Privacy

Locol Privacy Policy

Last updated: 2026-10-11

This policy explains how Locol handles information in the Locol iOS app, the Locol website at locolapp.xyz, the waitlist, and support.

Who is responsible

Locol is operated by Wesley Koot, a natural person and sole owner.

What Locol does

Locol helps people browse public event information, save events privately, and make personal plans. You can browse as a guest. Signed-in features use an account. Optional features include Google Calendar availability, timing and directions, and sharing a private plan with invited people.

Information we receive

We collect information from you, your device, integrations you choose, and public or technical sources:

• Account and rights requests: account email, profile or account identifier, sign-in provider information, and the details needed to answer an access, export, correction, objection, or deletion request. If you sign in with Google, this includes your Google account email, name and profile picture; this Sign-In grant is separate from Google Calendar access, which is asked for only when you later choose to connect Calendar.
• Discovery and location: chosen or current latitude and longitude when you use location-based discovery, search radius, market or city, timezone, and search, event, or place identifiers and display data. Location access is optional; you can browse without granting location access.
• Weather: weather forecasts shown with an event come from Apple Weather (WeatherKit). To get a forecast, the app sends Apple the location of that event. Weather data by Apple Weather.
• Event images: event images are loaded directly from the original publishers' own websites. When an image loads, the publisher's server receives your IP address and the usual technical request data, under that publisher's own privacy policy.
• Saved content: saved event identifiers and the event display data needed to show your saved items.
• Plans and invitations: plan title, notes, event and place snapshots, place and time information, invitation-response identifiers, the display name you enter when you answer an invite on the web, answers, attendance and reactions, and shared invite event details. Plans and intents are private to the people the plan owner invites. Your first name is shown to the organiser and to the other people invited to the same plan.
• Google Calendar: if you connect Google Calendar in Account, Locol receives a Google authorization code during connection, encrypted OAuth tokens, and the names and IDs of your Google calendars. For events in the calendars you switch on, Locol reads the title, start and end time, status, location, and the event link — never attendees, descriptions, or events from calendars you did not select. Reads happen only when you use the app, never in the background, and look at most 90 days ahead. When you choose a calendar under "Plans go to" and add a plan, Locol writes only that one plan (title, description, location, start, and end time) to the calendar you picked, updates it if the plan changes, and never deletes your events; Locol stores only the link between the plan and the Google event ID, not your calendar contents. Tokens are encrypted at rest (AES-256-GCM) with the encryption key held outside the database. Google user data from Calendar is not shared with or sold to third parties, not used for advertising or analytics, and not used to train AI models; no one at Locol reads it except to provide support you request or to investigate a security or legal issue.
• Invite page cookies: the web page that opens from a plan invite link sets two strictly necessary security cookies in your browser: one that ties your answer to that plan and one that protects the response form against cross-site request forgery. They are HttpOnly, last up to 90 days, are used for nothing else, and are not advertising or analytics cookies.
• Live Activities and notifications: Live Activity identifiers, push token, route coordinates, travel mode, and timing when you request a relevant timing or Live Activity feature.
• Optional product analytics: when you give the required consent, product interaction records can include an event, timestamp, idempotency key, market, surface, app version, a signed-in account identifier or a random guest installation identifier and hash, and relevant invite or plan identifiers. Locol has no advertising SDK, ATT-based advertising tracking, crash reporter, or resale of personal data.
• Waitlist: the email address, city, audience flag (person or organizer) and referral information you submit on the website. A historical organizer waitlist signup additionally stores the organizer or venue name you enter and, if you choose to give one, a website or calendar address; we keep that historical waitlist address as a contact detail and do not fetch it. A new organizer submission is a separate flow described below. Each new signup also stores one coarse entry label from a fixed short list (for example “direct”, “search”, “social” or “referral-link”) so we can see roughly where signups come from. For a visit that arrives from one of our paid ads the label also carries the ad’s own tag from the link (for example “meta:a”), so we can compare ads; it says nothing about you. We do not store the referring URL, the rest of the query string, an IP address or any browser fingerprint for this. If you join the person waitlist, we send you one email, on the day Locol opens in your town, and no others. It is not a newsletter. On the home page the town is the one you type into the form. On our ad landing page, which asks for an email address only, we take the town from the approximate location of your visit: Cloudflare derives a city name from your connection, and we store only that city name, to tell you when your town opens. We retain waitlist records for 12 months after the last contact, or until the account is created.
• Page views: we count page views on our own server: per page, per day, with the same coarse entry label used for the waitlist above (including the ad tag for a visit from one of our paid ads) and a two-letter country code. No cookies, no identifiers, no IP address, no referring URL and no browser fingerprint are stored, and there is still no advertising tag on the website. We keep this aggregate count indefinitely; it contains no personal data.
• Website analytics: the website loads Cloudflare Web Analytics, a small script from Cloudflare, which already hosts and delivers this site. When a page loads, it sends Cloudflare the page address, the referring site and page-load timings; Cloudflare also sees the standard request data every website receives, such as your browser type and approximate country. It sets no cookies, uses no browser storage, assigns no identifier to you or your device, and does not track you across other websites. Cloudflare aggregates the measurements and shows us only totals, such as visits and page views by page, country, referring site, browser and device type.
• Functional storage in your browser: after you join the waitlist, the website stores three things in your browser's local storage: a referral code, the city you chose (if you gave one) and a random status string. When you return, the page uses them to recognise that you have already signed up, and sends the status string to our servers to check the status of your signup. The status string is held in hashed form on our side, is never placed in a URL, and is issued only when a signup is first created. A record saved in the same way by an earlier version of this page may also be read. None of this is an advertising or analytics identifier, none of it is shared with anyone, and clearing your browser data removes it — your waitlist signup itself is unaffected.
• Website and security data: Cloudflare may process standard technical request data and bot-protection data when you use the website or its Turnstile protection.

Locol does not use product analytics to collect calendar contents, contacts, precise location, messages, or plan links. The optional product analytics described above is first-party and consent-gated.

Why we use information and our legal bases

If a signed-in feature requires account data, we explain that requirement at the point of use. Withdrawing optional analytics or waitlist consent does not affect unrelated features. Withdrawal does not make earlier lawful processing unlawful. You can object to processing based on legitimate interests; we will stop unless we have a compelling lawful reason or need the information for legal claims.

Recipients, processors, and third-party services

Depending on the service, providers may act as processors on Locol's instructions or as independent controllers under their own terms. We use or interoperate with the following services for the purposes above:

• Supabase, hosted in eu-central-1 (Frankfurt), for authentication, database, Functions, and Storage.
• Cloudflare for Pages, Functions, D1, Turnstile, network security, cookieless Web Analytics, and delivery of the website.
• Apple for Apple Weather (WeatherKit), Apple Maps/MapKit, push notifications (APNs and ActivityKit), Sign in with Apple, and iOS distribution.
• Google for Google Sign-In, optional Google Calendar, and the Google Workspace support email.
• Vercel (invite pages), on its EU/US edge network, to serve the web page that opens from a plan invite link.

For Google Calendar and other Google Workspace scopes, the following statement applies exactly:

The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

See the Google User Data Policy.

International transfers

Supabase stores the primary Locol backend data in Frankfurt. Other providers may process information in countries outside the European Economic Area as part of their global infrastructure or support. Where a transfer is required, Locol will use a lawful transfer mechanism and appropriate contractual, technical, or organizational safeguards, such as an adequacy decision or approved standard contractual clauses where applicable. Contact us for the current provider-specific transfer information.

How long we keep information

• Account and plan content is kept while the account is active and then purged, subject to legal duties, disputes, and necessary recovery records.
• Product interaction records, for guests and for signed-in accounts, are kept for 90 days.
• An account deletion request has a 30-day recovery period. Your account remains active; sign in again within 30 days to cancel the deletion. If that does not work, contact support@locolapp.xyz.
• A private data-export object is available for at most 24 hours; a signed export URL expires after 5 minutes.
• A bare record that an account was deleted, with no personal data, is kept for 730 days to prevent accidental re-creation and support auditing.
• A notice that deletion finished, without your address, is kept for 90 days.
• Google Calendar tokens are retained until you disconnect Calendar or your account is purged, with bounded revocation handling.
• Waitlist records use the following owner-confirmed period: 12 months after the last contact, or until the account is created.

If an in-app export or deletion operation is unavailable, contact support@locolapp.xyz.

Organizer submissions

If you submit an event or agenda page, we store your contact email, the details you submit, your terms and rights declaration, and records of verification, review and changes. We use these to review and manage listings and communicate with you. Approved event details, the public organizer name if supplied, the source link and any approved image may appear in Locol; your contact email does not. We may check an agenda URL for events after review. If you choose event statistics emails, we send aggregate activity without app-user identities. You can stop those emails using your manage link.

Verification and management use private, expiring links. They are stored as hashes. Keep your link private; email confirmation proves mailbox access, not venue ownership.

• Unverified submissions and unused uploads are deleted after 7 days; verification links expire after 24 hours.
• Rejected or withdrawn submission contact details and payloads are deleted 90 days after closure. Unused or publicly withdrawn organizer images are removed within 30 days, with cache invalidation where supported.
• Approved submission contact details, revisions, terms and review records are retained during the active listing or agenda relationship, then for 12 months after the last event ends or the agenda relationship closes.
• A documented legal or rights hold may require a specific record to be kept longer. Its basis, scope and expiry are reviewed separately.
• Weekly reports use the existing product interaction retention periods. They do not extend those periods or contain lifetime totals.

Submissions are processed through Cloudflare and our private Supabase backend. Transactional organizer email is sent through Resend when configured. Optional images are processed and stored through Cloudflare when that service is configured. New addresses are held for review when a location cannot be confirmed. We do not give organizers identities or contact lists of people using the app. See Third-party services and the Organizer Terms.

Your choices and rights

Depending on where you live, you can ask us to access, correct, export, or delete your information, restrict or object to processing, and withdraw consent. You may also complain to the supervisory authority in the EU/EEA country where you live, work, or believe an infringement occurred. Autoriteit Persoonsgegevens (NL)

To make a request, email support@locolapp.xyz and include enough information for us to find the relevant account or record. Do not send passwords, OAuth tokens, or other secrets. We may need to verify identity before fulfilling a request. We aim to acknowledge support requests within 2 business days and resolve rights requests within 30 calendar days, or tell you within that period why a lawful extension is needed.

For the current in-app controls:

• Export: Settings → Account → Export your data. This prepares a JSON file; when the app says the export is ready, tap the row again to save or share it. You must be signed in. See Data export.
• Delete: Settings → Account → Delete account. You can export your data first, type DELETE, and tap Request account deletion. The recovery window is 30 days; your account remains active; sign in again within 30 days to cancel the deletion. If that does not work, contact support@locolapp.xyz. See Account deletion.
• Google Calendar: disconnect it in Account, or remove Locol's access directly at myaccount.google.com/permissions. Disconnecting in Account revokes the token at Google and deletes the stored credential.
• Sign in with Apple: you can remove Locol’s Apple sign-in grant in your Apple Account settings. Follow Apple’s instructions for managing Sign in with Apple apps. Removing this grant does not request deletion of your Locol account; use the account-deletion steps above.
• Optional analytics and waitlist communications: withdraw consent in the relevant control or contact us.

Children and automated decisions

Locol is for people aged 16 and over. It is a general-audience personal planning service. We do not knowingly request information from children in violation of applicable law. If you believe a child has provided personal information, contact support@locolapp.xyz.

Locol uses deterministic rules and ordinary service operations to show event information, availability, and planning features. We do not make decisions about people based solely on automated processing that produce legal or similarly significant effects.

Public events and the Digital Services Act

Event details come from public sources and reviewed organizer submissions. The organizer channel accepts event or agenda submissions for human review. Private plans and intents can be shared with invited people. Reports about allegedly unlawful information or service issues can be sent to support@locolapp.xyz. DSA point of contact: support@locolapp.xyz. EU languages accepted for DSA communications: English and Dutch.

Open data & licences

• DATAtourisme — Etalab Licence Ouverte 2.0. Tourism data from DATAtourisme and its contributing producers. Producer and last-update information belong to the source record. Source website.
• DZT Knowledge Graph — CC0 / CC BY / CC BY-SA, as specified for each record. Data from the German National Tourist Board (DZT) Knowledge Graph and its contributing publishers. The licence and copyright notice of each record apply; this list does not assign a licence to records without one. Source website.
• OpenStreetMap contributors — Open Database Licence (ODbL). © OpenStreetMap contributors Source website.
• Axenda de Cultura de Galicia — CC BY-SA 4.0. Axenda de Cultura de Galicia / Xunta de Galicia (cultura.gal), CC BY-SA 4.0 Source website.

Event images belong to their publishers. Individual photo credits and licences apply where provided. Request an image takedown.

Security

We use access controls, encrypted transport, protected token storage, bounded retention, and operational safeguards appropriate to the information and feature. No online service can guarantee absolute security. Tell us promptly about suspected account compromise or a security issue at support@locolapp.xyz.

Changes and contact

We may update this policy when the service, providers, or legal requirements change. We will update the date above and provide additional notice where required. Questions, rights requests, and support are handled at support@locolapp.xyz.