Privacy

1. Controller

Email: emonight.bs@gmail.com

The association's full designation is in the imprint.

2. Principle

This website sets no cookies, uses no analytics or tracking services and loads no fonts, scripts or styles from anybody else's server; it embeds no third-party content either. The fonts are served from our own machine. For the song wishes we store a random number in your browser, but only once you first wish for a song or vote (clauses 3 and 4). It serves only to tell your vote apart from those of other devices on the same internet connection, and nothing else. If you do not want that, do not wish or vote; everything else on this site works without it. It is not a cookie either, which is why there is no cookie banner here.

3. What is stored in your browser

On the public pages four values are stored: three in your browser's local storage and one in its session storage. The first is emonight.lang — the language you chose (de, fr, it or en). It is purely functional, contains nothing personal, is never sent to the server, and disappears as soon as you clear this site's data in your browser. The second is emonight.cart — your cart, once you put something in it: which articles, in which colour and size, how many, the delivery country you chose and, once you go on to pay, the number of the last order. Unlike the language, the articles and the delivery country are sent to our server so that it can check the prices and work out the shipping cost to the chosen country; the order number is not sent along and serves only to empty exactly this cart once the payment is confirmed. It disappears when you empty the cart, once the payment for this order is confirmed, or when you clear this site's data. The third is emonight.checkout — what you type at the checkout: your name, e-mail address and delivery address, as you type them; your acceptance of the terms is not part of it. It lives in session storage, applies to this tab only and goes with it, so that the form is filled in again if you come back without paying. We delete it once the payment for this order is confirmed; these details reach our server only with the order itself. The fourth is emonight.voter — a random number of 32 characters, created only once you first wish for a song or vote. It lives in local storage, is sent to our server only with song wishes and votes, and is neither stored nor logged there (clause 4). It disappears when you clear this site's data; your browser then counts as a new device. If your browser does not allow local storage, the number lasts only while the page is open. Anybody who signs in as a crew member also has the token of clause 8 in their browser's session storage; it ends with the session.

4. Song wishes and votes — your IP address is not stored

Your IP address is not stored, and neither is the random number of clause 3. With a random key that changes every day, we combine the two into one hash (HMAC-SHA256) that stands for your device on that day, and the IP address alone into a second hash that counts only towards the limit per internet connection. If no valid random number comes along, the IP address alone stands for the device. Only these opaque values and the date they belong to are stored, together with the wish or the vote.

When you search for a song, we send only your search words to MusicBrainz (MetaBrainz Foundation, USA) to find matching songs — from our server, not from your browser. We do not pass on your IP address, and we neither store nor log the search words.

The day's key lives in the database for that one day and is deleted at the turn of the day (Swiss date). After that nobody can recompute the previous day's values any more, ourselves included. While the day's key exists, one of today's values could be computed back to an IP address — whoever holds the database could do that. We do not, and after the turn of the day nobody can.

Purpose and basis: abuse prevention. You have one credit a day per device: either you wish for a song — the wish counts as your vote at the same time — or you vote for a wish that is already there. If you take your vote back, the vote credit comes back to you; the right to a second wish of your own on the same day does not. On one and the same internet connection, at most 50 votes count per day; a vote taken back frees its place again.

In fairness, this comes with it: people sharing one connection — a club wifi, a mobile network — each have their own vote per device, but together they have at most 50 votes a day. Clearing this site's data or opening a second browser counts as one more device; the limit still applies.

Retention: the votes stay, because they are the public ranking – unless the crew deletes the night they belong to, or removes a single wish: the wishes concerned and all their votes then disappear. If the crew merges two wishes, no vote is lost; it then counts for the wish that remains. Their values are worth nothing once the day's key is deleted, and at the turn of the day we also remove the value used for the limit from past days' votes. The markers of past days, which record that a wish had already been made that day, are deleted – including when the night is deleted.

5. Newsletter and helper sign-up

For a newsletter sign-up we store: the email address, the first name if you give one, the language you chose, the moment of your consent, a random unsubscribe key, a "do not contact" marker together with the moment it was set, and the moment the entry was created and last changed. Nothing else.

For a helper sign-up we store: the name, the email address, the language you chose, a random unsubscribe key, a "do not contact" marker together with the moment it was set, and the moment the entry was created and last changed. There is no consent tick box on that entry, and we therefore store no moment of consent for it either: the basis is your own offer to help.

Purpose: to tell you about the next night, and to reach you when we are looking for helpers. Signing up to the newsletter again with an address that is already active on the list changes nothing about that entry; offering to help again creates one more entry every time, because the crew wants to see every offer. Both are answered exactly like a first sign-up — so the form tells nobody who is on the list.

We never lift the "do not contact" marker ourselves, and the two lists are separate: a marker on the newsletter list does not apply to the helper list, or the other way round. On the newsletter list it is lifted when you sign up again with your consent, or by the crew at your request. On the helper list only the crew lifts it, at your request: offering to help again does not lift it, and the new entry carries the marker from the start. So there too, no sign-up reveals whether anything was already stored for that address.

The crew can download both lists as a spreadsheet file (CSV). It holds the same details as above, without the unsubscribe key. That is a copy of your data outside this website; no other service is involved in it.

Removal: write to the contact address in clause 1. The crew can delete an entry for good — the address, its history and any "do not contact" marker are then gone, and a later sign-up is a new entry with no past.

6. Email — not active yet

At the moment we send no email at all: sign-ups are only stored. When we start, sending will go through Resend (Resend Inc.) as a processor. We name the service now, marked as not yet active, so that this text does not have to be corrected after the fact — and so that clause 5 is not read as the promise of a confirmation email.

7. Server logs and abuse prevention

The hosting platform and the application see your IP address for the duration of a request. For abuse prevention there are four counters per address: at most five sign-ups an hour, at most ten moves to payment in ten minutes, a limit on the requests for which we have to ask Printful, and a general limit on requests. All four hold the address in memory only, for at most the length of one window; none of them ever writes it to the database or to a log. A restart forgets them.

8. Login for the crew

The organisers have an account area. What is stored: an email address, a name, a role (crew or admin), whether the account is active and whether the password still has to be changed, a password stored only as a hash, and a token in the browser for the length of the session, six hours at most. No time of a last sign-in is stored. The crew creates, changes and deactivates these accounts itself — they are not deleted; the first admin account is created from the configuration at start-up. There are no visitor accounts and none can be created.

9. Hosting

The site runs on Fly.io, in a data centre in Amsterdam (Netherlands, EU). The database is a file on a volume in that data centre. Apart from the services named in this text, the data does not leave it.

10. External offerings

Clicking "Tickets" takes you to an external ticket provider that differs from night to night; clicking "Photos" takes you to an external gallery. From that moment the operator of that site is responsible, under its own privacy policy. We transmit nothing to them ourselves and receive nothing back.

11. Orders in the shop

You enter your name, your e-mail address and your delivery address on our own checkout page, before you go to payment; we do not ask for a phone number. With «Continue to payment» we create an order. It holds these details, the items with colour, size, price and quantity, the amounts, the delivery country, the language, the order number and the moment you accepted the terms and conditions. SumUp receives only the amount and the order number from it. When SumUp confirms your payment to us, we also store the type of payment method and the payment’s references at SumUp. From Printful we store the order number, the state of the order and the tracking number. Every order has a history (paid, sent to Printful, shipped …); it contains neither your address nor your e-mail address.

Purpose: to have the order made and delivered, to answer questions and complaints, to carry out refunds and to keep our books. The crew sees the orders in its account area (section 8).

Retention: we delete your e-mail address and your delivery address 90 days after the order, once the order is finished – shipped, refunded or cancelled by Printful. An order that is not finished by then keeps these details until it is. We keep your name, the order number and the amounts for ten years from the order for our books; after that the whole order is deleted. An order that is not paid holds your details from before the payment. So we delete your name, your e-mail address and your delivery address as soon as SumUp tells us that the payment failed or the payment page expired – it stays open for 30 minutes – and the order itself at the next run of our deletion. If SumUp tells us nothing, we delete the whole order at the first run of our deletion after it has turned seven days old, at the latest. That deletion runs whenever our server starts and every 24 hours after that; because the server rests while nobody needs it, this can also be later.

12. Payment through SumUp

Payment is by card through the payment service SumUp. The payment page is a page of SumUp’s, at SumUp’s own web address; on emonight.ch no SumUp script is loaded and no SumUp cookie is set. You enter your card details on the payment page, directly with SumUp. From us, SumUp receives only the amount and the order number (section 11). According to its own privacy policy, SumUp processes the payment data under its own responsibility, to carry out the payment, to prevent fraud and to meet legal obligations. What SumUp collects on its page, and where it processes these data, is governed by SumUp’s privacy policy.

13. Production and shipping by Printful

Your order is made and shipped by Printful. For this, once the payment is confirmed, we send Printful your name, your e-mail address, your delivery address and the items ordered. Printful processes these data on our behalf (as our processor) and e-mails you the tracking number. Printful itself chooses the production site where your items are made.

14. Transfer to the United States

Printful is a company based in the United States (Printful Inc.); your data may therefore be processed in the United States. Printful keeps its own copies of your data under its own privacy rules; the periods in section 11 apply to the data held by us, not to those copies.

15. Your rights

You have the right to information, correction, deletion and objection. Write to the contact address in clause 1.

One limit, said openly: here a wish or a vote is tied only to the opaque values of clause 4, not to a person. So we can neither reliably show you an individual entry nor delete one individually; once the day's key is deleted nobody can — which is exactly the point of this design.

16. Changes

The current version applies. The date at the top of this page says which one that is.