Privacy Policy

Last updated: October 2026

1. Who is responsible

This site is run by the Freestyle Players Association (FPA), a nonprofit based in the United States. The FPA is the controller for the personal data processed here under the General Data Protection Regulation (GDPR):

Freestyle Players Association
Email: events@freestyledisc.org

2. What we collect and why

Your account

When you sign up we store your name, your email address and your password. The password is only stored as a one-way hash; nobody can read it. We use your email address to verify your account, to let you reset your password, and to sign you in. Accounts moved over from the previous events site keep the name, email address and password hash they had there. Legal basis: providing the service you signed up for (GDPR Art. 6(1)(b)).

Events you create

Everything you enter for an event — its name, dates, location, description, schedule, venues and the event picture you upload — is published on the event page and visible to everyone. Event pictures are stored with Cloudflare R2. Legal basis: Art. 6(1)(b).

RSVPs and attendee lists

When you RSVP to an event we store your status. If you are attending, your name appears on the event page, which anyone can see, including visitors who are not signed in. You can turn this off under Settings → Privacy: you are then still counted, but not named. The event's organizers always see your name. Only the event owner and site admins can see your email address in the manage area; co-organizers see names only. Legal basis: Art. 6(1)(b).

Calendar feed

Your Dashboard and Attending pages offer a personal calendar link listing the events you are attending. The link contains a secret code, and anyone who has it can read the feed without signing in, so keep it to yourself. Generating a new link makes the old one stop working. Legal basis: Art. 6(1)(b).

Sign-in and security

When you sign in we store a session with your IP address and browser type, to keep you signed in and to spot misuse of your account. Legal basis: our legitimate interest in a secure service (Art. 6(1)(f)).

Server logs

When something goes wrong, our server logs the page, the time and your user ID so we can find and fix the error. When the site sends you an email, the log records the address it went to. Legal basis: our legitimate interest in running the service reliably (Art. 6(1)(f)).

Error reports

When something unexpected breaks, in the server or in your browser, the site sends an error report to an error tracker (GlitchTip) that we run ourselves on our own server at Hetzner. It is not a third-party service. A report contains the error message and the technical trace of where it happened, a short reference code, the page's route pattern (for example /invite/[token], never the actual address), your user ID if you are signed in, and basic browser and system details. It contains no page address, no cookies, no email address and no name. Reports are deleted after 90 days. Legal basis: our legitimate interest in running the service reliably (Art. 6(1)(f)).

3. Cookies and local storage

We set one cookie, which keeps you signed in, and your browser remembers whether you collapsed the sidebar (local storage, sidebar:state). Both are needed for the features you use, so they need no consent. We use no analytics, tracking or advertising.

4. Services we use

Hetzner (hosting)

The site and its database run on servers of Hetzner Online GmbH in Germany, which processes the data on our behalf. See Hetzner's privacy policy.

Mailgun (email)

Account emails (verification and password reset) are sent through Mailgun Technologies, Inc., from its EU region. Mailgun receives your email address and the message. See Mailgun's privacy policy.

Cloudflare (image storage and spam protection)

Event pictures are stored with Cloudflare R2. The sign-up, sign-in, password reset and event forms use Cloudflare Turnstile to tell people from bots: your browser loads it from Cloudflare, which receives your IP address and technical details about your browser. It sets no tracking cookies. Cloudflare, Inc. is based in the United States. See Cloudflare's privacy policy.

OpenStreetMap (maps)

Maps are drawn from tiles your browser loads directly from the OpenStreetMap Foundation's servers, which receive your IP address. See the OpenStreetMap privacy policy.

Komoot Photon (place search)

When you search for a city or venue, your browser sends the search text to Komoot's Photon service (photon.komoot.io), which also receives your IP address. See Komoot's privacy policy.

Where data reaches a provider in the United States, the transfer relies on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

5. How long we keep it

Your account data stays for as long as your account exists. Sessions end when you sign out or after a week without use. Verification and password-reset links expire after a short time. Server logs are deleted, at the latest, when the site is next updated. You can delete your account at any time under Settings → Account; this removes your account, your sessions, your RSVPs and the events you created.

6. Your rights

Under the GDPR you have the right to:

see the data we hold about you (Art. 15)
have wrong data corrected (Art. 16)
have your data deleted (Art. 17) — you can delete your account yourself
restrict or object to processing (Art. 18, 21)
get your data in a portable format (Art. 20)

To use any of these rights, email us at events@freestyledisc.org.

7. Complaints

You can complain to a data protection supervisory authority, in particular the one in the EU country where you live.