Privacy Policy

Who we are

Tanzkarte ("we", "us") is a private, non-commercial website at tanzkarte.at, a bilingual directory and planning tool for Vienna's ball season. The data controller is Giomar Hexspoor, reachable at contact(at)tanzkarte.at. See also our Impressum.

What data we collect

We only collect what we need to run the service.

If you browse without an account

• Theme preference — a theme cookie remembering light or dark mode.
• Server logs — standard technical logs (IP address, browser, timestamps) kept briefly by our hosting provider for security and troubleshooting.

If you create an account

• Account data — email address, display name, username, preferred language, and account role.
• Your season — the balls you mark as interested or going.
• Social data — your friend connections, dance-card entries (including freeform partner names you enter yourself), and private events you create or are invited to.
• Private ball data — when you create a private ball, the details you enter (such as its title, date, venue, address, description, dress code, and guest list), and, when you are invited to one, your invitation status.
• Privacy and notification preferences — your chosen settings.

Location

The "Near me" feature uses your browser's geolocation only after you allow it. Your coordinates stay on your device to sort the map and list; they are never sent to or stored on our servers.

Cookies

We use only essential cookies:

• Authentication cookies set by Supabase to keep you signed in.
• A theme cookie to remember your light/dark preference.

We do not use advertising or analytics cookies. Because these cookies are strictly necessary for the service to work, no consent banner is required for them; we show a short informational notice instead.

Why we process your data (legal bases)

• Performing our contract with you (Art. 6(1)(b) GDPR) — to provide your account and its features.
• Legitimate interests (Art. 6(1)(f) GDPR) — to keep the service secure and working, and to make sure a deleted account stays deleted.

Email

We send only account emails: sign-in links, confirmations, and password resets. Email is delivered through our email provider, Zoho. We do not send notification emails, newsletters, or marketing of any kind.

Who processes your data

We rely on these processors:

• Supabase — database, authentication, and storage.
• Vercel — website hosting.
• Zoho — email delivery.

Nothing else is loaded from anywhere else. The ball map's tiles, label fonts and icons are all served from tanzkarte.at, so no map provider ever sees your requests, and ball photographs are served from our own storage rather than linked from the organisers' websites. In practice this means that browsing the site reveals your IP address to Vercel, and to Supabase once you sign in — to nobody else.

What other people can see

Your profile is never public and cannot be searched or browsed by other members. Your display name and username are readable only by people something already connects you to: your friends and anyone who has sent you or received from you a friend request, the people you share a dance-card entry with, and the host and guests of a private ball you are part of.

Your profile photo is stored privately and follows the setting in your privacy settings — your friends only, or every signed-in person who can already see your name. There is one deliberate exception: if you host a private ball, the guests you invite always see your photo alongside your name and username, whatever that setting says, so they can tell who invited them. Someone opening your invite link without signing in sees your name and username but no photo.

How long we keep your data

We keep account data while your account exists. When you delete your account, your profile, friendships, dance cards, private events, and related data are permanently removed. Technical logs are rotated on our providers' standard schedules.

We keep one thing after a deletion: an internal record of the account's identifier and the time it was deleted, for up to 90 days. It holds no name, email address, or other content. Its only purpose is to let us re-apply the deletion if we ever have to restore the database from a backup that predates it — without it, a restore would quietly bring a deleted account back.

Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, and port your data, and to object to certain processing. You can:

• Export your data at any time from your settings.
• Delete your account at any time from your settings.

To exercise any other right, contact us at contact(at)tanzkarte.at. You also have the right to lodge a complaint with a data protection supervisory authority — in particular the one in your country of residence or place of work.

Changes to this policy

We may update this policy. The "last updated" date above reflects the current version.