Privacy Policy

In short

• We do not sell your data or use it for advertising.
• We use no tracking or advertising cookies.
• Your e-mail address is not shown to hosts or to other members.
• An event's exact address is shown only to guests whose place is confirmed, unless the host chooses otherwise.
• You can download a copy of your data and delete your account whenever you like.

The legal detail is in the KVKK Privacy Notice; this page says the same things in everyday language.

What we collect

• Account: your e-mail address. There is no password; you sign in with a code or a link we send to your e-mail.
• Profile: your name, city, interests and, if you wish, your photo, a short bio and your social links.
• Events: those you host; those you register for or apply to and your answers to the host's questions; your ticket and check-in time.
• What you write and share: your messages with hosts, carpool posts, feedback, event photos.
• Which link brought you to an event: if the host added a source tag to the link she shared, your registration is kept with that source.
• For safety: your reports, the members you block, the record of the texts you accepted.

Who sees what

• If you host an event: your name, photo, bio and the links you added appear on the event page.
• If you register for or apply to an event: its hosts see your name, photo and answers. Hosts can keep short notes and tags about guests that only they see.
• Other guests: see your name and photo where the host has opened the guest list; if you would rather not appear, turn it off in your privacy settings.
• Exact address and online link: the event page shows everyone only the city and district. The address is shown to guests whose place is confirmed, unless the host chooses otherwise; it is never put in e-mails.
• Your feedback is shown to the host without your name.
• Your reports reach the herity team only; the other side is not told who reported. When you block someone, she is not told.
• The herity team: can access account details (including your e-mail address) when support or safety requires it. Every admin action the team takes is logged.

Cookies and measurement

We use only what is essential: the cookies that keep you signed in, and settings stored in your browser such as your theme. There are no tracking, advertising or third-party analytics cookies, which is why we do not ask for cookie consent.

We count how often event pages are viewed without cookies and without recording who you are. To tell repeat visits on the same day apart we use an irreversible digest that changes every day, and erase it within two days at the latest.

E-mails

Sign-in codes and messages about your own registrations (application results, cancellations, a change of date or place, invites) are always sent. You can turn off reminders, host announcements, news from circles you follow and message notifications under Settings → Notifications.

The service providers we work with

• Supabase: database, sign-in and file storage. Servers in Germany (Frankfurt).
• Vercel: hosting of the application. Based in the United States; pages are served from its servers around the world.
• Resend: sending e-mails (sign-in codes, registration notices, announcements). Based in the United States.
• Mapbox: the text a host types when searching for an event's venue. Based in the United States.

These providers process your data only on our behalf. Because their servers are abroad, we ask for your explicit consent to this separately when you sign up.

How long we keep it

• Account and profile details: for as long as your account is open. When you delete your account they are erased for good at the end of the 30-day waiting period.
• Your answers to registration questions: erased one year after the event.
• Notifications and e-mail delivery records: erased after one year.
• The digests used for counting visits and preventing abuse: erased within two days at the latest.
• The record of the texts you accepted: for as long as your account is open.
• Where a law requires longer retention, the data concerned is kept for that period.

Security

• Every connection is encrypted (HTTPS).
• We keep no passwords; you sign in with a single-use code sent to your e-mail.
• In the database, who may read each record is defined record by record; a member reaches only the rows she is allowed to see.
• The photos you upload (profile, cover and event photos) are redrawn before upload; the location and device details inside them are removed.
• Admin access is limited and every admin action is logged.

No system is completely secure. If a breach affects your data we will inform you and the authorities within the periods the law sets.

What is in your hands

• Change your profile, and whether you appear in guest lists, in Settings.
• Choose which e-mails you receive under Settings → Notifications.
• Block a member, or report an event, a member or a circle.
• Download a copy of your data as one file from Settings → Account.
• Delete your account from the same page; unless you change your mind within 30 days, your data is erased for good.

Age

herity is for people aged 18 and over. If we learn that someone under 18 has opened an account, we close it and erase its data.

Changes and contact

When we update this policy we publish the new version here and tell you about important changes.

You can send your questions to merhaba@herity.space.