Privacy

CurtainChatter helps you find what is on stage tonight across Germany, Austria, and Switzerland. Running that with personal accounts means processing some personal data. This page explains what we process, why, and the rights you have. The short version: no advertising trackers, no third-party analytics, no selling of data.

Who is responsible

The controller for curtainchatter.com under the GDPR is:

Questions about this policy or about your data are welcome at the email address above.

What we process

Account data. When you create an account we store your email address, your name, and your sign-in credentials: a hashed password, a passkey (WebAuthn credential), or the identifier from your Google account if you choose to sign in with Google. Signup is currently invite-only, so we also record the invite code your account was created with.

What you do in the product. Events you save, productions you watch, reviews you write, and preferences you set. This data exists so your account is useful to you, and for no other purpose.

Technical data. Our servers write standard request logs (IP address, requested page, time, browser signature) and set a session cookie so you stay signed in.

Why we process it, and on what legal basis

• Providing your account and its features, including saved events, watched productions, reviews, preferences, and transactional email such as verification codes and password resets: performance of a contract, Art. 6(1)(b) GDPR.
• Keeping the service secure and reliable, including server logs, session handling, and abuse prevention: legitimate interest, Art. 6(1)(f) GDPR.
• Sign-in with Google: only if you choose it. The processing needed to complete that sign-in is based on Art. 6(1)(b) GDPR.
• Anything beyond the purposes above would only ever happen with your consent, Art. 6(1)(a) GDPR, which you could withdraw at any time.

Cookies

We use essential cookies only: a session cookie that keeps you signed in, and short-lived cookies needed for secure sign-in flows. There are no advertising cookies, no third-party analytics, and no cross-site tracking.

Who helps us run the service

A small set of infrastructure providers process data on our behalf, bound by data processing agreements:

• Hetzner Online GmbH, Gunzenhausen, Germany: hosting. Our servers and database are located in Germany.
• Cloudflare, Inc., USA: content delivery, network security, and delivery of media assets (Cloudflare R2).
• Resend (Plus Five Five, Inc.), USA: transactional email such as verification codes and password resets.
• Google (Google Ireland Limited / Google LLC): only if you sign in with Google. Google processes that sign-in under its own privacy policy.
• Sentry (Functional Software, Inc.), EU region: error monitoring, so we notice when something breaks. Reports are stored on European servers. We switch off personal data collection: no request bodies, no cookies, no credential headers, and no account identifiers are sent.

International transfers

Hosting and the database stay in Germany. Cloudflare, Resend, and Google are US companies, so some data can be transferred to the United States: for example network traffic passing through the CDN, or the email address a verification code is sent to. These transfers rely on the EU standard contractual clauses and, where the provider is certified, the EU-US Data Privacy Framework.

How long we keep data

Your account data and everything attached to it is kept for as long as your account exists. If you delete your account, or ask us to, we delete the personal data associated with it without undue delay, unless a legal obligation requires keeping something longer. Server logs are kept only briefly for security and troubleshooting, then deleted automatically.

Your rights

Under the GDPR you can ask us at any time for:

• access to the personal data we hold about you (Art. 15),
• rectification of inaccurate data (Art. 16),
• erasure (Art. 17),
• restriction of processing (Art. 18),
• a portable copy of the data you provided (Art. 20),
• and you can object to processing based on legitimate interest (Art. 21).

Where processing is based on consent, you can withdraw it at any time with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority, for example the authority responsible for your place of residence.

Contact and changes

To exercise any of these rights, or for any privacy question, write to [email protected]. We will update this page when our data practices change, and note the date here.

Last updated: 2 August 2026