Privacy Policy

1. Controller

Michael Scholz · MSc - IT Services
c/o IP-Management #11093 · Ludwig-Erhard-Strasse 18 · 20459 Hamburg · Germany
Email: info@reson.social

2. What data we process

We only process data that you actively provide to us or that arises technically when you use our services. This includes:

• Contact and registration data (e.g. email address)
• Profile information (e.g. username, display name, profile picture, music genres)
• Content you publish (posts, comments, images, reactions, messages in event groups)
• Activity data within the app (e.g. who you follow, which events you attend)
• Safety and moderation data (profiles you have blocked, reports you have submitted)
• A device identifier for push notifications, if you enable them (see section 6)
• Technical access and error data (e.g. IP address, time of access, crash reports — see section 7)

We do not pass your data on to third parties, except to carefully selected service providers we use to operate our platform technically. These are in particular:

• Supabase (backend, database & image storage; server location Frankfurt / EU)
• Vercel (hosting of this website)
• Resend (sending transactional emails, e.g. confirmations)
• Sentry (collection of technical error and crash reports; server location EU / Frankfurt)
• Expo, Apple (APNs) and Google (FCM) — solely to deliver push notifications, if you enable them
• Apple iTunes Search API (searching for song data; your search query is transmitted, but no account information)

These service providers process data exclusively on our behalf and are contractually bound to confidentiality (processing on behalf of a controller pursuant to Art. 28 GDPR). Where a provider processes data outside the EU, this takes place on the basis of appropriate safeguards pursuant to Art. 46 GDPR (e.g. EU standard contractual clauses).

3. Purpose & legal basis

Your data is used exclusively to provide and operate ResOn — that is, to display your profile, your feed and the social features of the platform, as well as for technical communication (e.g. confirmation emails).

Processing is based on your consent (Art. 6(1)(a) GDPR), on the performance of a contract (Art. 6(1)(b) GDPR) and on our legitimate interests in the secure technical operation of the platform (Art. 6(1)(f) GDPR).

4. Retention & account deletion

We store your data only for as long as necessary for the respective purpose — as a rule, for the duration of your membership.

You can delete your account at any time directly in the app. The process is deliberately two-staged:

• Immediately: Your account is deactivated and your profile can no longer be found or opened by other users.
• Within 30 days you can revoke the deletion by signing in again.
• After 30 days your account is processed permanently: your email address and access are removed, your profile is anonymised (display name “Deleted user”; username, bio and genres are deleted), and your profile picture as well as all images you uploaded are deleted from storage. Your follower relationships, reactions, event attendances, notifications and blocks are deleted as well.
• Retained are your posts and comments in anonymised form (shown as “Deleted user”), so that discussions remain comprehensible for other users. They can no longer be traced back to you.

Statutory retention obligations remain unaffected.

5. Cookies

This website does not use tracking, analytics or advertising cookies. For reach measurement we use a cookieless method (see section 11). Fonts are delivered locally from our own server (no external CDN), so that simply visiting the website does not transmit any personal data to third parties. Only technically necessary cookies are used.

6. Push notifications

If you allow push notifications, a technical identifier (push token) is generated for your device and linked to your account. It is used solely to deliver notifications about activities that concern you — for example new followers, comments or group invitations. Delivery takes place technically via Expo and the services of Apple (APNs) or Google (FCM).

You can disable push notifications at any time in your device settings. The identifier is removed when you sign out and when you delete your account. The legal basis is your consent (Art. 6(1)(a) GDPR).

7. Error and crash reports

To detect and fix errors in the app we use Sentry. If an error occurs, technical information is transmitted: the error message, the affected part of the program, the app version as well as device type and operating system version. In addition we transmit your user identifier (a random ID) — but not your email address or your name — so that we can tell whether a problem affects individual accounts or all users.

Processing takes place on servers in the EU. The transmission of additional personal data such as the IP address is disabled in our configuration. The legal basis is our legitimate interest in the stable and secure operation of the app (Art. 6(1)(f) GDPR).

8. Blocking & reporting

If you block another profile, we store that relation so that their content is hidden from you. If you report content, we store the report together with a reference to the reported content in order to review it. This data serves solely the safety of the platform and is not published. The legal basis is our legitimate interest in a safe platform as well as compliance with legal obligations (Art. 6(1)(c) and (f) GDPR).

9. No automated decision-making

We do not use profiling or automated decision-making within the meaning of Art. 22 GDPR.

10. Your rights

You have the right to information, rectification, erasure, restriction of processing and data portability, as well as the right to object to the processing of your data. Please contact info@reson.social at any time.

You also have the right to lodge a complaint with the competent data protection supervisory authority. For Baden-Württemberg this is the State Commissioner for Data Protection and Freedom of Information (LfDI BW): www.baden-wuerttemberg.datenschutz.de

11. Reach measurement

For the statistical analysis of website usage we use Vercel Web Analytics (Vercel Inc.). Only aggregated, anonymous usage data is collected (e.g. pages viewed, approximate origin, device and browser type). No cookies are set and no cross-device identifiers are created; individual persons are not identifiable by us. The legal basis is our legitimate interest in a statistical evaluation and improvement of our service (Art. 6(1)(f) GDPR).

12. Affiliate and partner links

The app and this website contain links to third-party providers through which you can book tickets (e.g. Eventim, Ticketmaster, Reservix) or accommodation (via the intermediary Stay22, which aggregates Booking.com, Expedia, Kayak and others). Some of these are affiliate links: if you complete a booking with the provider after clicking, we may receive a commission — at no extra cost to you. Clicking redirects you to the respective provider's site; from that point their privacy policy applies, and any data processed there (e.g. IP address) is their responsibility. We do not embed any of these providers' tracking scripts or cookies on our own pages.

13. Changes

We reserve the right to update this privacy policy as required. You can always find the current version at reson.social/en/privacy.html.

Last updated: July 2026

This is an English courtesy translation. In case of discrepancies, the German version prevails.