Privacy

Processors and third-party services

Last updated: 2026-10-25

This page is the processors and Google disclosure section of the Locol Privacy Policy. The canonical policy is the Privacy Policy.

Depending on the service, providers may act as processors on Locol's instructions or as independent controllers under their own terms. We use or interoperate with the following services:

• Supabase, hosted in eu-central-1 (Frankfurt), for authentication, database, Functions, and Storage. It holds the account, plan, saved-event, invitation, product-analytics, and push and Live Activity records described above.
• Cloudflare for Pages, Functions, D1, Turnstile, network security, cookieless Web Analytics, and delivery of the website. D1 stores the waitlist, Turnstile receives the visitor IP address to check that a signup is not automated, and, when signup notifications are switched on, a private Cloudflare Worker sends Locol a notification email for each new waitlist signup. When organizer image uploads are enabled, Cloudflare Images processes optional uploads and private R2 storage holds them for review and approved delivery.
• Resend for organizer verification, management, review and optional weekly statistics emails when organizer mail is enabled. Resend receives the recipient address and message content to deliver those emails. Organizer mail is sent from a domain set up in Resend's EU sending region (eu-west-1).
• Hetzner, in Germany, hosts the Locol server that collects public event information and Locol's own internal dashboards. The dashboards run Grafana, software Locol operates itself on that server, reachable only over a private network. They read the product interaction records described under optional product analytics through a read-only database role. They also read waitlist counts and, for the latest signups, only the time, city and entry label, never email addresses, names or websites.
• Apple for Apple Weather (WeatherKit, which receives the location of the event, not yours), Apple Maps/MapKit (which receives the origin and destination you ask a route or travel time for, and looks up an address you type), push notifications (APNs and ActivityKit, which carry your device token and the notification content, such as event title, venue and leave-by time), Sign in with Apple (which gives Locol your email address or an Apple private relay address, and a sign-in token), iOS distribution, waitlist invitations (TestFlight, which receives your waitlist email address so Apple can send you the invitation), and crash and performance reports delivered through MetricKit. Weather data by Apple Weather.
• Google for Google Sign-In (which gives Locol your Google account email, name and profile picture), optional Google Calendar, and the Google Workspace support email. See Google Calendar for exactly what Locol reads and writes.
• Vercel (invite pages), on its EU/US edge network, to serve the web page that opens from a plan invite link.

Publisher-sourced event images may load directly from the original publishers' websites, so a publisher's server receives your IP address when an image loads. Those publishers are independent of Locol. Approved organizer uploads may instead be delivered through Locol's Cloudflare image service.

Organizer addresses that cannot be confirmed are held for location review. If we introduce an external geocoding provider for this route, we will identify it here before sending organizer addresses to it.

For Google Calendar and other Google Workspace scopes, the following statement applies exactly:

The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

See the Google User Data Policy.

Read the full Privacy Policy for purposes, legal bases, and transfers.