Privacy Policy

1. Who is responsible

The data controller for FaBu is Simon Bodelet. For anything related to your personal data — questions, requests, complaints — contact simon.bodelet@gmail.com.

2. What data we collect

We only collect what the service needs to work:

• Account data: your name (optional), username, email address, a hashed version of your password (never the password itself), and your preferred language.
• Content you create: events (title, description, address, times, cost, capacity, images), messages in event discussions, and photos you upload to event galleries.
• Participation data: which events you are invited to, your RSVP responses, your role (participant or organizer), and — for paid events — whether you have paid.
• Guest RSVPs: if you respond to a public invite link without an account, the name and email address you enter, tied to that one event.
• Friendship data: friend requests you send and receive, and their status.
• Technical data: short-lived rate-limiting counters (to prevent abuse) and standard server logs kept by our hosting provider.

FaBu does not use tracking cookies and does not build advertising profiles. Usage analytics are collected without cookies and without identifying you (see section 8).

3. Why we process it (legal bases)

• To provide the service — creating your account, showing events, delivering invitations, RSVPs, messages, photos, reminders and payment status. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• To keep the service safe — rate limiting, abuse prevention and server logs. Legal basis: our legitimate interest in running a secure service (Art. 6(1)(f) GDPR).
• To send transactional email — invitations, RSVP notifications and event reminders. These are part of the service itself; FaBu sends no marketing email. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• To comply with legal obligations where they apply (Art. 6(1)(c) GDPR).

4. Who can see your data

Other users see what you share with them: your username and name appear to people in the same events and to your friends; your RSVPs, messages and photos are visible to the other participants of that event; if you host an event with a public invite link, anyone with the link can see the event details.

We also rely on a small number of service providers (processors) who handle data on our behalf:

• Vercel Inc. (USA) — hosting the application, storing uploaded images, and cookieless aggregate analytics.
• Neon Inc. (USA) — the database where FaBu's data is stored.
• Stripe Inc. (USA) — payment processing for paid events. Card details go directly to Stripe; FaBu never sees them.
• Resend (USA) — delivery of transactional email.

We do not sell personal data and we do not share it with anyone else, unless required by law.

5. International transfers

Our providers are US companies. Transfers of personal data to them are protected by the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses, as applicable to each provider.

6. How long we keep data

• Account and content data: for as long as your account exists. Deleting your account (Settings → Delete account) permanently removes your account, the events you host, and your messages, photos, RSVPs and friendships.
• Guest RSVPs: for as long as the event exists, or until the host removes the entry or you ask us to delete it.
• Rate-limiting counters: minutes to hours; they expire automatically.
• Server and delivery logs kept by our providers: per those providers' standard, limited retention periods.

7. Your rights

Under the GDPR you can, at any time:

• Access and export your data — Settings → Download my data gives you a machine-readable JSON copy (right of access and portability).
• Correct your data — your profile can be edited in Settings (right to rectification).
• Delete your data — Settings → Delete account removes everything immediately (right to erasure).
• Restrict or object to processing based on legitimate interests.
• Complain to a data protection supervisory authority in your EU country if you believe we handle your data unlawfully.

For anything you cannot do in the app, email simon.bodelet@gmail.com. We answer within one month, as the GDPR requires.

8. Cookies and analytics

FaBu uses exactly two cookies, both of which are needed for the service to function — which is why no cookie consent banner is shown:

• A session cookie that keeps you signed in (strictly necessary; deleted or expired when you sign out).
• NEXT_LOCALE, which remembers your chosen language for up to one year (functional).

There are no advertising, tracking or third-party cookies. Page analytics (Vercel Analytics) work without cookies and without persistent identifiers: we see aggregate counts, not individual visitors.

9. Guests without an account

If you RSVP to an event through a public invite link, we store only the name and email address you enter, and use them solely to show the host who is coming and to send reminders about that event.

To access or delete this data, email simon.bodelet@gmail.com, or ask the event's host, who can remove your entry directly.

10. Children

FaBu is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.

11. Changes to this policy

If this policy changes in a meaningful way, we will update the date at the top of this page and, for significant changes, point it out inside the app.