This page explains what data we use and why.
Account sign-in (Google OAuth): verified email address and name (given/family name) to create or access your account.
Profile data: first name, last name, phone, and pronouns (if you add them).
Booking data: first name, last name, email, event date/time, event type, location, and optional description.
We use strict session cookies and server-side session data to keep you signed in and protect access.
For abuse prevention and troubleshooting, we process technical data such as IP address, route/method metadata, anti-bot checks, and rate-limit events.
We use Google for authentication and Cloudflare Turnstile for bot protection on booking requests. Turnstile tokens are verified server-side and may include your IP address.
Booking and GDPR delete-request notifications are sent to internal admins through our configured email delivery provider.
We do not sell personal data.
Account and booking records are stored while needed for account operation, service delivery, legal obligations, and security.
If you request account deletion, the account is deactivated immediately and a deletion request is recorded with a review deadline (currently 30 days).
You can request access, correction, or deletion of your personal data according to applicable law.