Data Controller
The party responsible for data processing on this website is AFTR.IO, Aleksa Petrovic, Vienna, Austria. For privacy inquiries, contact us at aftrparties.business@gmail.com.
What Data We Collect
We only collect the email address you provide when signing up for Early Access. Additionally, the time of registration is stored.
Purpose of Data Collection
Your email is used exclusively to grant you access to the Early Access program of our app and to provide the Early Access bonus.
Legal Basis
The processing of your email is based on your consent pursuant to Art. 6(1)(a) GDPR.
Data Sharing with Third Parties
Your email is not shared with any third parties.
Storage & Deletion
Your email is stored for as long as the Early Access program is active. You can request deletion at any time by emailing aftrparties.business@gmail.com.
Security
We take appropriate technical and organizational measures to protect your data.
Your Rights
You have the right to access, rectify, delete your data, or withdraw your consent at any time. Contact us at aftrparties.business@gmail.com.
Note on the App
The use of the AFTR app is subject to separate privacy policies, which you can review within the app.
User-Generated Video Content (Clips)
When you upload a video clip via the AFTR app ('Clip'), the following processing applies: (1) The video file is uploaded to our content delivery network (Cloudflare R2, EU region) and assigned a unique URL. (2) The video is automatically scanned by automated content moderation systems for policy violations: text in the video metadata and the visual content are both scanned by Cloudflare Workers AI (on Cloudflare's EU edge infrastructure) for harmful content and NSFW categories. (3) Neither system performs facial recognition, biometric identification, or person matching. We do not extract biometric templates, we do not link faces to identities, and we do not maintain a database of facial features. (4) Clips are automatically deleted from our CDN 24 hours after upload, except where moderation has flagged content for review or where you have chosen to keep the Clip in your profile. (5) You can delete any Clip you have uploaded at any time. The legal basis is Art. 6(1)(b) GDPR (performance of the contract for Clip publishing) and Art. 6(1)(f) GDPR (legitimate interest in content moderation for safety). Because we do not perform biometric identification, Art. 9 GDPR does not apply.
Party and Event Data
When you join a party or purchase a ticket, we process: your user ID, ticket type, payment status, check-in time, and — if you enable it — your real-time location. Ticket QR codes rotate via HMAC every 5 minutes to prevent reuse. Event hosts see attendee lists for their own events only.
Payment Processing
We use Stripe (Stripe Payments Europe Limited, Ireland) to process payments. Stripe receives your payment details directly; we do not store full card numbers. Stripe acts as an independent controller for fraud prevention and as our processor for transaction handling. See Stripe's privacy policy at stripe.com/privacy.
Location Data
When you enable location sharing during a party, your approximate location is shared in real-time with other guests at the same party via WebSocket. Location is not persisted after the party ends. Legal basis: Art. 6(1)(a) GDPR (your consent, revocable at any time in app settings).
Messaging and Chat
Direct messages between users use end-to-end encryption (Signal Protocol). We cannot read message content. Group party chat is server-stored for 30 days then auto-deleted.
Content Moderation
We use automated content moderation (Cloudflare Workers AI for both text and images/video, running on Cloudflare's EU edge) to enforce community guidelines. Flagged content is reviewed by human moderators. You may appeal moderation decisions via the in-app appeal mechanism. Legal basis: Art. 6(1)(f) GDPR and DSA Art. 16.
Push Notifications
We use Firebase Cloud Messaging to deliver push notifications (order updates, party reminders, chat messages). You can disable notifications at any time in device settings. Notifications contain no personal data in the payload — display content is rendered locally.
Third-party services we use: Stripe (payments, EU + US), Firebase Cloud Messaging (push notifications, EU + US), Cloudflare R2 (content storage, EU), Cloudflare Workers AI (text + image moderation, EU edge), Sentry (error tracking, EU Frankfurt), Crisp (customer support chat, EU).
Data Retention
Account data: retained while account is active + 30 days after deletion. Payment records: 10 years (statutory accounting). Clips: 24 hours unless flagged or saved to profile. Chat messages: 30 days. Location: not persisted. Moderation logs: 12 months. Sentry error events: 90 days.