What we collect, and why

The short version

• You can browse, search and read everything without an account.
• An account stores your email, a display name, your city and the interests you pick.
• What you post — events, comments, votes, images — is stored and mostly public.
• We do not run analytics, advertising or tracking software of any kind.
• We do not sell your information.

Browsing without an account

You do not need to sign in to browse events, search, or read comments. Doing so does not create a profile for you and does not place tracking cookies. The site stores one preference in your browser — whether you chose the light or dark theme — which never leaves your device.

Your account

Accounts are handled by Supabase Auth. When you sign up we store your email address and a password that Supabase hashes; we never see or hold your password ourselves. Your sign-in session is kept in your browser’s local storage, not in a cookie.

Your profile and preferences

The short setup after sign-up stores:

• a display name, which is public and shown next to anything you post
• the country and city you chose, which set your default feed
• the interest tags you picked
• whether you opted into the weekly digest or new-event emails
• optionally, how you heard about Whatson

You can change these at any time. Your email address is not shown to other people.

What you post

Events you submit, comments you write, and votes you cast are stored against your account. Events and comments are public and appear with your display name. Votes are not shown individually to other people — only the totals are.

Images you upload for an event are stored in Supabase Storage under a folder tied to your account, and are publicly readable once attached to a published event. Only you can upload to or delete from your own folder.

If you report an event or a comment, we store the reason you chose, any note you add, and your account if you were signed in. Reports are visible to moderators, not to the person you reported.

Location

Whatson does not ask for or use your device’s GPS location. The only location information involved is the city you choose and the venue or address attached to an event, which is part of the public event listing. City weather is fetched by city name.

Technical logs

Our API writes ordinary server logs. These include the time, the request path, the response status, and the IP address the request came from. IP addresses are also used to limit how often an action can be repeated, which is what keeps spam and abuse manageable. For signed-in requests that limit is applied to your account instead.

These logs exist for operating and securing the service. We have not set an automatic deletion schedule for them, and we would rather say so than state a retention period we do not currently enforce.

Who else is involved

Whatson is built on a small number of services, each of which necessarily processes some data to do its job:

• Supabase — accounts and sign-in, the database, and image storage.
• Netlify — serves the website.
• Railway — runs our API and the search index.
• WeatherAPI — city weather forecasts. Only a city name is sent; nothing about you.

The search index holds public event information only — titles, descriptions, venues, tags and image links. It holds nothing about you.

What we do not do

We do not run analytics or behavioural tracking, we do not use advertising networks or pixels, we do not build profiles of you for targeting, and we do not sell or rent your information. If that changes, this page changes first.

Deleting things

You can edit or delete your own comments, and you can archive or delete events you created, from your events. Deleting an event also deletes the images you uploaded for it.

Full account deletion is not built yet. It is planned, and until it ships you can ask us to remove your account and we will do it by hand.

Contacting us

Whatson is in public beta and does not yet publish a postal address or a support mailbox. When those exist they will be listed here.