Privacy · gather

This tool coordinates the logistics of Libre Space Foundation gatherings. It holds personal data about the people attending, so here is exactly what it keeps, why, for how long, and how to get rid of it.

Who is responsible

The Libre Space Foundation is the data controller. For anything on this page, including erasure requests, write to info@libre.space.

What is collected

Only what someone types in, plus the timestamps needed to run the thing.

Your account: Email address, the display name you choose, optionally your forum handle, your language preference, and when you last signed in. Plus an identifier linking this account to your Libre Space ID — a string of letters and numbers that means nothing outside signing in.
Your answer to an event: Whether you are coming, which accommodation you picked, your arrival and departure dates, and any note you write.
Room sharing: Whether you want a room to yourself, and who you would rather share with.
Diet: Your diet (omnivore, vegetarian, vegan and so on) and any note about it.
Allergens — health data: If you tell us about an allergy, that is health data and gets stricter handling. See below.
Travel: Where you are leaving from, when, in what, how many seats you have or need, how much luggage room, and any note about the vehicle.
Gear: Which items you have, need, or can lend.

What is deliberately not collected

No phone numbers. This was considered and rejected. The community already has its own contact channels, so storing numbers would add personal data for no gain.
No passwords. Never, by either route. This site holds no password of yours: signing in happens at auth.libre.space, and where a link is emailed instead, only a hash of that link's token is ever stored — so a leaked database yields no working logins.
No tracking. No analytics, no advertising cookies, no third-party scripts. The only cookie is the one that keeps you signed in.
One exception, and it is the map. An event page with coordinates loads map tiles from OpenStreetMap, which means your browser contacts them directly and they see your IP address and which area of the map you are looking at. Nothing about you or the gathering is sent with it — no name, no email, no event title. It is the only request this application makes to anyone else, and an instance can switch it off entirely, in which case the map is drawn from coordinates instead.

Allergens are treated differently

Allergen information is health data — a special category under Article 9 of the GDPR. It is stored apart from your dietary preference and handled differently in three ways:

It is collected only if you choose to give it, on the basis of your explicit consent, and you can withdraw that at any time by clearing the field.
Catering can read it. Organisers cannot. The organiser summary shows counts by diet type and nothing else. This is enforced by the database, not only by the screens: a separate role grants access, and the summary view excludes the allergen columns outright.
It is deleted sooner than the rest of your answer — within 30 days of the event ending, once it can no longer serve any purpose.

If you would rather not put it in a database at all, that is a reasonable choice: tell an organiser directly instead.

Why, and on what legal basis

Everything except allergens is processed on the basis of legitimate interest — organising a gathering you asked to attend. You can object at any time, though it is hard to feed and transport someone whose answers we do not have.

Allergen data is processed on the basis of explicit consent, which legitimate interest cannot cover for health data.

Who can see it

Other participants see your display name, forum handle and whether you are coming, plus any lift or gear information you offer. That is the point: the tool exists so people can find each other a seat.
Organisers see the above plus aggregate counts.
Catering additionally sees allergens.
Nobody else. Your data is not sold, shared, or sent to any third party. There is no processor other than the servers the Foundation runs itself. Your browser makes two outbound requests that are not to this site: the map tiles above, which carry none of your data, and signing in, which goes to the Foundation's own identity service.

How you sign in

Signing in happens at auth.libre.space, the Libre Space Foundation's own identity service — the same account you use for the forum and everything else the Foundation runs. You are sent there, you sign in, and you come back. It is the same data controller, not a third party, and no new organisation learns anything about you.

What comes back is three things: an identifier for your account, your email address, and your name. Nothing else is requested and nothing else is stored.

Your session here belongs to this site. Signing out ends it immediately; auth.libre.space will then ask whether you want to sign out there as well, and that is your choice to make.

If you had an account here before this changed, it is the same account. The first time you sign in with your Libre Space ID the two are joined by your email address, and everything you had already answered is still there.

How long it is kept

A sign-in in progress: While you are away signing in, this site keeps a short record so it can recognise you coming back. It names nobody, and it is deleted the moment you return, or after 10 minutes if you do not.
Sign-in links: Expire after 15 minutes and can be used once. Purged 7 days after expiry.
Sessions: Expire after 30 days. Purged 7 days after expiry.
Allergens: Deleted within 30 days of the event ending.
Everything else: Kept while your account exists, so that the next gathering does not start from a blank sheet. Removed when you ask for erasure.

Your rights

You can ask for a copy of your data, correct it, object to processing, or have it erased. Most of it you can change yourself by signing in.

Erasure anonymises rather than deletes. Your identity — name, email, forum handle, and the link to your Libre Space ID — is removed, and the rows that remain stop pointing at a person. Historical headcounts stay correct without anyone being able to tell it was you. Where a row exists only to describe you, such as your allergens, it is deleted outright.

If you think this is being handled badly, you can complain to the Hellenic Data Protection Authority. We would rather you told us first.

Security, stated honestly

Access rules are enforced in the database itself, not only in the application, so a mistake in one screen cannot expose data another screen was hiding. Login tokens are stored only as hashes.

The known limitation, since pretending otherwise helps nobody: those database rules depend on the application connecting with a restricted account. Postgres does not enforce that on its own — the deployment does. The source is public, so you can check the claims on this page against the code.