Privacy Policy

Munich Today is a calendar of things to do in Munich and the surrounding region. This policy explains what personal data we process and why. Data controller: Cedric Oeldorf, Landsberger Str. 141, 80339 München, Germany. Questions or requests: privacy@munich-today.com.

You can browse events, open the calendar, download an event as an .ics file, and subscribe to public calendar feeds without creating an account or giving us your name or email address.

Like any website, our hosting service receives technical request data such as your IP address, browser type, requested page, and time of access so it can deliver and protect the site. We process this limited data for reliable and secure operation (Art. 6(1)(f) GDPR). Operational logs are deleted after the hosting service's short configured retention period, unless a specific security incident requires longer investigation.

If you choose Google sign-in, Google shares your name, email address, profile picture, and Google account identifier with us. We store these details to identify your account, together with the events you save and your preferences so your plan is available on every device.

Legal basis: providing the account service you requested (Art. 6(1)(b) GDPR). Google also processes information when you use its sign-in service under Google's privacy policy.

Sign-in relies on two strictly necessary cookies set by our authentication system for every visitor (a CSRF-protection token and a redirect target; both expire with your browser session), plus a session cookie once you sign in (30 days). These are required for the sign-in feature and do no tracking. Features you use — saved events, preferences, hidden filters, your consent choice — are kept in your browser's local storage; that storage only exists because you used the feature, and it never leaves your browser except where this policy says so. Local storage remains until you remove it, clear site data, or use the relevant reset or privacy control.

If — and only if — you allow it in the privacy banner, we store two random identifiers in your browser: one browser identifier in local storage and one session identifier in session storage. They let us record first-party interactions such as event impressions, views, saves, and outbound link clicks. This is pseudonymous usage data: the identifiers are not linked to your account, but they distinguish one browser or session from another.

Nothing is stored and nothing is sent without that opt-in. Declining changes nothing about how the site works, and we use no advertising technology or third-party analytics. Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can change your choice at any time via "Privacy settings" in the footer. Withdrawing stops future analytics, removes the identifiers from your browser, and requests deletion of records connected to them.

The browser identifier remains until you withdraw consent or clear the site's data. The session identifier lasts for the browser session. Analytics records older than 90 days are deleted automatically.

If you report a problem with an event, we store the event, the reason you selected, any details you write, and your optional email address if you provide it. We use this to verify and improve listings, and may contact you about the report if you gave an email address.

We use Vercel for hosting and Supabase for our database and image storage under data-processing agreements. Google provides sign-in. If you buy a business service, Stripe provides hosted checkout, subscriptions, tax handling, and invoices; Stripe receives the account and payment details needed for that purchase. The legal basis for billing is Art. 6(1)(b) GDPR and, where records must be retained, Art. 6(1)(c) GDPR. See Stripe's privacy policy.

The Oktoberfest guide contains a map loaded from OpenStreetMap. When it appears, your browser connects to OpenStreetMap's servers and sends normal request data such as your IP address and browser information. We use the map to make the guide useful (Art. 6(1)(f) GDPR). See the OpenStreetMap Foundation privacy policy.

Event listings and images are gathered from public third-party sources. Opening an organiser, venue, map, calendar, or ticket link takes you to a third party with its own policy. Where a service processes personal data outside the EEA, the provider must use an applicable legal transfer mechanism.

Account data is kept until you delete your account, after which it is removed, except for billing records we must retain by law. Analytics records older than 90 days are deleted automatically. Event issue reports are retained only while needed to verify and improve the affected listing; you can ask us to delete a report linked to your email address.

You may request access to, correction of, or deletion of your personal data, object to processing, and request portability. To exercise any of these, email privacy@munich-today.com. You also have the right to complain to a data protection authority.

We may update this policy as the product evolves. Material changes will be reflected in the "last updated" date above.