Privacy

CurtainChatter shows what is on stage across Evrópa. This page explains what we do with data about you, and what you can ask of us.

Who is responsible

Birk Skyum, Sallenbachstrasse 11, 8055 Zurich, Sviss. For anything about your data, write to [email protected].

Reading without an account

You can read the calendar, performances, productions and venues without an account. We use no advertising trackers. When you load a page, your IP address and browser details reach our servers and our network provider, because that is how a page gets to you; we use them to deliver the site and keep it secure.

When you choose a language or dismiss the language offer, we remember that choice in a first-party cookie for one year. For guests, programme choices, answers to the first-visit questions and whether the comedy-theatre offer has been shown are kept in this browser’s local storage. You can remove these choices by clearing this site’s browser data.

The map in What’s on loads its background map from OpenFreeMap (openfreemap.org), which therefore receives your IP address when you open it. If you use Near me, your position stays in memory and local storage in this browser and is never sent to our servers or analytics: to list what is on near you, the browser asks only for the dates of the houses it picked. Clear location removes it. A city you choose is part of the page address, like a search.

Counting visits

We count visits and actions such as searches, saves and clicks on ticket links with Umami Cloud, run for us by Umami Software, Inc. in the United States under a data processing agreement with the EU standard contractual clauses. It sets no cookies. Your browser only talks to our site: we pass the counts on and shorten your IP address before they leave our server, so Umami never sees it in full. Umami records the page, where you came from, your browser, device type and rough location, and tells visits apart with a code that changes every day. If your browser sends Do Not Track, we do not count you at all.

Server error reports

We use Sentry, operated by Functional Software, Inc., as a processor for server error reports in its EU data region. Reports help us find and fix failures in the website and catalogue API. Before sending a report, we remove request bodies, cookies, headers, URLs and query strings, user identity, breadcrumbs and error messages that could contain your input. We retain technical stack locations and service labels. Error reporting runs on our servers; your browser does not connect to Sentry.

If you have an account

We store your email address and name, your password in hashed form or your passkeys, and your sign-in sessions with the IP address and device they came from, so you can review and end them on your account page. We store which version of the Terms you agreed to when you signed up, and when. We store the dates you save, what you follow and the reviews you write. Your saved dates and follows are private. Reviews you publish can be read by other members.

Sign-in and verification codes are sent by email through Resend. If you sign in with Google, Google tells us your name and email address.

To keep bots out of sign-up, password resets and email changes, we use Cloudflare Turnstile. It looks at your IP address, your browser and the page you are on, only to tell people from bots; Cloudflare does this on our behalf.

The mobile app uses your approximate location only if you allow it, to find what is on nearby. We do not store it with your account.

People in the catalog

We publish the names and roles of artists and creative teams as the venues announce them. If you are listed and want something corrected or removed, write to us.

Where your data is kept

On servers in Germany run by Hetzner, except the visit counts, which Umami keeps. Cloudflare carries the traffic between you and those servers, and keeps our backup copies in its data centres in Europe. We keep account data until you delete your account, which you can do at any time on your account page. A deleted account stays in the backup copies for about a month more, until newer ones have replaced them. Accounts whose email address was never confirmed are deleted after 30 days, and sign-in sessions a week after they expire.

Your rights

You can ask what we hold about you, have it corrected or deleted, and object to how we use it. You can also complain to a data protection authority: in Switzerland the Federal Data Protection and Information Commissioner, in the EU the authority where you live.