Privacy Policy

Effective date: October 16, 2026 · Last updated: October 17, 2026 · App: EventCrew (Android app and member web app) · Developer: Hartmann Studios

This policy explains what information EventCrew ("EventCrew", "the app", "the service") handles, why, how long it is kept, and the choices you have. EventCrew is made by Hartmann Studios ("we", "us"). If you have a question, open an issue on GitHub and choose "Privacy or data question".

1. How EventCrew works

One person, the leader, creates an event in the EventCrew Android app (or on the web) and shares an invite link. Other people, members, open the link in a web browser, pick a nickname and join. During the event, the group can see each other on a map, chat and share photos. Each event has an end time. When it ends, the event and everything in it are deleted.

2. Information handled during an event

Content you share (encrypted on your device)

The event name, nicknames, chat messages, photos, locations and the leader's meetup pin are encrypted on your device with a key that exists only in the invite link. The part of the link that holds the key is never sent to our server. Our server, and the hosting provider it runs on, store and pass along only the encrypted form and cannot read it. Anyone you give the invite link to, and who is let into the event, can read it.

Technical information needed to run the event

• A random member ID and a random access token stored in your browser or app. The server keeps only a one-way hash of the token.
• Your role (leader or member), whether you've been approved, the color of your map dot, when you joined, your location precision setting, and the time of your latest location update.
• The event's settings, end time and plan (Free or Pro), and invite links stored as one-way hashes with their expiry and use counts.
• If you turn on notifications, the push address your browser or phone gives us (see section 6).

All of this is stored in that event's own database and is deleted with the event.

3. Location

• Only during an event. The app and the web page ask for location permission. Location is shared only with the people in the event you joined.
• Members (web): your location is sent only while the EventCrew page is open, and only after you have moved. Browsers do not allow web pages to use location in the background.
• Leader (Android app): while your event is running, the app can keep sharing your location with the group with a visible notification on your phone. It stops when the event ends or you leave.
• Only the latest point. Each person's newest location replaces the previous one. No route or history is kept. Your last known spot is saved now and then so the group can still see where you were if your phone dies.
• Your choice: exact, approximate (rounded to about 100 m on your device before it is encrypted) or paused. The leader can require approximate locations for everyone.
• Photos are re-drawn on your device before sharing, which removes hidden metadata such as the GPS position where the photo was taken.

4. When data is deleted

• When the event ends: when the leader taps End, or automatically one hour after the planned end time, every connection is closed and the event's entire database is deleted in one step: locations, chat, photos, nicknames, members, invites and settings. There are no soft deletes, archives or backups. If the leader leaves, the event ends.
• When you leave: tapping Leave deletes your member record, location, messages and photos from the server immediately, and removes the event from your browser's storage. The same happens if the leader removes you.
• Safety net: scheduled checks run every 30 minutes and daily to delete any event that has passed its end time.
• Our hosting provider (Cloudflare) handles the physical storage. How quickly its systems overwrite deleted storage is controlled by Cloudflare, not us. Event content is encrypted either way.

5. Abuse prevention and limits

To keep EventCrew free and prevent abuse, the service keeps a small amount of information with no names and no event content:

• A one-way hash of the leader's random device key, used to enforce the number of events a leader can run at once. It is deleted when the event ends.
• A salted one-way hash of the IP address that creates an event, combined with the date, used to limit how many events can be created from one place per day. The IP address itself is not stored, and the hash is deleted after one day.
• Daily counts of events created and expected usage, kept for 3 days.

We have turned off request logging for the EventCrew server.

6. Notifications

• Web: if you allow notifications, your browser gives us a push address run by your browser's push service (for example Google, Apple or Mozilla). Notifications carry no content; they only say "New activity in your group". The push address is deleted with the event, or when you leave.
• Android app: notifications to the leader app are delivered by Firebase Cloud Messaging, a Google service, which uses a device token for this.

7. Maps

Map images come from OpenFreeMap, which needs no account, key or cookies. Your device downloads the map tiles directly, so OpenFreeMap receives your IP address and which map area is being viewed, as with any website. Your location and the group's dots are drawn on your device and are not sent to OpenFreeMap.

8. Advertising

• Android app (free plan): the app shows ads from Google AdMob, never on the live map. The Google Mobile Ads SDK collects and shares with Google your device's advertising ID, IP address (which can indicate approximate location), device and app information, and ad interactions, as described in How Google uses information from sites or apps that use its services. You can reset your advertising ID or opt out of personalized ads in Android Settings. Where the law requires it, the app asks for your consent first.
• Member web app (free events): a single banner labelled "Ad" may be shown on some screens, never over the map, the chat box or any button. The ad network is AADS (aads.com, formerly A-Ads), which shows non-personalized ads. The banner loads from AADS inside a sandboxed frame: our pages load no ad scripts and set no cookies, and the sandboxed frame cannot read or set cookies on our pages. Like any website, AADS receives standard information from your browser, such as your IP address and browser type, plus our site address as the referrer; it never receives your nickname, messages, photos, location, invite link or event ID. When no AADS banner is available, the slot shows our own promotion of Hartmann Studios products instead, which involves no third party.
• Pro: events started by a Pro leader never show ads, in the Android app or the web app, to anyone in the group.

9. Purchases

Pro is sold through Google Play Billing. Google processes your payment; we never receive your card number or billing details. Subscription status is managed by RevenueCat, using a random ID generated by the app rather than your name or email. When a Pro leader creates an event, the server checks that status so the event gets Pro limits.

10. What we don't do

• We do not sell personal data, and we do not share it for anyone else's advertising or marketing.
• We do not ask for an email address, phone number, real name or contacts.
• The member web app has no analytics or crash-reporting tools.
• We do not keep location history or event content after an event ends.

11. Who processes data for us

• Cloudflare (hosting the EventCrew server and each event's encrypted database, at eventcrew.eventcrew-app.workers.dev). On October 17, 2026 the server moved to a Cloudflare account dedicated to EventCrew; the provider, the data practices and this policy are unchanged.
• Google (Google Play, Play Billing, AdMob ads and Firebase Cloud Messaging)
• RevenueCat (subscription status)
• OpenFreeMap (map tiles)
• Your browser's push service, if you turn on web notifications
• AADS (aads.com, formerly A-Ads), for the sandboxed web banner on free events only, never on Pro events

12. Security

Connections use HTTPS. Content is encrypted on your device before it is sent. Invite links can expire and can be cancelled by the leader, and by default the leader approves each new person. Anyone who has the link and is let in can see the event, so share it only with people you trust. No system is perfectly secure, but keeping as little as possible for as short a time as possible is how EventCrew limits risk.

13. Children

EventCrew is not directed at children under 13, and we do not knowingly collect information from them.

14. Your choices and rights

You can pause location, choose approximate location, turn notifications off, or leave an event at any time, which deletes your data immediately. Because there are no accounts and event data is deleted when the event ends, there is usually nothing left for us to access, correct or delete afterwards. See Delete your data. For anything else, open an issue on GitHub.

15. Changes to this policy

If this policy changes, we will update this page and its "Last updated" date. Significant changes will also be noted in the app.