Privacy policy

01

Who we are

CityInEurope (cityineurope.com) is a free, ad-free guide to events and places in European cities: Budapest, Vienna, Prague, Bratislava, Munich, Berlin, Hamburg, Copenhagen, Paris, Lisbon, Porto, Rome, Milan, Barcelona, Madrid, Stockholm, Brussels, Istanbul, Antalya, Amsterdam, Kraków, Warsaw, Naples, London, Dublin, and Florence. It is operated by Core Engineering Korlátolt Felelősségű Társaság (Core Engineering Kft.; registered office: Váci út 99, Balance Hall, 3rd floor, H-1139 Budapest, Hungary; company registration number: 01-09-441199), which is the controller of the personal data described here. Contact: hello@cityineurope.com.

02

Using the site without an account

You can browse events and places without signing up. We do not use advertising or third-party tracking cookies and we do not build visitor profiles.

To know which pages are useful we count visits with Umami, a cookieless analytics tool running on our own server: it records the page, referrer, country and device type in aggregate, stores no IP address or identifier, sets no cookie and respects your browser's Do Not Track setting.

Like any web server, ours keeps a technical access log (IP address, requested address, browser type, time). It is used only to fix errors and fend off abuse, and it is deleted after 7 days.

If you allow location access, your position is sent only with the search request to sort results by distance; it is not stored. Radars you save without an account stay in your browser's local storage.

03

What we store when you sign up

Your email address and, if you choose a password, a salted scrypt hash of it (never the password itself). A session token is stored as a SHA-256 hash for 30 days.

Everything you add yourself: display name, your city, favourites, events you attend and your ratings, notes, lists, radars, photos and events you submit, children's ages, an optional home location, notification preferences and push subscriptions.

When you sign up we also record the country you signed up from. It is looked up from your IP address on our own server; the IP address itself is not stored.

04

Signing in with Google

You can create an account with your email address or with your Google account. With Google sign-in we receive only your Google account identifier, your email address and your name, and we use them solely to create and sign you in to your CityInEurope account. We do not post anything on your behalf and do not access your contacts, files or other data. If we offer other sign-in options such as Apple or Facebook in the future, the same applies to them.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

05

Weekly email without an account

You can subscribe to the weekly email with just your email address, without creating an account. We store the address, the city and language you chose, the page you subscribed from, and the dates of subscribing, confirming and the last send. The subscription only starts after you tap the button in the confirmation email (double opt-in); unconfirmed addresses are deleted after 14 days.

Every email has a one-click unsubscribe link. After unsubscribing we keep only the address with the unsubscribe date, so we never write to you again by mistake; ask us and we delete it completely. The legal basis is your consent (GDPR Art. 6(1)(a)), which you can withdraw at any time. The address is used only for this email and is never shared or sold.

06

Why we use it

To run your account and the features you switch on: saved items, reminders, radar alerts, the weekly email and recommendations. The legal basis is performing the service you asked for (GDPR Art. 6(1)(b)); optional notifications rely on your consent, which you can withdraw at any time in Account.

Error tracking, backups and the automatic check of content you submit rely on our legitimate interest in keeping the service secure, working and free of harmful content (GDPR Art. 6(1)(f)).

07

Who processes it

Hosting: the site and its database run on our own server in the EU, in Vienna (Austria), rented from netcup GmbH (Karlsruhe, Germany).

Microsoft Azure (Sweden Central region, EU): Application Insights receives technical data about errors and requests (page address without query parameters, response time, error details) so that we can fix problems; request contents are not sent and email addresses in error messages are masked. Azure AI Content Safety automatically checks the texts and images you submit for publication, such as photos, event submissions and list titles, for violent, sexual, hateful or self-harm content. Azure Blob Storage holds off-site copies of our database backups.

Anthropic (Claude, USA): AI helps us summarise and categorise public event descriptions; no personal data is sent for this. If you use the assistant, the question you type is sent to Anthropic together with matching public listings and the weather, so that the question can be understood and short reasons written for the suggestions. It is not linked to your account, but please do not include personal details in it.

Translation: public event descriptions are translated automatically with services from Google and Anthropic; no personal data is sent for this.

Resend delivers our emails, so it receives your email address and the message. Browser push messages pass through your browser vendor's push service. Visitor statistics (Umami) stay on our own server.

We never sell or rent personal data and never share it for advertising.

08

Content loaded from other sites

Maps load their tiles from the OpenStreetMap Foundation's tile servers, and some photos load directly from Wikimedia Commons or the organiser's website. As with any website, these servers see your IP address and browser type when your browser fetches the file. Links to Google Maps, ticket shops or organisers open only when you tap them, and that site's own privacy policy then applies.

09

Affiliate links

Some links to ticket shops and tour offers (currently Skiddle and GetYourGuide) are affiliate links. They are marked as sponsored in the page code and a note appears next to them. If you buy or book after clicking one, the partner may pay us a commission; the price you pay stays the same.

Our site sets no advertising or tracking cookie for this and we pass no personal data to the partner. Once you open the partner's site, it works under its own privacy policy and may set its own cookies, for example to credit us for the sale. We only receive aggregate reports (number of bookings and commission amount), not who you are. Affiliate links never change which events we list or how we rank them.

10

Cookies

Only strictly necessary cookies: kesif_session keeps you signed in, and kesif_oauth (10 minutes) protects a Google sign-in against forgery. Optionally, if you click OK on the small notice, your browser's local storage keeps the day of your first visit (no identifier, no cookie); visits are then counted as new or returning. If you decline, nothing is stored. You can withdraw at any time by clearing this site's data in your browser.

11

How long we keep it

Account data is kept until you delete your account. Expired sessions are removed automatically. The server access log is deleted after 7 days.

Database backups: a copy on our own server is kept for 7 days, and an off-site copy in Azure Blob Storage (Sweden Central, EU) for 14 days. To protect against data loss and attacks, each off-site copy is locked for 13 days so that nobody can change or delete it; after 14 days it is deleted. Data from a deleted account therefore disappears from all backups within 30 days at the latest.

12

Your rights

You can view and edit your data in Account and delete your account there at any time. This immediately removes your profile, sessions, linked sign-ins, favourites, notes, lists, radars, photos and submissions from our database; backup copies expire as described above.

You also have the right to access, rectify, port or restrict processing of your data and to object. Write to hello@cityineurope.com. You may lodge a complaint with a supervisory authority, for example in the EU country where you live, or in Hungary, where we are based, with the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH, Falk Miksa utca 9–11, 1055 Budapest, naih.hu).

13

Children

The site helps parents find activities for children, but accounts are meant for adults. Children's ages you add are stored as numbers only, without names.

14

Changes

If this policy changes materially we will update the date above and, for members, mention it in the next email.