TodoWeekend.

Privacy Policy.

Short version: we collect very little, we use privacy-preserving analytics to understand traffic, we don't run ads, and we don't sell or share your data. Long version is below.

What we collect

TodoWeekend is read-only for most visitors. You can browse the map, event pages, editor's picks, and category lists without submitting any personal data. What is collected on every page load:

  • Aggregate analytics (Google Analytics 4 + Google Tag Manager). Page views, scroll depth, click events, city and locale dimensions. IP anonymization on, no advertising features, no Google Signals. See our Cookie Policy for full detail.
  • Web vitals (Vercel Analytics). Cookieless page view counts and Core Web Vitals (LCP, INP, CLS). Aggregated at the edge, no identifying cookie.
  • Map tile requests (CARTO).The map loads vector tiles from CARTO's CDN on every city page; your IP is visible to CARTO as part of the HTTP request.
  • Server-side request logs (Vercel).Standard web-server logs — request URL, timestamp, user-agent, IP address — rotated on Vercel's infrastructure schedule.

In addition, we collect identifying personal data in two places only:

  • Newsletter signups. When you enter an email address and submit the newsletter form, we store: your email, the time of signup, your user-agent, and a short hash of your IP (not the raw IP). The hash is used to detect abuse only.
  • Plan builder.When you describe what you want in the plan builder form, your prompt is sent to Anthropic's Claude API to generate a plan. We don't store the prompt or the generated plan on our side.

We do not run advertising, sell data, or build audiences. A proper consent banner with per-category toggles is in active development; until it ships, the bottom-left notice discloses what's tracked.

We do not scrape personal data about event attendees or organizers. Our ingest pipeline only collects event metadata — names, dates, venues, prices, public descriptions. Where a source incidentally exposes a phone or personal email for an organizer, we strip it before storing.

Why we collect it

The newsletter list exists to send you one email per week with our editor's picks. That's the entire purpose. We don't sell, rent, or share the list with anyone else, ever.

Plan builder prompts are sent to Anthropic because Claude generates the itineraries. Anthropic's privacy policy covers what they do with the data. By default, Anthropic does not train models on API traffic.

Who we share it with

We use a small set of infrastructure and analytics providers. Your data is technically processed by them when you use the site:

  • Vercel (hosting + Vercel Analytics) — request logs, may include your IP address transiently; aggregate web vitals. Privacy policy.
  • Google(Google Analytics 4 + Google Tag Manager) — aggregate traffic analytics. Processed in the US under Google's Standard Contractual Clauses. Privacy policy.
  • CARTO (basemap tiles) — receives your IP as part of the HTTP request when the map loads. No event, bookmark or identifying data is sent. Privacy policy.
  • Supabase (database) — stores newsletter signups and the event catalog. Privacy policy.
  • Anthropic (plan builder) — receives your plan prompt to generate the itinerary. Privacy policy.
  • Resend (email delivery) — handles newsletter welcome emails and subscription notifications. Privacy policy.
  • Cloudflare (DNS, CDN for event images) — routes traffic to our servers. Privacy policy.

Your rights under GDPR

If you're in the EU (including Spain, where we operate), you have the right to:

  • Access the personal data we hold about you.
  • Ask us to correct or delete it.
  • Withdraw consent (one-click unsubscribe on every newsletter email).
  • Port your data to another service.
  • Lodge a complaint with the Spanish data protection authority (AEPD).

To exercise any of these, email hello@todoweekend.com or use the data subject request form. We aim to respond within 7 days and in any case within the one-month statutory ceiling under GDPR Article 12.

How long we keep it

Newsletter emails are kept until you unsubscribe. After unsubscribe, your email is deleted from our active database within 30 days. Abuse-hash IPs are purged every 90 days. Server access logs are rotated by Vercel on their own schedule.

Changes to this policy

If we change anything material, we'll note it at the top of this page with a new “last updated” date. For significant changes that affect subscribers, we'll also announce it in the newsletter before the change takes effect.

Rights holders & takedowns

If you're a venue, artist, organizer, or rights holder and you see something on TodoWeekend that shouldn't be there, email us. We remove content within 48 hours, no legal letter required. Full policy on the Sources page.

Contact

Privacy questions, deletion requests, anything else: hello@todoweekend.com.