umadum

Privacy policy

This is a courtesy translation. The German version is legally binding.

This privacy policy applies to the website umadum.app and to the app "umadum – Event Radar" (Android, iOS and web app). We take the protection of your data seriously: umadum contains no advertising and embeds no third-party analytics service. We count how often the website is opened ourselves — without cookies, without any identifier and without recognising you (section 9).

1. Controller

Ralph Grashuber
Wöhlerstraße 34
84489 Burghausen
Germany
Email: zutoruffy@gmail.com

2. Use without an account

Browsing events is possible without an account. No personal data about you is stored in the process. For technical reasons, when events are loaded, the visible map area (geographic coordinates of the screen area, not your device location) is transmitted to our database in order to return the matching events (legal basis: Art. 6(1)(b) GDPR).

3. Location data

If you grant the app location permission, your device location is used exclusively locally on your device to center the map on your surroundings. Your location is not transmitted to us or to third parties and is not stored. The permission is optional; the app also works without it.

4. User account

For favorites, your own event suggestions and notifications you can optionally create an account. In doing so we process your email address and a password (stored encrypted, as a hash). The legal basis is the performance of the usage contract (Art. 6(1)(b) GDPR). The data is stored with our processor Supabase (see section 8) and transmitted exclusively encrypted (HTTPS/TLS).

5. User content, favorites and notifications

Content stored with an account — events you suggested or created, change requests, favorites and in-app notifications — is associated with your account and stored in our database (Art. 6(1)(b) GDPR). Approved events are visible to all users; your name or email address is not displayed publicly.

Your account has a display name. On registration it is pre-filled from the part of your email address before the @ sign, and it is visible to moderators when they review your suggestion. You can change it at any time in the app under Account → Change display name.

6. Push notifications

Push notifications are off by default. Only once you turn them on in the app under Account → Push notifications is Firebase Cloud Messaging (FCM) by Google Ireland Ltd. / Google LLC started at all. Before that, no connection to Google is made and no device identifier is created.

After you turn them on, a pseudonymous device token is generated and processed by us and by Google in order to deliver messages to you (e.g. decisions on your event suggestions) (Art. 6(1)(a) GDPR). You can withdraw your consent at any time with the same switch (Art. 7(3) GDPR) — the token is deleted in the process — or revoke the permission in your system settings. More information: Google privacy policy.

7. Map display and place search (OpenStreetMap)

The map loads map tiles from servers of the OpenStreetMap Foundation (OSMF). For the place search, the entered search term is sent to the OSMF service Nominatim. For technical reasons, your IP address is transmitted to the respective servers (Art. 6(1)(f) GDPR — legitimate interest in displaying a functional map). The OSMF privacy policy applies.

8. Hosting and processors

The backend (database, authentication, storage) is operated with Supabase (Supabase Inc., USA) in a region inside the EU; all transmission is encrypted. A data processing agreement under Art. 28 GDPR is in place with Supabase. The website itself is hosted with Render (Render Services, Inc., USA). When it is accessed, Render processes technically necessary server log data (IP address, time, page accessed) to deliver the page and ensure its security (Art. 6(1)(f) GDPR). Render's privacy policy applies.

Transfers to third countries: Supabase Inc., Render Services, Inc. and Google LLC are based in the USA. Access from the USA cannot be technically ruled out. Transfers are based on the EU-US Data Privacy Framework or on standard contractual clauses under Art. 46(2)(c) GDPR.

9. Website usage measurement

So that we can tell at all whether and how the website is used, we count page views and clicks on individual buttons (such as "Open app" or the Google Play button). This happens in our own database at Supabase — there is no third-party analytics service involved.

No cookies are set and nothing is stored on or read from your device (§ 25 TTDSG is therefore not engaged), so no consent is required. Per view we store only:

We do not store your IP address, your browser type or any device or session identifier. A single record can therefore neither be attributed to you nor chained with another record into a history. We see views — not visitors. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in being able to assess the use of our own site at all).

If your browser sends the Do Not Track signal, nothing is counted at all. The counts are deleted after 400 days.

10. Event import for organizers and clubs

At umadum.app/en/import.html, organizers and clubs can submit their dates as a spreadsheet or calendar file, or register a calendar or events page to be fetched regularly. No account is needed for this.

The uploaded file never leaves your device. It is read and parsed inside your browser; only the list of events you reviewed and explicitly submitted is transmitted to us. The file name is sent along so that we know what a question refers to.

We store per submission: the name of the organization, optionally a contact person, the email address for questions, the chosen plan, an optional message as well as the time and size of the submission. The legal basis is Art. 6(1)(b) GDPR (carrying out the publication you asked for) and Art. 6(1)(f) GDPR (legitimate interest in a traceable origin of the entries). We delete these contact details after 24 months; the submitted events themselves remain as content for as long as they are relevant to the map.

Addresses are looked up: to appear on the map an event needs coordinates. The assistant therefore queries the address you entered at the OpenStreetMap Foundation’s Nominatim service — directly from your browser, which technically transmits your IP address to the OSMF (see section 7). The coordinates found are cached in your browser only.

For a registered connection (iCal address or events page) we additionally store the address you gave and fetch it regularly once we have enabled it. You can end the connection at any time by email; removing the address on your side also works.

11. Storage period and account deletion

We store account data and associated content for as long as your account exists.

You can delete your account yourself at any time — in the app under Account → Data & privacy → Delete account. Deletion happens immediately and cannot be undone. It removes: your account including your email address, your display name, your favourites, your suggestions and change requests, your notifications, your push device tokens and your unpublished drafts. Events that have already been published remain, but lose any link to you — they describe a public event, not you.

There is a way without the app too: see Delete account.

We delete notifications and completed requests no later than 12 months after they are settled. Device tokens for push are removed as soon as Google reports them as invalid, at the latest when you sign out or turn notifications off.

12. Your rights

You have the following rights vis-à-vis the controller regarding your personal data:

Access and erasure work directly in the app, without writing to us: under Account → Data & privacy you will find "Export my data" (a complete copy as JSON, Art. 15 and 20 GDPR) and "Delete account" (Art. 17 GDPR). For anything else, reach us at zutoruffy@gmail.com.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority of your habitual residence. The authority responsible for us is the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany.

13. App permissions

14. Changes to this policy

We will update this privacy policy when the app or the legal situation changes. The version published here applies.

Last updated: August 2026