Privacy Policy

Last Updated

October 27, 2026 — public alpha

Controller / Responsible Party

Andrzej Mikulicz, Boizenburger Str. 5, 12619 Berlin, Deutschland. Privacy contact: privacy@ravemeapp.com.

Public alpha and optional sign-in

You can browse the public map without signing in. An account is needed for personal and restricted features. The alpha is free: no advertisements, paid accounts or commissions. Any future commercial features will require updated information before activation.

New accounts are limited to people aged 16 or older. At signup, including when a social sign-in would create an account, we ask for a confirmation. The current check is a self-declaration; we do not request or store a date of birth for it.

Profile visibility in search engines

During signup, you can choose whether search engines may show your public account profile. You can change this choice in Settings. Accounts created before this choice was introduced are not submitted to our search-engine sitemap until their owner selects visibility. This setting does not make private messages, restricted events, email addresses or precise locations public.

If you turn visibility off, we remove your profile from our sitemap and mark its page not to be indexed. Search engines may need time to update or remove an existing result. Public event, venue, artist-directory and imported organizer pages follow separate publication rules.

Sign-in, infrastructure and external sources

Hosting is provided through OVHcloud. Cloudflare provides domain services and may be used for restricted backups through R2. Transactional and support email uses Zoho. Optional Google sign-in provides an account identifier, email, display name and profile image; we do not request access to your Gmail messages. Optional SoundCloud connection uses OAuth to identify and link the SoundCloud account. We receive profile details such as the SoundCloud ID, display name, profile URL and avatar; the current integration also retains the provider's profile response, which may include additional profile details and activity counts. Map tiles are supplied by CARTO using OpenStreetMap data. Requests to these services can disclose connection information, such as an IP address, to the service concerned.

Event and professional artist information may come from public Resident Advisor listings and SoundCloud profiles, including stage names, public profile links and available profile images. Automatically created artist profiles are unclaimed directory entries, not registrations by the artist and not endorsements. To request correction, removal or object to an association, contact privacy@ravemeapp.com and include the profile URL. Matching is automated and can be wrong; identity claims require review.

Purposes and legal bases

We process information needed to provide requested account features under Article 6(1)(b) GDPR. Security, abuse prevention and maintaining a relevant public event and professional artist directory rely on legitimate interests under Article 6(1)(f), subject to the rights and interests of affected people. Where a feature relies on consent, it is optional and consent can be withdrawn; legal obligations are handled under Article 6(1)(c).

Browser storage is used for sessions and requested features. Precise device location is requested through your browser permission; it is not required to browse the public map. A bug report or feedback submission contains your description, optional reply email and screenshot you choose, plus app version and browser information. We do not automatically capture your screen. Submissions are stored in our database. When email notifications are enabled, a copy including any screenshot is forwarded to our support mailbox; email delivery can fail, so the stored submission remains the primary record until delivery. Feedback is not displayed in the app's bug-report queue. Access to stored submissions and the mailbox is restricted to authorized operators.

If device location is unavailable, the web app currently tries approximate city lookup through ipapi.co or GeoJS using your public IP address. This does not send your device coordinates or account details to those services. A successful city result may be cached in browser session storage for 15 minutes. The map remains usable if the lookup fails.

Browser storage and product analytics

Basic Web and mobile activity counters record only the type of action and platform, grouped by server hour. They do not store account, device, session or entity identifiers, search text, referring pages, IP addresses or location in the analytics records. These counters run independently of optional analytics choices. They measure opening and action totals, not unique people. Transport and security logs are separate from these counters. Registered account totals come from the account database rather than analytics consent.

For signed-in web users, the app stores an authentication token and account information in browser local storage. The web app also stores your privacy choice and, when you use the relevant features, settings, language, drafts, search or interface preferences. Session storage can hold temporary map-location results and other session state. Signing out removes the stored web authentication session on that device, but does not necessarily remove drafts or preferences.

If you allow optional web product analytics, the app stores a pseudonymous analytics session identifier in session storage and sends usage events to our API. Depending on the action, those records can include the action and time, an event or venue identifier, a search term, platform, referring page and approximate country or city derived from request headers. When a request carries a valid signed-in session, the event can also be associated with the account. Pseudonymous does not mean anonymous.

Optional web product analytics is off until you allow it. You can change or withdraw this choice in the app's privacy choices. Allowing it creates a random consent receipt stored on your device; our API stores its hash, the notice version, platform, optional account ID and server times of grant or withdrawal. New analytics records reference that receipt. The receipt is checked before accepting analytics events. On a successful server-side withdrawal, the API revokes the receipt and deletes raw product and venue analytics records linked to it from the live database. If your device is offline, it retries revocation when the app next loads; deletion cannot be confirmed until the server responds. Earlier records without a receipt link, backups and other personal data are not covered by this automatic action. Contact privacy@ravemeapp.com to request review or deletion of those records.

Venue usage statistics are a separate stream. If you allow them, opening a venue profile or using its route, website, social links or save action may send the venue identifier, action, source where available, time and signed-in account ID to our API. Reading a venue profile or saving it does not create a venue analytics record without an active opt-in. On the web, the optional web analytics choice also controls this venue stream; in the native mobile app, signed-in users can enable or disable venue usage analytics in Settings. The native choice and receipt are stored on the device for that account. Both default to off; an earlier device-only choice must be confirmed again before tracking resumes.

In the native mobile app, signed-in users can separately allow optional app usage analytics in Settings. When allowed, opening or returning to the app sends an app-open event, time, app version, platform and account association to our API for aggregated Pulse statistics. This choice defaults to off and uses an account-bound consent receipt stored on the device. It is independent of venue usage analytics and can be withdrawn in Settings; successful withdrawal deletes raw records linked to that receipt from the live database as described above.

External media and links

Event stories can contain embedded players from SoundCloud, Spotify, YouTube or Vimeo. These players are not loaded until you allow external media; your browser then connects directly to the provider and may use its storage technologies. You can withdraw this choice in privacy choices. Following an external event, ticket, artist or social link takes you to that third party.

Some event, venue and artist images may be served directly from their source host. Loading them can disclose technical connection data independently of the external-player choice. Rejecting the optional choices also does not stop map-tile requests or, when device location is unavailable, the approximate IP-based city lookup described above. Those connections are part of the current map flow.

Data We May Collect

• Account data, such as email, login identifiers, authentication status and account settings.
• Profile data, such as display name, avatar, bio, preferences and public profile activity.
• Event activity, including event creation, edits, saves, views, attendance signals and reports.
• Venue interactions, including views, saves, claim requests, corrections and source-link activity.
• Location data used for map discovery, nearby context, unlock logic and safety controls.
• Private rave and access data, including request status, approximate reveal and exact reveal state.
• Claim verification data for venue, organizer or event ownership checks.
• Messages, system notices, moderation messages and support communications.
• Media submitted by users, including images or other content attached to profiles or events.
• Device, log, diagnostics and analytics data used to secure and improve the product.
• Push notification tokens and delivery state when notifications are enabled.
• Support, report and safety data submitted through contact or reporting flows.

How We Use Data

• Operate accounts, authentication, profiles and product settings.
• Provide map-first event, venue and scene discovery.
• Show nearby context and support location-based discovery features.
• Process private rave access, approximate reveal and exact reveal behavior.
• Review venue, organizer and event claims.
• Deliver messages, system notices, push notifications and support replies.
• Detect abuse, review reports, enforce rules and protect users.
• Improve reliability, performance, security and product quality.
• Meet legal, regulatory, security and rights-protection obligations.

Location Data

RaveMeApp is built around map discovery. Location data may be used to show nearby events and venues, provide distance and area context, support unlock or reveal features and help with safety or anti-abuse checks.

For private or limited-access listings, RaveMeApp may show approximate location before access is approved and exact location only when the product logic allows it.

Smingol and OpenAI

Smingol is an optional AI assistant inside RaveMeApp. When you use Smingol, we send your chat messages, recent conversation context needed for the reply, locale/timezone and related planning or support context to OpenAI so that a response can be generated. Smingol messages are not end-to-end encrypted. Do not enter passwords, one-time codes or other sensitive secrets in Smingol.

OpenAI processes this content as our processor under our agreement with them. Where available we configure requests not to store Responses API objects for later retrieval (store=false); that setting is not a guarantee of zero retention by OpenAI. Provider terms, destination and transfer safeguards for OpenAI are part of our processing inventory; contact privacy@ravemeapp.com for details about this integration.

Sharing

• Service providers that help operate, host, secure, measure or support the product.
• OpenAI, when you use Smingol, for generating assistant replies from the messages and context described above.
• Legal, safety or rights-related recipients where required or reasonably necessary.
• Venue, organizer or event claim reviewers when needed to verify a claim.

RaveMeApp does not sell personal data.

Retention and Deletion

Account and profile information is needed while the account is active. Published event, venue and unclaimed artist entries may remain public while relevant; source accuracy and correction or objection requests are reasons to review them. Support and safety records are needed while handling the request, abuse or a dispute. Technical and analytics records are used for security and product-quality analysis. The automatic age-based cleanup of raw product and venue analytics is not active: the two streams need separate retention decisions that preserve necessary historical reporting. Withdrawal of optional analytics consent removes raw records linked to that receipt from the live database, as described above. Periods or objective retention criteria for other categories remain under review; we do not claim a fixed period that has not been implemented.

Signed-in users can start account deletion in Settings. The in-app action records a deletion request, ends your sessions and blocks further sign-in while the request is pending. Details and the path for people who cannot sign in are on the Account Deletion page. A request is reviewed against any applicable legal obligation or overriding need to retain a specific record; deletion of the account does not automatically erase another person's messages or a separately maintained public event record. We explain any relevant exception in our reply.

GDPR Rights

Where GDPR applies, you may have rights to access, correction, deletion, restriction, portability, objection and complaint to a supervisory authority. Contact privacy@ravemeapp.com.

Your choices and complaints

Contact privacy@ravemeapp.com for access, correction, erasure, restriction, portability or objections, including requests about unclaimed profiles. You may complain to a data protection supervisory authority, including the Berlin Commissioner for Data Protection and Freedom of Information. Providing account information is necessary for account features but not for public browsing. We do not use solely automated decisions with legal or similarly significant effects.

Some providers may process data outside the EEA. The provider, destination and applicable transfer mechanism for each integration require confirmation in our processing inventory; contact us for details about a specific service. Deletion from live systems does not immediately remove an item from existing restricted backups; restored data remains subject to deletion requests.