Privacy Policy

1. Who is responsible

Evera is an events listing service. For anything covered by this policy — including requests to access, correct or delete your data, or to remove a flyer or listing — contact us at legal@everaevents.com. This is also the channel for organizer takedown requests (see §4).

2. What we store

If you create an account, we store:

• Your account data — email address, display name, the time your email address was verified, your account role (for example organizer) and, if your sign-in method supplies one, an avatar URL. Your password is handled by our sign-in provider (see §5) and is not stored in our own database.
• Your birth year. We ask for this to enforce age limits on age-restricted events, and we deliberately store only the year, not your full birth date, to keep what we hold to the minimum needed.
• The events you save, and the organizers and venues you follow.
• Requests to follow a page — the Instagram or Facebook page you ask us to add (the link or handle you paste) and the status of that request.
• Event links you submit — the Facebook event or Instagram post link you paste to add an event, its status, and, if it is refused, a short automated reason. Submissions are screened automatically; when a screening check flags a submission we keep a security record of it (what was flagged, a risk score, and the link) and may turn off link submissions for the account.
• Saved search filters — a name and the filter settings you chose (a city name, or that you chose “near me” and a radius). No coordinates are stored; a “near me” filter asks your device for its location again each time you use it.
• Series of recurring events you have chosen to show less of.
• A record of which events you've viewed while signed in, used to power the unique visitor counts organizers see on their dashboard.
• A push notification token for each device where you enable notifications, and a log of which notifications we have sent you, so that you do not get the same one twice.
• If you act as an organizer — your organizer profile claim, any verification requests you send (the organization number, website, social link and message you provide, and our reviewer's note), the events you submit or edit, and the record of who edited what.
• Any problem reports you send — your message, screenshots you attach, and technical details such as your browser or device, app version and screen size. The text of reports you send while signed in is deleted with your account (see §7); attached screenshots are kept as unlisted image files that are not removed automatically — email legal@everaevents.com to have one deleted.

Whether or not you have an account, our servers also handle technical data:

• Your IP address, used briefly to deliver pages, to avoid counting the same anonymous visitor twice when we count views of an event, and to limit how many problem reports one address can send. These checks are held in the server's memory only.
• The server logs of our API record your IP address together with the request — which address was asked for, including any search words or location your device sent with it (for example in a “near me” search), and whether it worked. They are kept in rotating logs — at the time of writing, roughly two months of history — and are used for security and troubleshooting.

You don't need an account to report a problem. A report sent while signed out is not linked to any account; it contains only what you write, the screenshots you attach, the same technical details and, if you choose to add one, a contact email address. To have such a report removed, email legal@everaevents.com and tell us what it said.

3. Why we use your data, and the legal basis

Under the GDPR (Article 6) we need a legal basis for each use of your data:

• Providing the service you asked for (contract). Your account, saved events, follows, follow requests, event links, saved filters, hidden series and organizer features exist because you use them.
• Age limits (contract and legal obligation). Your birth year is used to enforce age limits on age-restricted events.
• Notifications (consent). Push tokens and the notification log exist only if you enable notifications. Turning notifications off on your device stops them appearing; the push token stays until your device stops accepting notifications or you delete your account (§7).
• Running and protecting the service (legitimate interest). Our interests are showing organizers how many people view their events, fixing the problems you report, keeping the service secure and preventing abuse (including screening the event links you submit), and troubleshooting from server logs. You can object to this (see §8).
• Public event and organizer information (legitimate interest). Our interest is helping people find events. See §4.

4. Event and organizer information

Most of the event information on Evera — titles, times, venues, descriptions and flyer images — is gathered from public event announcements (for example public social media posts and websites), not supplied by an Evera account holder. The same is true of organizer and venue names and social links. Public posts are processed with automated tools, including AI language-model services, to extract event details; no account data is sent to them. The same applies to a link you submit: we fetch the public post and process it this way, without sending your account details. If you run an event or venue listed on Evera and want information about it removed, contact legal@everaevents.com.

5. Who processes your data

We use the following recipients to run the service:

• Hetzner (data centre in Finland, EU) — hosting of the website, the API, the database and uploaded images.
• Supabase — sign-in only: it holds your email address and password credentials.
• Resend — sends the confirmation and password-reset emails, so it receives your email address and the message.
• Cloudflare R2 — encrypted off-site backups of our data.
• OpenFreeMap — map tiles. Your browser or app requests them from OpenFreeMap directly, so it receives your IP address when you view a map.
• Expo — delivery of push notifications, which it passes on to the push service built into your phone's operating system.
• Apify — gathering public event information from the web. It receives no account data.

We do not use advertising technology or third-party analytics services.

6. Transfers outside the EU/EEA

Our own servers are in Finland. Resend, Expo, Cloudflare and Supabase are US-based companies, so personal data can reach the United States. We rely on these safeguards:

• Resend and Cloudflare — the EU–US Data Privacy Framework and Standard Contractual Clauses.
• Expo — the EU–US Data Privacy Framework.
• Supabase — Standard Contractual Clauses.

To ask how to obtain a copy of these safeguards, contact legal@everaevents.com.

7. How long we keep it

We keep your account data, and everything linked to it, for as long as your account exists. Choosing “Delete account” in account settings permanently removes your account and everything linked to it — your saves, follows, follow requests, event links and their security records, saved filters, hidden series, view records, push tokens, notification log, verification requests and problem reports (screenshots on request, see §2). All we keep is a random account ID with no personal data, so that a sign-in token issued before the deletion cannot re-create the account.

Events you published as an organizer are not deleted along with your account: they remain listed, de-linked from the deleted account, so that the information already public isn't lost to attendees. The history of edits to those events, and any organizer profile you claimed, are kept in the same way.

A push token is also removed when the push service reports that the device no longer accepts notifications. Server logs are rotated as described in §2. Our encrypted off-site backups are made nightly, so deleted data can remain in them until they are replaced by newer backups.

8. Your rights

You have the right to access the data we hold about you, to have it corrected, to have it erased, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent you have given (turn off notifications on your device; see §3 for what that leaves behind). You can erase your account yourself with “Delete account” in account settings. For any other request, email legal@everaevents.com; we answer within one month.

If you think we handle your data unlawfully, you have the right to complain to the Swedish supervisory authority, Integritetsskyddsmyndigheten (IMY), at imy.se, or to the authority in your own country.

9. Cookies and storage on your device

On the website we store:

• If you sign in, a sign-in cookie (sb-…-auth-token) that keeps you signed in until you sign out or, at the latest, about 400 days after you last used the site, plus a temporary helper cookie while a sign-up confirmation is in progress.
• Your accent colour choice in your browser's local storage (evera.accent).
• A note in your browser's session storage (evera:intro) that you have already seen the intro animation, which is cleared when you close the tab.
• The last page you visited in this tab, in session storage (report:last-page), used only to fill in the page address if you send a problem report; it is cleared when you close the tab.

In the app we store:

• Your sign-in session, in the device's secure storage.
• Your choices — language, accent colour, whether we have already asked about notifications — and your last few search terms, on the device only.

The web version of the app keeps the same items in your browser's local storage. All of this is either needed to provide the service you asked for or remembers a choice you made. It is not used for tracking or advertising, so we do not show a cookie banner (Swedish Electronic Communications Act, 9 kap. 28 §).

10. Children

Evera is not directed at children. Age limits on age-restricted events are enforced using the birth year on your account (see §2).

11. Changes to this policy

We may update this policy from time to time; the date at the top shows when it last changed.