Privacy policy

1. Controllers

Luciago is jointly operated by Julian Kaufmann and Sebastian Frankl. Both are jointly responsible and authorised to represent Luciago:

Julian Kaufmann and Sebastian Frankl
Luciago
Stifterweg 112
89075 Ulm
Germany
Email: support@luciago.com
Phone / WhatsApp: +49 155 60941759

TODO: The precise legal classification of the joint operation still requires external legal review. Add a data protection officer if one is appointed or legally required.

2. Technical delivery of the website

Technically required connection data is processed when the website is accessed. This may include IP address, time, requested URL, HTTP headers and browser or device information. It enables delivery, troubleshooting and protection of the website.

The repository contains a Cloudflare Worker configuration with Worker observability and also retains a ChatGPT Sites hosting artifact. The live domain and the version or provider that actually serves it cannot be established locally.

TODO: Confirm the live hosting provider, log scope, retention, region, contract and transfer mechanism. The approved version should name only the hosting route actually used.

3. Supabase

Luciago technically uses Supabase for authentication, the PostgreSQL database, Realtime features, Edge Functions and file storage. Depending on the feature, Supabase processes account and profile identifiers, content, roles, interactions, location-related data, messages, notifications and technical session data.

TODO: Add the production project region, backups, logs, authentication mail provider, processing agreement, subprocessors, retention periods and any international transfers.

4. Registration, sign-in and guest use

Regular use is intended for people aged 16 or over. A free usage agreement is formed when registration is completed and the user expressly accepts the terms; the privacy policy must be acknowledged during registration. The non-preselected acceptance control exists, but the app does not yet store a separate terms version or acceptance timestamp. The age threshold is currently confirmed only by self-declaration in this step and is not enforced server-side against a date of birth.

Registered accounts involve the processing of an Auth UUID, email address, sign-in provider, session and refresh tokens and authentication metadata. If Google sign-in is selected, data required for the OAuth flow is exchanged between Google, Supabase and Luciago.

Under the current technical design, app guests also receive an anonymous Supabase Auth session. Its Auth UUID is persistently stored in AsyncStorage. Although it does not by itself contain a real name, it allows repeat recognition and is therefore pseudonymous.

TODO — legal bases: Approve the basis for registered accounts, anonymous guest sessions, Google OAuth, security and abuse prevention separately.

5. Profiles, roles and organizer accounts

Depending on use, Luciago may process username, description, avatar, interests, date of birth, gender selection, telephone number, roles, suspension status and organizer memberships. Optional profile details are processed only when provided. Creator and admin access is limited using roles and relationships stored in Supabase.

Organizer verification may include details about the organizer, the applicant’s role, website or social profile, event location and contact method.

6. Events, organizers and published content

To create and display events, Luciago processes data including titles, descriptions, times, prices, tags, venues, addresses and coordinates, bonus information, maximum attendance, organizer relationships, event images and menu images. Organizer profiles may also contain descriptions, contact details, a website and social media addresses. Published details and media may be publicly visible.

7. Community, friends, attendance and chats

Friendships, favorites, attendance, tickets or attendance status, ratings, direct messages and event chats may involve internal user and event IDs, relationships, messages, timestamps, memberships and status information. Realtime delivers new messages and notifications to authorised accounts.

Users may voluntarily share live location in a direct chat. The user ID is used as a Presence key, and latitude, longitude and a timestamp are sent through Supabase Realtime Presence to the chat partner approximately every five seconds or after relevant movement. The audited code does not create a historical location table from this data; transmission stops when sharing is switched off or the chat is left.

8. Reports, blocking and moderation

Community safety functions may process the reporting user, reported user, organizer, event or content, reason, description, affected chat, review status, internal notes and decisions. The intended measures are content removal, warning, temporary suspension and permanent suspension; Luciago may skip stages depending on severity. A review may be requested at support@luciago.com. A technical appeal case linking the user to a specific moderation decision is not currently implemented. Certain chat and moderation records may remain without a direct profile link after account deletion.

TODO: Approve legal bases, access rights, procedural time limits, any legally required statements of reasons and specific retention periods.

9. Location, maps and matching

• The current location may be shown locally on the map after operating-system permission.
• Nearby search sends current coordinates and a radius to Supabase; no permanent location history was found in the audited function path.
• Matching stores user ID, search coordinates, tags, an optional message, group size, sharing preference and expiry as an intent in Supabase.
• Creating an event venue geocodes the entered address and stores the resulting location and coordinates.
• Opening external directions passes an event-derived address or search query to the selected map app or provider.

Non-location features and manual city selection remain available without location permission.

TODO: Confirm the actual map providers for iOS and Android, their data flows, key configuration and legal bases using the production builds.

10. Event analytics and audience statistics

Luciago intends to use event analytics for all users as a product setting. The app records event impressions, detail views, shares, favorites and attendance together with event ID, source and time. The active backend call uses the Supabase Auth UUID as a persistent visitor_id. Registered users are additionally linked through an internal user_id.

This processing is not fully anonymous. Guests can be recognised through the persistent anonymous Auth UUID; registered users are linked to an account in the backend. Creators receive aggregate reach, source, funnel and returning-visitor metrics. Age, gender and interest statistics are calculated from participant profiles and are shown only as aggregates once at least five distinct participants are present.

The current code contains no consent flag or opt-out check before event tracking. No retention period or automated deletion routine was found for individual analytics events. Account deletion removes analytics events whose visitor_id or user_id matches the deleted account’s Auth UUID, so the persistent visitor identifier does not remain linked to the former account. This product decision does not resolve the open legal assessment of the applicable legal basis or consent requirement.

TODO: Approve the legal basis, applicable GDPR and German TDDDG requirements and, where required, a consent design, and define general retention.

11. Notifications and push

In-app notifications involve recipient ID, message, event or source reference, read status and preferences in Supabase. Once operating-system push is voluntarily enabled, Luciago stores the Expo push token, user ID, platform, activation state, last contact and delivery/request information. Push content is sent to the Expo Push Service.

Push can be disabled in app settings, which removes the stored token. Whether the full delivery path is operating in production and which Expo retention periods apply cannot be verified locally.

12. Device permissions and local features

Location, camera, photo library, calendar and notification permissions are requested only for the relevant feature. No camera image upload was found in the QR scanner path. When adding an event to a calendar, the app writes event title, time, location and description to a calendar selected on the device. Further synchronisation depends on the user’s device account.

13. Images and Supabase Storage

Selected avatar, event, menu and organizer images are checked for file type and size and uploaded to the Supabase Storage buckets avatars, event-images or organizer-images. Public content images may be available through public URLs.

Uploaded images may also be processed or edited with AI to create improved or adapted Luciago and event images. This does not include training Luciago’s own AI models with user images, selling the images or using them arbitrarily for unrelated purposes. No external AI provider has yet been selected; its actual data flows and privacy terms must be added before production use.

The account deletion flow queues avatar deletion privately if immediate storage deletion fails. Event images use a separate deletion-request path. Complete backup/cache lifecycles and a final organizer-image deletion process require confirmation.

14. Password reset and account deletion

Password reset uses Supabase Auth and processes the email address, recovery link or code, a temporary recovery session and the new password. The website and app use their designated redirect and deep-link flows.

Regular users may delete their account at any time without a notice period. Account deletion processes the current Auth session, reauthentication, a confirmation phrase, account ID and, where applicable, the avatar path. The server checks that the session is no more than ten minutes old and then deletes the Auth user, cascading personal records and analytics events linked to the account through visitor_id or user_id. The former user no longer appears publicly under their previous profile; retained content displays “Deleted User” instead of the username and profile image. Certain chat and moderation records may remain without a direct profile link. Sole organizer owners must transfer ownership first.

Future events created personally by the user should also be deleted with the account. This is not yet implemented. Events belonging to an organizer profile with several members or owners must not be deleted solely because one member deletes their personal account.

15. Cookies, browser and app storage

The website uses Supabase browser storage for persistent Auth sessions and short-lived sessionStorage markers for password recovery, deletion reauthentication and deliberate Cal.com activation. The app stores the session, language, selected city and optionally the Expo push token in AsyncStorage.

A complete list, purposes and durations is available in the cookie and storage policy. No Luciago marketing cookies or Cloudflare Web Analytics beacon were found in the audited website code.

16. Cal.com and organizer verification

Cal.com is actively used for appointment booking in the organizer and verification process. The booking interface loads only after a visitor selects “Enable Cal.com & load booking” on the verification page. Technical connection data and appointment/contact details entered in the booking interface may then be transferred to Cal.com.

TODO: Confirm the Cal.com contract or data processing agreement, region, subprocessors, international transfer mechanism, cookies/storage and retention.

17. Contact, social media and external links

The contact page contains no form. Contact is available through support@luciago.com and by phone or WhatsApp at +49 155 60941759. Email and WhatsApp links open the selected external service; the website stores no form entries. Instagram, TikTok, WhatsApp and map links transfer data to the target provider only after a click. No social SDK, embedded feed or pixel is included.

The former contact form is no longer used. A new database migration removes the Supabase RPCs and contact_request table used exclusively for that form. Confirmed project information states that there are no historic contact requests that need to be retained.

18. Recipients and possible international transfers

Depending on the feature and actual production configuration, technical recipients may include Supabase, the confirmed hosting provider, the Expo Push Service, map and OAuth providers, Cal.com, and social, messaging, map and email services deliberately opened by the user.

TODO: Verify the full recipient list, controller/processor roles, locations, processing regions, agreements, subprocessors and transfer mechanisms. This draft neither generally asserts nor rules out international transfers.

19. Retention

The code contains specific deletion rules only for selected data, such as account records, push tokens, avatars and event images. No reliable complete periods were found for individual analytics events, moderation data, read notifications, expired matching intents, hosting logs, backups or provider logs.

TODO: Approve a concrete period or transparent criteria for every data category and add them here. No retention period should be inferred solely from this draft.

20. Legal bases

TODO before publication: Document the legal basis actually selected under the GDPR for each processing operation. Account services, anonymous guest sessions, community features, safety/moderation, pseudonymous event tracking, demographic analytics, location, push, Cal.com and provider transfers each require separate assessment. This technical draft does not select a legal basis.

21. Data subject rights

Subject to applicable law, individuals may request access, rectification, erasure, restriction and portability of their personal data and may object to processing. Consent may be withdrawn for the future. Individuals also have the right to lodge a complaint with a competent data protection supervisory authority.

Requests may be sent to support@luciago.com. TODO: Add the competent supervisory authority and the internal process for access, export, rectification, objection and deletion confirmation.

22. Required information and automated decisions

Required fields are needed for the feature requested; optional profile details remain voluntary. The system sorts and aggregates event and usage data, but no legally significant decision based solely on automated processing was found in the audited code.

TODO: Confirm before publication whether profiling or legally significant automated decision-making occurs in the production configuration.

23. Changes

This policy must be updated when features, providers, data flows, legal bases or retention periods change. The published version is authoritative.