Privacy Policy

Controller

Schick Vienna is a private, non-commercial project. The app is free of charge, contains no advertising, and no data is sold or shared for advertising purposes.

1. Data, purposes and features in the app

Account and sign-in

We process your account identifier, email address, login state and security-related account information; a password is stored only as a cryptographic hash. If you sign in with Google or Apple, we receive your email address from them (with Apple, an anonymous relay address if you choose), an account identifier and, if provided, your name; your name is not shown to others. Google or Apple learn that you are signing in to Schick. The purpose is to create, secure and manage your account.

Profile and visibility

We process username, friend code, gender or avatar variant, an optional profile picture, birth year, student status, language, points, level and one-time mission progress. These details are associated with your account on the server. Other signed-in users see your username, your level icon in the variant you chose and your profile picture, for example when searching for usernames, under “People you may know” and among your friends. Birth year and student status are never shown to others; organisers do not receive your profile or individual demographic values. An uploaded profile picture is checked automatically for nudity on our own servers before it is stored; it is not sent to any third party for this. Refused pictures are not stored. Stored profile pictures can be retrieved via their image address without signing in.

Friends and attendance plans

We process friend requests, confirmed connections, nicknames, blocks, mute and close-friend status, and sharing preferences. When you choose “I’m coming!”, we store the event or club and the time. Plans are only visible while sharing is on, and then only to your confirmed friends, never to anyone else. New accounts start with sharing off; you can turn it on or off at any time in the friends settings under “Share attendance”. If someone has marked you as a close friend and turned on that notification, they receive a push notification when you confirm, again only while you share. Suggestions under “People you may know” are based solely on friends of your confirmed friends; friends of your friends see your username, level icon, profile picture and the number of mutual friends there. No address book is read.

Community statistics

Attendance confirmations are used to compile aggregate statistics about age groups, gender distribution and student share. Demographic results are displayed only once a minimum number of confirmations is reached (currently 5). Organisers receive no attendee lists, profiles or individual values.

Event and club usage

We process daily per-user views, attendance, ratings, artist kudos, followed hosts, favourites, reports and interactions to provide the app, prevent abuse and compile aggregate statistics and community rankings.

Using the app without an account

You can browse the map, calendar and events without an account. So that a device counts as one view per event and day, the app creates a new random identifier every day, keeps it on your device until the day ends and sends it along with views. It is not derived from any device data, not linked to an account and not shared with anyone, so views from different days cannot be connected. On the server we delete guests’ view data every night shortly after midnight; only the summed-up number of views per event and day remains.

Location and maps

With permission, device location is used to show your position and nearby places. It is generally processed on-device and not stored as a movement profile. External map providers apply their own privacy terms when you deliberately open their apps.

Camera and photos

The camera is used only to scan friend QR codes; no images are stored. Photo access serves solely to choose a profile picture, which you can remove at any time.

Technical data and diagnostics

IP address, timestamps, device, platform, app version and technical logs may be processed for security and diagnostics. The app sends crash and error data, such as device type, app version and the steps before the error, to Sentry (Functional Software, Inc.); it is stored in Sentry’s EU data centre. Search terms are removed from requested addresses before sending; contents of input fields are not meant to be part of error reports.

Notifications

When notifications are enabled, we process push identifiers and your notification settings, for example for attendance reminders, friend requests, close friends’ confirmations and the weekend overview of hosts you follow. Notifications are delivered through Expo’s push service (650 Industries, Inc.) and through Apple or Google, which receive the push identifier and the content of the notification. The app contains no advertising; there is no ad tracking and no sharing of data for advertising purposes.

Host features

Hosts who list events submit event, venue, ticket and image details as well as Instagram references. We review this content and publish it in the app and on the website. Hosts receive aggregate figures such as views and confirmations for their own events, but no personal data.

Artists, organisers and venues

To provide event information we also process details about artists, DJs, organisers and venues: artist and organiser names, public Instagram accounts, Spotify identifiers and pictures, and kudos counts. These details come from public sources, namely organisers’ websites, Instagram profiles and ticket pages and Spotify, or from hosts. The legal basis is our legitimate interest in informing fully about events in Vienna (Art. 6(1)(f) GDPR). Anyone concerned can object or ask for a correction at any time: kontakt@schick-vienna.at.

2. Legal bases

Depending on the feature, processing is based on Art. 6(1)(b) GDPR to provide your account and requested app services, Art. 6(1)(a) GDPR for consent-based features such as location, camera, photos and optional notifications, Art. 6(1)(f) GDPR for security, diagnostics, abuse prevention, counting views, product improvement, displaying content from other providers, details about artists, organisers and venues, and meaningful aggregate community statistics, and Art. 6(1)(c) GDPR for legal obligations. Our legitimate interest is to provide a reliable picture of Vienna nightlife; this is balanced by data minimisation, grouped analysis and a minimum number of confirmations before publication. Consent can be withdrawn prospectively at any time.

3. Source and provision of data

Data generally comes from you, your device or your interactions in the app. If you sign in with Google or Apple, your email address, account identifier and, where applicable, your name come from that provider. Details about artists, organisers and venues come from public sources or from hosts. Account, profile and login data are required for registration, the level icon and community features; without them the profile cannot be fully provided. Location, camera, photos and notifications are voluntary. If permissions are not granted, the app remains usable, but the respective feature — such as location display, QR scanning or push notifications — is unavailable or limited.

4. Recipients and external services

Access is limited to recipients who need data for the relevant purpose. We use these processors: Hetzner Online GmbH (Germany) for servers, databases, profile picture storage and encrypted backups; Sentry for diagnostics; Expo for delivering push notifications; an email service provider for confirmation and password emails. Sign-in runs on our own Keycloak server; profile pictures are checked and addresses are searched on our own servers too. Apple and Google are involved when you sign in with them and when push notifications are delivered.

Third-party content: some content is loaded by the app directly from other providers’ servers. For technical reasons the provider receives your IP address, device and app details (user agent) and the time of the request. This applies to:

• event pictures from Instagram posts and organisers’ profile pictures: Meta Platforms Ireland Ltd. (Instagram), when you view an event card or a host;
• event pictures from the websites of organisers, venues or ticket shops: the operator of that website, when you view an event card;
• artist pictures: Spotify AB, when you open the music details of an event or club;
• a connectivity check: Google, when the app starts, to find out whether you are online;
• for hosts entering an event: Instagram and the ticket website given, to check the accounts, posts and links entered.

The legal basis is our legitimate interest in displaying this content properly (Art. 6(1)(f) GDPR). The providers process the data under their own responsibility; see their privacy policies for details.

Spotify, Instagram, Apple Maps and Google Maps are also contacted when you open a corresponding link. Organisers receive only aggregate results; profiles and individual values are not disclosed. Data is not sold and not shared for advertising purposes.

5. Transfers outside the EEA

For some technical providers, processing outside the European Economic Area, in particular in the USA, cannot be ruled out, for example with Expo, Google, Apple and Meta (Instagram); Sentry stores error data in the EU but is a US company. Where required, transfers are based on an adequacy decision, such as the EU-US Data Privacy Framework, or appropriate safeguards under Art. 46 GDPR, in particular EU standard contractual clauses.

6. Retention

Account data is stored until the account is deleted. You can permanently delete your account at any time in the app under “Delete account” or ask for deletion by email; Delete your account explains how and which data is deleted. Friendship and attendance data is deleted or decoupled when the connection, entry or account is deleted, unless statutory retention obligations apply. Security and error logs are kept only as long as necessary for analysis and protection. Deleted data may remain in encrypted backups for up to one week until they are overwritten automatically. Local settings can be removed by signing out, resetting or deleting the app.

7. Website schick-vienna.at

Server logs

When you visit the website, technically necessary connection data (IP address, time, page requested, browser) may be processed in server log files. The website runs on servers of Hetzner Online GmbH in Germany. The purposes are operation, security and diagnostics (Art. 6(1)(f) GDPR).

Pictures on the website

Your browser loads event pictures from organisers’ websites directly from their servers; the operator receives your IP address, browser details and the time, but not the address of our page. Pictures from Instagram posts are delivered through our own server; Instagram receives no data from you in the process. The legal basis is our legitimate interest in presenting events fully (Art. 6(1)(f) GDPR).

Host login and event submissions

When you submit an event through the website, we process the account identifier and host permission from your Schick login and the event, venue, ticket and image data you provide, in order to review and publish the event. A short-lived access token is stored only in your browser’s session storage and is removed when the tab is closed.

Contact

The contact form prepares an email in your email client. The website does not send the message automatically or store it in a database.

Analytics

Google Analytics 4 (Google Ireland Ltd., Dublin) is only loaded with your consent in the cookie notice. Without consent, no data is sent to Google and no cookies are set. With consent, usage data (pages viewed, time, browser and device information, IP address) is sent to Google and the cookies _ga and _ga_GDNG7BC45R are set for up to two years; any transfer to Google LLC in the USA relies on the EU-US Data Privacy Framework. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 165(3) TKG 2021), which you can withdraw at any time via “Cookies” in the website footer.

Local storage

Your browser may store your cookie decision and the state of forms you have started locally. This data does not leave your browser.

8. Your rights

Subject to statutory conditions, you have the right to access, rectification, erasure, restriction, data portability and objection. In particular, you can object to the future use of your profile data for community statistics. Consent can be withdrawn at any time with future effect. No decision with legal or similarly significant effect is based solely on automated processing. Requests go to kontakt@schick-vienna.at. Proof of identity may be required to prevent unauthorised disclosure.

9. Right to lodge a complaint

You can lodge a complaint with the Austrian Data Protection Authority: Barichgasse 40–42, 1030 Vienna, email dsb@dsb.gv.at, web dsb.gv.at.

10. Security and changes

We apply appropriate technical and organisational measures to protect your data. This policy is updated when features, providers or legal requirements change. Material changes are communicated in an appropriate form in the app.