Datenschutz.

The controller for the purposes of Art. 4(7) GDPR is:

Showup, operated privately from Aachen, Germany
Postal address to be added before launch
hallo@showup.app

Showup is small enough that it is not required to appoint a data protection officer under Art. 37 GDPR and section 38 BDSG. Write to the address above about anything on this page.

You can read Discover, the map and every group page without an account, and nothing on this list exists until you make one.

Account

Your name, email address, home city, a scrypt hash of your password, your profile picture if you add one, and whether your profile is public or private. Private means strangers see your name and nothing else; people you have accepted as friends see what a public profile shows, because accepting them is you deciding that.

Art. 6(1)(b) GDPR, performance of a contract. Without an account there is nothing to log in to.

Login sessions

A random token, when it was issued and when it expires, held both in a cookie on your device and as a row in the database.

Art. 6(1)(b) GDPR. Keeping you signed in is part of running the service you asked for.

Groups and events

The groups you joined or host, the events you posted (with or without a group behind them), and their date, venue name, address and coordinates. Venue coordinates describe places, not people, and are public by design.

Art. 6(1)(b) GDPR.

Friends

Who you asked to be friends with, who asked you, and which of those were accepted, with the dates. A friendship is one record naming both people. Declining a request or removing a friend deletes the record rather than marking it, so nothing keeps a note of who said no.

Art. 6(1)(b) GDPR. Showing your friends what you have on is the function you asked for.

Invitation links

Every event gets a random code that forms part of a link its host can send. Holding the link is what lets somebody take a seat at a friends-only event. The code says nothing about you and is not tied to whoever the link was sent to.

Art. 6(1)(b) GDPR.

RSVPs and check-ins

Whether you said you were coming to an event, whether a host approved the seat, and whether you marked yourself present afterwards. Check-ins are self-reported. Nothing detects your presence automatically.

Art. 6(1)(b) GDPR. Showing who is coming is the function of the app.

Pictures and captions

Pictures you post from an event you attended, with any caption, stored against that event and against you.

Art. 6(1)(b) GDPR.

Notifications

One line per thing that happened to you in the app, read inside the app. Showup sends no email at all, not even for password resets.

Art. 6(1)(b) GDPR.

Reports

If you report a group, an event or a person, we store who reported what and the reason you gave.

Art. 6(1)(f) GDPR, legitimate interest in keeping the app safe to turn up to.

Server logs

Our hosting provider records requests, including IP addresses, for delivery, security and troubleshooting. We do not build them into profiles.

Art. 6(1)(f) GDPR, legitimate interest in a working and secure service.

showup_session

A cookie holding a random login token. httpOnly, SameSite=Lax, secure in production, valid 30 days. It encodes nothing about you: the token is meaningless without the matching database row, and deleting that row logs the device out.

Strictly necessary, section 25(2) TDDDG, so no consent banner is required.

showup-theme

A local storage entry remembering whether you chose the light or the dark page. It never leaves your device and is never sent to the server.

Strictly necessary for a setting you asked for.

That is the complete list. There is no third cookie, no cookie set by anyone but us, and no consent banner because there is nothing to consent to.

If you allow it, your browser gives the app your coordinates so Discover can be sorted by distance and the map can draw the dot showing where you are standing. Your browser asks first, and you can refuse or withdraw the permission at any time in your browser settings, losing nothing but the sorting.

Those coordinates are used in your browser and nowhere else. They are never sent to our server, never written to the database and never shared. The legal basis is your consent, given through the browser prompt, under Art. 6(1)(a) GDPR and section 25(1) TDDDG.

• No analytics, no trackers, no advertising pixels, no third-party scripts. There is no measurement layer in the app at all.
• No profiling and no automated decision-making within the meaning of Art. 22 GDPR.
• No sale of personal data, and no sharing of it for advertising.
• No mailing list and no marketing email. Your address is a login credential.
• Fonts are served from our own domain, so loading a page sends nothing to Google Fonts.

Vercel

Hosting and delivery. The app runs in Vercel's Frankfurt region (fra1). Vercel Inc. is a US company, so a data processing agreement with the EU Standard Contractual Clauses applies.

Processor under Art. 28 GDPR.

Neon

The Postgres database, hosted in the EU (eu-central-1, Frankfurt). Everything in section 02 lives here.

Processor under Art. 28 GDPR.

OpenStreetMap Foundation

Map tiles are fetched by your browser straight from tile.openstreetmap.org, so their servers see your IP address and which part of the map you looked at, the way any website you load does. We send them nothing about you.

Art. 6(1)(f) GDPR, legitimate interest in showing a map. OSMF is a separate controller for what it receives.

Nominatim, for address search

When a host searches for a venue, the search runs through our server rather than from your browser, so OpenStreetMap's geocoder sees our server and not your IP address.

Art. 6(1)(b) GDPR.

There is no one else. No advertising network, no analytics vendor, no CRM, no email provider.

• Account data, groups, friendships, events, RSVPs, check-ins and pictures: until you delete them, or until you delete the account, which takes all of it at once.
• Login sessions: 30 days at most, and expired ones are swept by a daily job.
• Reports: kept while they are still useful for handling the situation they describe. A report about somebody is deleted with their account; a report they filed about someone else outlives it, with their name detached.
• Server logs: kept by the hosting provider for its own short retention period, then dropped.

Under the GDPR you can ask for any of the following, and we answer within one month:

• Access to the data we hold about you, and a copy of it (Art. 15).
• Correction of anything wrong (Art. 16).
• Deletion (Art. 17).
• Restriction of processing (Art. 18).
• A machine-readable export to take elsewhere (Art. 20).
• Objection to anything done on the basis of legitimate interest (Art. 21).
• Withdrawal of consent, such as location access, at any time, with no effect on what happened before (Art. 7(3)).

Write to hallo@showup.app. You also have the right to complain to a supervisory authority (Art. 77). For a controller in North Rhine-Westphalia that is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen in Düsseldorf, and you may equally go to the authority where you live.

There is a button, at the bottom of your profile under Settings. It asks for your password, lists what is about to go, and then does it immediately. There is no waiting period, no thirty days in a bin, and no way to get any of it back.

What it removes: your name, email, password, picture and city; your friendships; your memberships; your RSVPs; your check-ins and the streaks counted from them; your pictures; your notifications; and every login session, so any other browser you were signed in on is signed out too. Groups you host go with it, along with their events, their member lists and everything posted on them, so hand a group over to somebody else first if you would rather it survived you. Events you were running go the same way, and anyone holding a seat at a future one is told it is off.

It also removes you from other people's records: any notification that named you as the person who did something is deleted rather than just unlinked, and so is any report filed about you or about a group you host.

One thing is deliberately kept. If you reported somebody else, that report stays, with your name detached from it. It is a record about the person you reported, not about you, and closing an account should not be a way to withdraw it. It no longer points at you in any way.

If you would rather somebody did it for you, or you cannot get into the account, mail hallo@showup.app from the address on the account.

Showup is not meant for children. Do not make an account if you are under 16. If you find out that a child has, write to us and it will be removed.

If the app starts doing something this page does not describe, this page is updated before that ships, not after. The date below says when it was last true.