and
localStorage(openstage_locale) - Theme as a cookie and
localStorage(openstage_theme) - Last search and history locally (
openstage_preferences); after sign-in also on the account
Cookie settings: On your first visit a banner appears (c15t). You can separate necessary cookies (sign-in, language, appearance) from the optional statistics category. Statistics loads PostHog (EU cloud) only after you consent: page views, coarse usage events (text in click events masked) and JS errors. There is no session recording (no video of your session). c15t stores the choice locally in the browser; an optional c15t backend for audit logs is only active if configured. Change your choices anytime via “Cookie settings” in the footer. Necessary storage: Art. 6 (1)(b) or (f) GDPR and § 25 (2) TDDDG. Optional statistics: Art. 6 (1)(a) GDPR and § 25 (1) TDDDG.
Purposes and legal bases
| Processing | Purpose | Legal basis |
|---|---|---|
| Account, events, uploads | Contract for using the platform | Art. 6 (1)(b) GDPR |
| Contact form | Handling enquiries and notices | Art. 6 (1)(f) GDPR |
| Collaborator invitations | Host invites co-organisers | Art. 6 (1)(b) GDPR |
| RSVP (“I’m going”) | Host estimate; count public, names only host/co-organisers | Art. 6 (1)(b) GDPR |
| Server logs, security, abuse prevention | Stable operations | Art. 6 (1)(f) GDPR |
| Google sign-in | Alternative sign-in | Art. 6 (1)(a) GDPR (consent by clicking) |
| Browser geolocation | Nearest city after clicking “Use location” | Art. 6 (1)(a) GDPR |
| Optional statistics cookies (PostHog) | Page views and errors, opt-in only | Art. 6 (1)(a) GDPR, § 25 (1) TDDDG |
| Content moderation (OpenAI, local NSFW) | Detecting abuse and illegal content | Art. 6 (1)(f) GDPR |
| Legal obligations | e.g. retention, access requests | Art. 6 (1)(c) GDPR |
Legitimate interests (f) are operational security and abuse prevention (including content moderation) and handling contact requests. You may object (Art. 21 GDPR).
Recipients and services
The browser does not load Google Fonts, map iframes or social SDKs. UI, fonts and uploads stay first-party.
| Service | When | What |
|---|---|---|
| Hetzner | ongoing | Hosting of app, API, database and uploads in Germany |
| Google OAuth | Click “Sign in with Google” | Redirect to Google; we store Google ID, email, display name – no profile photo |
| Google Maps | Click an event address | You leave OpenStage; the query is the event address. No Maps SDK, no API key in the frontend |
| Instagram / YouTube | Click social icons on a public profile | You leave OpenStage to the linked channel. No social plugins |
| Google Calendar / Outlook | Click “Add to calendar” | You leave OpenStage; the query is title, times, place and event URL. No calendar SDK. The ICS file is created locally in the browser |
| WhatsApp / Telegram / email | Click in the share sheet, only without native share | You leave OpenStage. No social plugins. Messenger crawlers may fetch public event URLs and the OG image |
| Browser geolocation | Click “Use location” | Coordinates stay on the device; OpenStage does not store them. They only pick the nearest city from the cities catalog |
| Nominatim / OpenStreetMap | Creating or updating an event series; creating/importing an admin city | Free-text address or City, Country server-side, rate limit 1 req/s |
| OpenAI Moderation API | Only when content moderation is enabled (environment or admin toggle) | Event series title, description and optional cover; response is flag/categories only |
| Hetzner Konsole (SMTP) | Sign-up, email confirmation, password reset, email change, collaborator invitation, contact request (admin notification), moderation decision | Recipient address, link or the short decision reason; for contact requests name, email, subject and message to the configured admin address (Reply-To = sender). Sent via a Hetzner mailbox (SMTP), from noreply@openstage.one |
| Amazon SES | Optional, when the SES transport is active | Recipient address and link; for contact requests the same content as SMTP. Sent via Amazon SES (SendEmail API, Frankfurt region), from no-reply@openstage.one |
| PostHog (EU cloud) | Browser only after “Statistics” cookie consent, and only when enabled in system settings; server events only when enabled | Page views, coarse usage events, JS errors; internal user ID after sign-in, no email. No session recording. The server may report unhandled API errors without request bodies as well as counting events (sign-up, mail sent, series created/updated) with user ID or anonymous and IDs/types only |
| Web Push (browser push services) | Only after opt-in under settings (Push) and browser permission | Title and body of the in-app notification plus a relative app link to your devices |
Transfers to third countries
- Google OAuth, Google Maps, Google Calendar: Google LLC, USA. Google is certified under the EU-US Data Privacy Framework; where the Framework does not apply, Google relies on Standard Contractual Clauses.
- Outlook / Microsoft: When you click, you leave OpenStage; Microsoft’s terms apply. Microsoft is likewise DPF-certified or uses Standard Contractual Clauses.
- Nominatim / OpenStreetMap: The OpenStreetMap Foundation is based in the United Kingdom. The EU Commission has adopted an adequacy decision for the UK.
- OpenAI Moderation API: OpenAI, LLC, USA. Transfer only when content moderation is enabled (title, description, optional cover). OpenAI is certified under the EU-US Data Privacy Framework; where the Framework does not apply, Standard Contractual Clauses apply.
- Hetzner Konsole (email): Transactional mail via SMTP to a Hetzner mailbox in Germany (from noreply@openstage.one). Sending itself does not transfer data to a third country.
- Amazon SES (email): Only when the SES transport is active. Amazon Web Services EMEA SARL / AWS. Transactional mail from the Frankfurt region (
eu-central-1). We send the recipient address, subject and body (confirmation/reset link). Where processing takes place in the USA, AWS relies on the EU-US Data Privacy Framework or Standard Contractual Clauses. - PostHog (statistics): PostHog, Inc., EU cloud (ingest
eu.i.posthog.com, storage in the EU, typically Frankfurt). Only after opt-in and when the service is enabled in system settings. The vendor offers a data-processing agreement (DPA); this is not legal advice.
Apart from that, no transfer takes place unless you leave OpenStage by clicking a third-party offer.
Retention
Account data and events remain while the account or series exists. If you delete your account under Profile → Account, the account, hosted event series, occurrences, RSVPs, in-app inbox and attached uploads are removed. In-app notifications expire after 90 days. Uploads you attach to a profile or cover otherwise stay with that record. Contact requests remain in the admin inbox; the link to the account is dropped, while name, email and message stay. Collaborator invitations and memberships stay with the series (email until the membership or invitation is removed or the series is deleted; token seven days or until acceptance). Server logs only as long as operations and security require. Statutory retention duties remain unaffected.
Your rights
Subject to applicable law you may request access, rectification, erasure, restriction of processing, data portability and object to processing (Art. 15–21 GDPR). You may withdraw consent at any time with effect for the future (e.g. cookie settings; Google sign-in by choosing another sign-in method). You can delete your account and hosted content yourself under Profile → Account; admins can also delete or block accounts.
You may lodge a complaint with a supervisory authority. For us this is typically the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany, https://www.lda.bayern.de. You may also complain to the authority at your place of residence.
No automated decision-making including profiling within the meaning of Art. 22 GDPR takes place. The machine pre-check only hides content provisionally; flagged series are reviewed by a natural person. On the flag we store the time, action, a required short reason, an optional terms clause, and source/system where known. When content is deleted or an account is banned we email the host the reason.
Fonts and city photos
Fonts are self-hosted (see the imprint). City photos are stored locally; attribution and licences are in the imprint. Those are copyright notices, not tracking services.
As of August 2026