How RaveDragons handles your data across our website, shop, and mobile app (including crews, feeds, planner, member card and widgets), transparently and under GDPR (AVG).
Who we are
RaveDragons (KVK 42007416, BTW NL869257110B01), Maasdijk 169, 4827 MA Breda, Netherlands. Contact: info@ravedragons.com. We are the controller of your personal data within the meaning of the GDPR (AVG).
This policy covers our website, checkout, and the RaveDragons mobile app.
It does not cover RaveTickets (ravetickets.nl), our separate ticketing and event management site. That service has its own privacy information where applicable.
Personal data we collect
Website and shop
Order data: name, email, phone (optional), shipping address, ordered items, total amount.
Payment data: processed by Mollie B.V. We never see your full card or banking details.
Technical data: IP address, browser type, pages visited, only when you allow analytics cookies.
Communication: messages you send us and our replies.
Mobile app
Account data: email address, username, avatar, passcode hash, account creation date, dragon tier and claim status, and RaveDragons Card related data where enabled (such as points, balance and related wallet or challenge entries).
Community content: Live Festival Feed posts (photos, captions, tags), comments, likes, direct messages, friend requests, festival requests you submit, Find Your Crew / crew membership and names, crew map pins, crew group chat messages, raised-hand messages (the short intent text and the festival you attach), requests to join a raised hand and whether they were accepted or declined, reports you file, and moderation outcomes.
Crew map (optional): if you join or create a crew and choose to appear on the map, the App reads your device location only while you are viewing the crew map screen (not in the background), at most once every five minutes. We upload a map coordinate snapshot to our servers so other logged-in users can see your approximate position on the crew map. This is a last-known pin, not live tracking, others may see a position from when you last opened the map. Your exact street address is never stored. You can remove your pin at any time in App settings. Device location is also used locally to centre the map on your screen. The crew map's base map is provided by Mapbox; displaying it sends technical request data, including the map area you are viewing and your device IP address, from which an approximate location can be inferred, to Mapbox. To show the place name and current weather for the area you are looking at, the App also sends the coordinates of the map's centre (which you control by panning and zooming) to your device's mapping/geocoding service (Apple on iOS, Google on Android) and to Open-Meteo (a weather provider). These receive only a map coordinate, not your account details.
Ambient location for rave-buddy alerts (optional): separately from the crew map, if you grant location permission, the App may periodically send a precise coordinate to our servers while you are using the App (any screen), and — if you grant “Always” / background location permission — also while the App is in the background. We use this ambient presence only to decide whether you are within about 5 km of someone who raises a hand, so we can send you a nearby raised-hand push notification. Ambient location is not shown as your personal pin or avatar to other users on the crew map. Rows are overwritten as you move, ignored for matching once older than 24 hours, deleted automatically within 48 hours of your last update, and deleted when you sign out of the App or delete your account. Revoking location access stops further uploads. You can turn off nearby raised-hand notifications in Settings without turning off location permission; in that case we may still refresh ambient location for the matching system but will not send those pushes.
Rave buddies — Raise Hand (optional): when you “raise a hand” to find rave buddies for a festival, we share a short free-text message you write and the festival you select, together with your exact raise location shown as a precise pin on the map, with other logged-in users near you, and we may send them a push notification. Raising a hand is an explicit “come find me” action, so only raise a hand when you are comfortable sharing where you are on the map. If you are already sharing a live location on the crew map, that live position is used; if you are not, the App captures your device location at the moment you raise your hand. While your hand is raised, the App periodically checks your device location (roughly every 30 seconds, and only while the crew map is open in the foreground) so your search stays anchored to where you raised it; if you move more than 5 km from that spot, your hand is lowered automatically. The App stops that hand-anchoring check once you lower the hand or it expires (within 8 hours). Map discoverability (your raised-hand pin on the crew map) applies only while your hand is raised. Push matching may also use ambient location or crew-map live location for people who have not raised a hand (see Ambient location above). Other users near you can ask to join your raised hand, and you decide whether to accept. When someone asks, we show you their username, avatar and dragon rank together with how far away they were when they asked (rounded to the nearest kilometre), and we send you a push notification. We store that request — including the location the other person was at when they asked, which we use to place them on the map if you accept — and we keep a record of a declined request so that the same person cannot ask you again straight away. If you accept, the two of you form a crew — a persistent group with a shared name and group chat, of which you become the owner — and your hand can stay raised so you can accept more people into that crew until you lower it. If two people have each asked to join the other, the crew forms immediately. Crew data is handled as described in the Crew map and retention sections. You can lower your hand at any time, and you can turn off nearby raised-hand notifications in Settings.
Event activity: festivals you mark as attending or plan in Festival Planner, check-ins, passport memories, and wallet/challenge or Card entries where enabled.
Home screen widgets (optional): on supported devices, widgets may display festival countdown or timetable information derived from your account and festival data. Widget content is refreshed by the operating system using data we provide to the App; we do not receive a continuous live view of your home screen.
Device data: Expo push notification token, platform (iOS/Android), app version when registering for notifications.
Crash and error diagnostics: to find and fix bugs, the App sends error and crash reports to Sentry. These include the error and its technical stack trace, your device type and operating system, the app version, the screen you were on, and your account id and username. When an error occurs, Sentry may also capture a short recording of the app screens leading up to it; text and images in that recording are masked before it leaves your device. We do not record ordinary sessions where nothing goes wrong.
Permissions you grant: camera and photo library access when you choose to take or upload photos; Face ID / device biometrics are processed locally on your device for faster login and are not sent to our servers; location access when you use the crew map (see Crew map above), when ambient location for rave-buddy alerts is enabled (including background / “Always” location if you grant it — see Ambient location above), or when a map screen needs to centre on your position.
Maps (iOS and Android): the crew map is rendered using Mapbox on both iOS and Android; other map screens (such as Festival Planner, the festival map and event location previews) use Apple Maps on iOS and Google Maps on Android. When you open a map screen, the relevant map provider may process technical data needed to render the map.
Why we use your data and our legal basis
Contract (Art. 6(1)(b) GDPR): processing shop orders, shipping, after-sales support; providing App accounts, festival features, Festival Planner, RaveDragons Card features where enabled, home screen widgets, rave-buddy matching (Raise Hand), and crews.
Consent (Art. 6(1)(a) GDPR): optional analytics/marketing cookies on the website; push notifications (device permission); device location permission (including background / “Always” location where you grant it for ambient rave-buddy matching); non-essential marketing where applicable.
Legitimate interest (Art. 6(1)(f) GDPR): preventing fraud and abuse; securing our services; automated content moderation to keep the community safe; improving our products.
Automated moderation
Photos and text you submit in the App (posts, avatars, direct messages, crew chat) may be scanned automatically before publication or delivery using Amazon Rekognition and automated text checks. This helps detect illegal or prohibited content. If content is blocked, you will see a message in the App. Automated decisions do not permanently ban accounts without human review in serious cases.
How long we keep your data
Orders and invoices: 7 years (Dutch fiscal law).
App account and profile: until you delete your account, then erased without undue delay except where we must retain data by law.
Live Festival Feed posts: festival hub feeds are time-limited (typically open about 2 days before an event and close about 1 day after). When a feed closes, posts in that hub may no longer be available in the App. Direct messages and other non-hub content are kept until you delete them or delete your account, except where we must retain data by law. Deleting your account removes your posts, comments, direct messages and crew messages, except where we must retain data by law.
Crew data: crew membership, chat, and map pins are kept while the crew is active and you remain a member. If you leave, are removed, or delete your account, your membership and map pin are removed. If a crew is dissolved, crew chat and related data are deleted.
Raise hands: a raised hand stops being active and disappears from the map when you lower it, or automatically within 8 hours. The record itself — including the location you raised it from, the list of nearby members we notified, and any requests to join it together with the location each person was at when they asked — is deleted 7 days after it expires. If a hand has been reported, we keep it until moderators have finished reviewing the report. If a hand leads to a match, the resulting crew and its chat are kept as described under “Crew data” above. Reports you file are kept as needed for moderation.
Ambient location: overwritten as you move, so we hold one current position rather than a history. We use it for matching for up to 24 hours after it is recorded, and it is deleted automatically within 48 hours of your last update, as well as when you sign out of the App or delete your account. Not retained as a historical location trail.
Push tokens: until you sign out, disable notifications, or delete your account.
Transactional email records: our record of the automated emails we send you (such as order confirmations) is kept for 180 days.
Back office sign-in attempts: attempts to sign in to our administration system, including the email address used and the IP address, are kept for 90 days so we can detect unauthorised access. This is separate from signing in to the App, which we do not log in this way.
Marketing/analytics (website): no longer than 24 months and only with your consent.
Support messages: no longer than 12 months unless needed for an ongoing dispute.
Who we share data with
Payment: Mollie B.V., the Netherlands (website checkout).
Hosting and database: Vercel and Supabase (EU regions where available).
Live map positions: Upstash (short-lived storage of crew map positions, held for about 30 seconds).
Crash and error reporting: Sentry (diagnostics for app stability).
Content moderation: Amazon Web Services Rekognition (image analysis; EU region recommended).
Maps, geocoding and weather: Mapbox (crew map display, iOS and Android); Apple (iOS map display and place-name lookup) and Google (Android map display and place-name lookup); Open-Meteo (current weather for the map area you are viewing).
Shipping carriers used to deliver shop orders.
Authorities when legally required.
We never sell personal data.
International transfers
Where data is processed outside the EU/EEA (for example by Expo, AWS, Mapbox, Open-Meteo, Sentry, or Upstash depending on configuration), we rely on EU Standard Contractual Clauses or equivalent safeguards and limit transfers to what is necessary to provide the service.
Your rights
You have the right to access, rectify, erase, restrict, port, and object to processing of your personal data, and to withdraw consent at any time. You can delete your App account in Settings. Email info@ravedragons.com for other requests. You may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Age requirement
The App is for adults. You must be at least 18 to create an account, and we do not knowingly collect data from anyone under 18. Contact us if you believe an underage account exists and we will remove it.
Security
Connections are encrypted (HTTPS/TLS). Passwords and passcodes are stored hashed; sensitive secrets are stored only on the server. Database access is restricted to least-privilege service roles.
Changes
We may update this policy. Material changes will be communicated on the site or in the App.