This notice last changed on
Who is responsible for your data?
FDE Club, in Geneva, Switzerland, is responsible for the personal data this site holds. It is the operator named in the imprint.
Write to hello@fdeclub.ch about anything in this notice.
What does the club hold, and why?
Only what the table lists. The club asks for no special category data, and it sends no member data to analytics, to image generation services or to any provider that this notice does not name.
| About | What | Why |
|---|---|---|
| Visitors | A count of page views on public pages, with no cookie and no profile. The host keeps short technical logs of requests. | To see which pages are read, and to keep the site running. |
| Visitors who say yes to measurement | Visits to public pages as Google records them, with cookies that tell one browser from another, and whether a visit led to a started application, a sent application or a newsletter sign-up. The club sends Google the name of that step and nothing about you. | To see which pages are read and what a campaign brought. Only with your consent. |
| Accounts | Your email address, how you signed in, the account id that GitHub or LinkedIn gives when you use one of them, and for a passkey a public key and a credential id. Each session with its start time, its browser name and a keyed hash of its network address. | To sign you in and to show you where you are signed in. |
| Applications | What you enter: name, role, employer, a note about your work, links, canton and city, where you are on the path into the role, your listing choice and your consents. | So that a person can decide on your membership. |
| Members | Your profile as you write it, your listing switches, an optional photograph, your member number and the day you joined. | To show other members what you choose to show. |
| Application hints | If you confirm a work email address: its domain and the day you confirmed it. The address itself is not kept. If you came through a member's invite link: which member invited you. | As hints for the person who reads your application. A person still decides. |
| Meetups | A registration for a meetup, its state and whether you attended. | To plan a room with a limited number of places. |
| Talk proposals | What you send with the speak form: your name, your email address, what you would talk about, and your company if you give it. | To plan talks. Only the organisers read a proposal, and no automatic email is sent to the address in it. |
| Lists | Your email address, the list and the time you confirmed. | To send you what you asked for. Every message has an unsubscribe link. |
| Mail to the club | What you write to the club address. | To answer you. |
| Logs | Who opened which member record and when, what an organiser changed, and which emails were sent to you, without their text. | So that the club can show you who opened your record, and can prove what it did. |
Is member data used for recruitment?
No. Member data is never used for recruitment, by the organisers or anyone else. The terms of membership say the same.
Who decides on an application?
A person makes every membership decision. Hints that the site shows to a reviewer are hints, and no decision is automated.
Can I see who opened my record?
Yes. Every time an organiser opens your application or your member record, it is logged. Your privacy settings show who opened it, what they opened and when.
What does the club store for a passkey?
The biometric check happens on your device. We store a public key and a credential id. There is no password anywhere on this site.
Does the club store my IP address?
Only as a keyed hash, never as the address itself. A hash of this kind is still personal data, and the club treats it as such.
Who else processes the data?
The providers in the table, each under a contract that binds it to the club's instructions. The site and its database are hosted in the European Union.
| Provider | What it does | Where |
|---|---|---|
| Vercel | Hosts the site and runs its functions. Counts page views on public pages, with no cookie. | Frankfurt, Germany |
| Neon | Holds the database. | Frankfurt, Germany |
| Resend | Sends sign-in codes, account mail and list mail. | Ireland |
| Measures visits to public pages and the result of campaigns, with cookies, and only after you say yes in the prompt. | Worldwide, including the United States | |
| Cloudflare | Answers name lookups for the domain and forwards mail sent to the club address to the mailbox where a person reads it. It sees no page request. | Worldwide network |
| A backup store | Holds backups of the database. They are encrypted before they leave the site, and the store cannot read them. | Switzerland or the European Union |
| GitHub or LinkedIn | Confirms who you are, only when you choose to sign in with one of them. | United States |
Where a provider is owned by a company in the United States, the club relies on that provider's certification under the Swiss-US Data Privacy Framework, or on standard contractual clauses with the Swiss addendum.
How long is it kept?
For the periods in the table, and no longer.
| Data | Kept for |
|---|---|
| An account with no application | 30 days after the last sign-in, with one notice by email 7 days before |
| An account started with a passkey whose email was never confirmed | 24 hours |
| A draft application that was never submitted | 60 days after the last edit |
| A declined application | 6 months, then deleted |
| Member data | Until you delete your account. It is then gone within 30 days, backups included |
| Meetup registrations and attendance | 24 months, then kept as a count with no person |
| A talk proposal | While it is open or accepted. Once it is declined or archived, 6 months, then deleted |
| Consent records | While the consent stands, then 12 months |
| The list of addresses that asked not to be contacted | Until the person asks for removal. A keyed hash of the address only |
| Records of emails sent | 12 months. No message text is kept |
| The log of who opened your record | While you have an account |
| The audit log and data requests | 24 months. Ids and field names only |
| The error log | 30 days |
| Expired sessions, sign-in codes and rate limit rows | Deleted daily |
| Backups outside the host | 30 days, encrypted |
What are my rights, and how do I use them?
You can see, correct, export and delete what the club holds about you, and you can withdraw a consent at any time. Most of it needs no request: your account settings export everything the club holds about you except reviewers' notes, change each consent, and delete your account.
For anything else, or if you have no account, write to hello@fdeclub.ch. A person answers within 30 days. You can also complain to the Federal Data Protection and Information Commissioner.
Which cookies does the site set?
Only the ones the table lists. All but the cookies of Google Analytics are needed for the site to work, and are set without asking. The cookies of Google Analytics are set only after you say yes in the prompt on a public page.
| What | Kind | Why |
|---|---|---|
| The session | Cookie | Keeps you signed in. |
| The sign-in hint | Cookie | Lets a public page show the link to the app. It holds no personal data. |
| The last sign-in method | Cookie | Offers the method you used last time first. |
| Sign-in with GitHub or LinkedIn | Cookies that last a few minutes | Tie the answer of the provider to the browser that asked. |
| The sign-in code | A cookie that lasts 10 minutes | Ties a sign-in code to the browser that asked for it. |
| An invitation | A cookie that lasts 7 days | Remembers which member invited you until you apply. |
| The shortcut preference | Local storage | Remembers that you switched keyboard shortcuts off. It holds no personal data. |
| The passkey offer | Local storage | Remembers that this device was already offered a passkey. It holds no personal data. |
| The intro | Session storage | Remembers that the opening animation was shown. It is gone when the tab closes. |
| Your measurement choice | Local storage | Remembers your yes or no to measurement by Google, so that you are asked once. It holds no personal data and is never sent to the club. |
| Steps waiting to be counted | Local storage, only after your yes | Holds the name of a step, such as a sent application, until a public page can report it. It holds no personal data. |
| Google Analytics | Cookies whose names start with _ga, only after your yes | Tell one browser from another, so that Google can count visits to public pages. Not needed for the site to work. |
How are visits counted?
Public pages also count page views with the web analytics of the host, Vercel. It sets no cookie and builds no profile, and its script is served through the club's own domain. A page is counted by its address without the query, and no member data is sent with it. It never loads on a sign-in, account, member or admin page. A Global Privacy Control or Do Not Track signal switches it off for your browser.
The steps of the application form are counted on the club's own server, as totals per day with no identifier of any kind.
With your consent, public pages also load a tag from Google that measures visits and the result of campaigns. Nothing loads until you say yes in the prompt, and a Global Privacy Control signal counts as a no. No member data is sent with it, and it never loads on a sign-in, account, member or admin page.
You can change your answer at any time with "Measurement choice" at the foot of every public page. A no after a yes switches measurement off and deletes the cookies that Google set.
What is the policy on photographs and recordings?
A meetup is photographed only with notice at registration and at the door, and you can opt out there. No photograph is published with a name without that person's consent. A talk is recorded only when the speaker has agreed in writing.
To have a photograph taken down, write to hello@fdeclub.ch. It is removed within two working days.
Does this notice change?
When it does, the date at the top of the page changes with it, and the changelog says what changed.