What stays on your device
Two things live only on your device (localStorage): your light or dark mode choice and the last country you picked. Neither reaches us. The list of events you saved with the heart stays in the browser too while you are signed out; once you sign in, we keep it on your account so it works on your other devices as well, and signing out clears the browser's copy.
The only cookie we set is kk-session — and only when you sign in. It is a signed sign-in token (account id and e-mail), httpOnly, so the page's scripts cannot read it, and it is valid for 30 days — sign out and it stops working. Alongside it we set one more, kk-in=1: only a sign that someone is signed in, with no id or e-mail, which the page can read so it does not ask the server for a guest's saved events; it lasts as long and goes when you sign out. When you open the sign-in link from the letter we briefly set one more, kk-login: the link waits in it until you press “Sign in”, then we delete it (an hour at most). There are no cookies for analytics or advertising, so no cookie banner is needed.
Location
The “Closer to you” section asks the browser for your location so that events can be sorted by distance. The coordinates are used on your device only and are never sent to any server.
Account
You sign in with your e-mail — we send a link to sign in with; there is no password. On your first sign-in we create an organiser account. We store: your e-mail address; the domain and language you joined on (e.g. wherewhat.eu · English — so letters go out in the right language); and a profile — a name (a generic “Organiser” at first, changeable on /mans) and, if you have entries and choose to, a public address and a website. If you pick your city on /mans, we keep that too — it decides which nearby events we show you.
While you are signed in, the events you save with the heart are kept on your account (only the event's id and when you saved it), so you see them on your other devices and on /mans. Take the heart off and the record is gone.
We send the sign-in link ourselves, through our own mailbox; the e-mail address is stored in our database on our own server. When you sign in, entries you submitted earlier with the same address and that still have no owner become yours. Letters (sign-in links, the welcome letter, claim decisions) go through our own mailboxes and stay there.
If you claim somebody else's entry (“This is my event”), we keep the claim text and the evidence you type in, plus the e-mail the decision is sent to. A person reviews the claim.
Statistics (without cookies)
When you open an event card or press “Route”, “Tickets”, “Source”, “Share” or “Calendar”, or tap the heart (save), we record one anonymous event (what, when, and whether on the map or on the event page). We record one anonymous event in the same way when you press a filter button (“Tonight”, “Today”, “This week”, “All”, a country) or a category tile on the front page — only which button and when, nothing more. No cookies and no profile: a “visitor” is a daily hash of the IP address and the browser — we store neither the IP address nor the browser name, and the next day it is a different number. These figures help us understand what people are interested in, and they are all we will ever show organisers (“X people looked at your event”).
We count page views with a self-hosted Umami (stats.kurkad.lv) on our own server: no cookies, no IP storage, no third-party scripts. It shows how many people open which page, not who they are.
Map data
The map background comes through our own server, not straight from a third party — your browser never talks to the map provider. Most of it is our own Baltic map file on the same server; when it is unreachable the fallback is OpenFreeMap. The map is based on OpenStreetMap data (© OpenStreetMap contributors).
Server logs
The site runs on our own server in the European Union (Contabo) — the database lives there too. For technical reasons the providers may keep access logs (IP address, requested file) for a short time. We neither collect nor analyse this data.
What you send us
If you submit an entry of your own (“Add your own”), we keep what you type into the form: the name, the time, the address and the point on the map, the description, the link, the price and the photo — all of it becomes public once the entry appears on the map. Your e-mail, if you give one, stays with us alone — it is never shown anywhere; with it we can reach you and you can later take the entry over in your account. Address suggestions come from OpenStreetMap data (Photon, Komoot) through our own server — your browser never talks to the geocoder directly.
Who is responsible and how long we keep it
The data controller is the operator of this site — reachable at the contact address below (each language has its own). Data processors: Contabo (server and database, EU) and our e-mail provider (the mailboxes every letter goes through, and encrypted backup copies of the database). Supabase, where the database lived until 7 October 2026, keeps an untouched copy of it until 6 November 2026; then we delete it.
Retention: the sign-in cookie — 30 days; the account, submitted entries and claims — until you ask us to delete them; e-mail correspondence — the same. The anonymous event counters cannot be tied to a person, so there is nothing to find or delete as “yours”.
Your rights
You can ask at any time what data we hold about you, ask for it to be deleted or ask for a copy — write to the contact address below. Today this is a manual process: a person does it, not a button. When an account is deleted, the organiser profile and the sign-in address go with it; already published entries stay on the map unless you ask for those to be removed too. You also have the right to complain to the data protection authority (in Latvia, Datu valsts inspekcija).
Contact
Questions about privacy, a request to delete or export your data, mistakes on the map, or a request to take something down: info@wherewhat.eu.