Privacy

How we handle your data

AlbaGo is built for discovery, not surveillance. This page is the plain-English version of what we collect, where it goes, and how to reach us.

Last updated · June 10, 2026

What we collect

Account email and a hashed password when you sign up (via Supabase Auth).
Events and places you save to your account.
Event submissions and the form fields you fill (title, contact details, address, optional notes).
The geocoded latitude/longitude of the address you type in the submission form.

When you geocode an address (in the event submission form, or when searching for a city), we send the text you typed to OpenStreetMap Nominatim — a public, third-party geocoding service.
Nominatim sees the search text and your IP address, governed by their own usage policy. We do not send your account email or any logged-in identifier to them.
Map tiles are served by Mapbox. Mapbox sees your IP and the tiles your viewport requests, governed by their privacy policy. They do not see your account identifier.

All AlbaGo data is stored in Supabase (Postgres + Auth + Storage), hosted in the EU. Row-level security policies restrict access to your own rows.
Aggregate stats (e.g. published event counts) are public. Personal records (saved events, draft submissions) are private to you and platform admins.
We do not sell or share your data with advertisers. We do not run third-party analytics or ad pixels.

We use one cookie family: Supabase Auth session cookies, which keep you signed in. They are HTTP-only and scoped to this domain.
We do not set analytics, marketing, or third-party tracking cookies.

You can sign in and delete saved events at any time.
For deletion of your account or submitted events (including any older volunteer sign-ups), email us — see "Contact" below — and we will action it within 30 days.
You can also request a copy of every row tied to your account.