Privacy Policy

Who we are

SerbLink is registered in Toronto, Ontario, Canada, and is the controller of the personal information described here. You can reach us at contact@serblink.org.

What this covers

This policy covers the SerbLink website at serblink.org and the SerbLink apps for iPhone, iPad, Apple Watch, and Android. It does not cover other websites we link to.

Browsing without an account

You can browse events and the Orthodox calendar without signing in, and we do not ask you to create an account to read anything. You only need an account to reserve a place at an event and to keep your tickets.

What we collect

We collect only what the app needs in order to work:

• Your account: your name and email address, and the sign-in identifier from Google if you sign in with a Google account. Sign-in itself is handled by Firebase Authentication, which stores your password if you use one — we never see it.
• Your preferences: the topics and the starting surface you pick, and the city you choose or allow us to derive from your device's location. Coordinates are sent to Google's Geocoding service to turn them into a city name; we store the city, not the coordinates.
• Events and tickets: the events you reserve a place at, and the tickets issued to you. Card payments are processed by Stripe and card numbers never reach our servers.
• Push notifications: if you turn them on, a device token that lets us send notifications to that device, together with the platform it runs on.
• Technical data: your IP address, browser or device type, and the pages you opened when something goes wrong. This reaches our error-monitoring provider, Sentry, which also records a sample of browsing sessions on the website so we can see how a fault happened.

Those session recordings capture what happens on the page — what you click and how you move through it. They are taken from a small share of visits and from visits where an error occurs. They are used to diagnose faults, never to build a profile of you or to sell anything.

Cookies

We use a small number of first-party cookies, and none of them are for advertising:

• A session cookie that keeps you signed in. It is readable only by the server, expires after a day, and is deleted when you sign out.
• A small cookie that remembers you dismissed the preferences banner, so it does not follow you around the site.

We do not use advertising cookies, and we do not run Google Analytics or any similar third-party tracker.

How we use it

We use your information to:

• Run the service: sign you in, show you events, issue and check your tickets.
• Show you what is relevant: events near the city you chose, and the topics you picked.
• Send you what you asked for: confirmations for your tickets, and notifications if you turned them on.
• Keep it working: find and fix faults, and protect the service from abuse.

Our legal basis

If you are in the European Economic Area or the United Kingdom, we rely on: performing our agreement with you, for your account and your tickets; your consent, for push notifications and for using your device's location; and our legitimate interest in a service that works and is not abused, for error monitoring and security. You can withdraw consent at any time without affecting what came before.

Who we share it with

We do not sell your personal information and we do not share it for advertising. We do rely on a small number of providers who process it on our behalf:

• Google, through Firebase Authentication, for signing in, and through the Geocoding service for turning coordinates into a city name.
• Stripe, for card payments where an event charges for entry.
• Sentry, for error monitoring and the session recordings described above.
• Firebase Cloud Messaging and Apple, for delivering notifications to your device.

The Orthodox calendar is served by Orthodox Atlas, a separate project of ours, at api.orthodoxatlas.org. Reading the calendar sends no account information of yours to it.

We may also disclose information where the law requires it, or to protect our rights and the safety of others.

Where your information goes

We operate from Canada, and the providers above are based in the United States. Your information is therefore transferred outside the European Economic Area. Those transfers rely on the European Commission's standard contractual clauses, or on an adequacy decision where one applies.

How long we keep it

We keep your account information for as long as your account exists. Delete your account and we erase it — your name, your email address, everything you told us about yourself, your preferences, and the devices you were notified on. Your username is not released, so nobody else can claim it. Records of tickets and payments are kept longer where accounting and tax rules require it. Error reports and session recordings are kept for a limited period and then discarded.

Your rights

You can ask us to:

• Give you a copy of the information we hold about you.
• Correct anything that is wrong.
• Delete your account and the information that goes with it.
• Stop using your information for a particular purpose, or restrict how we use it.
• Send you your information in a portable format.

Write to contact@serblink.org and we will answer within one month. If you are in the European Economic Area or the United Kingdom you may also complain to your national data protection authority; if you are in Canada, to the Office of the Privacy Commissioner of Canada.

Children

SerbLink is not intended for children under 13, and we do not knowingly collect their information. If you believe a child has given us personal information, write to us and we will delete it.

Keeping it safe

Traffic to SerbLink is encrypted in transit, your session cookie cannot be read by scripts in your browser, and passwords are held by Firebase rather than by us. No service can promise perfect security, but we take this seriously and fix what we find.

Changes to this policy

When this policy changes we update the date at the top of the page, and we tell you in the app if the change is a significant one.

Contact us

Questions about this policy, or about your information, go to contact@serblink.org.