Privacy policy

Who we are

What2Do is made by Vagabonder. This policy covers the website what2do.lol, including the pages people open from links shared in the app.

The data controller is Vagabonder, Belgium, VAT BE 0745.714.422.

The waitlist

When you join the waitlist we store what you type and a little context, so we can email you once when What2Do opens near you:

• your email address
• whether you are on iPhone or Android
• the language of the page
• which page you signed up on

First we email you a link to confirm; only when you click it do you join the waitlist. We use your address only for that launch email and delete it when you ask. Our email provider Resend (Resend, Inc., USA) sends these emails and keeps the list for us, as our processor. Legal basis: your consent, which you can withdraw at any time.

RSVPs to plans

When you answer a plan invite without the app, we store the name you enter and your answer (going, maybe or can't) and pass them to the host of that plan.

We keep it as long as the plan exists in the app. Legal basis: taking the step you asked for (telling the host).

Contact forms

If you write to us through a form, your name, email and message reach our inbox as an email sent through Resend. We use them to answer you and keep them as long as the conversation needs.

Server logs

Our server logs each request's time, method, page path and result, to keep the site running and secure. These logs contain no IP addresses, query strings or browser details.

To stop abuse, the server keeps the requesting IP address in memory for a few minutes when you submit a form. It is never written to disk. Our hosting provider may keep its own security logs.

Cookies and local storage

We don't use tracking, advertising or analytics cookies. We only store:

• your language choice, if you pick one (cookie, one year)
• that you dismissed the language suggestion (cookie, one year)
• your light or dark theme choice (in your browser's local storage)

Who else sees it

We don't sell your data and we don't share it for advertising.

We use service providers for hosting and for email (Resend), bound by data processing agreements. Where data leaves the EU, it is protected by an adequacy decision or the EU's standard contractual clauses. A plan's host sees the RSVPs to their plan.

Your rights

You can ask us at any time to:

• see the data we have about you
• correct it
• delete it
• stop using it, or take it with you
• withdraw your consent

You can also complain to your local data protection authority.

Children

What2Do is for people aged 16 and over. We don't knowingly collect data from younger children.

Changes

If this policy changes, we update this page and the date at the top.