Privacy

Do Today is operated by We make AI work s.r.o., ID No. (IČO) 29697115, registered office Nové sady 988/2, Staré Brno, 602 00 Brno, Czech Republic, registered in the Commercial Register kept by the Regional Court in Brno, Section C, Insert 152497. Contact: service@dotoday.eu. We are the data controller for everything described below. We have not appointed a data protection officer; service@dotoday.eu reaches the person accountable.

Without an account: nothing that identifies you. We count calendar views as a daily total per country — no cookie, no IP address, no per-visitor record. With an account: your email address, your password stored only as a salted PBKDF2 hash (we cannot read it), optionally a separate "calendar email" you choose for invites, the events you favourite, and a session token. If you suggest a town we store your suggestion and, if you give one, an email to reply to. If something breaks we log the error message, the page path and a request id; email addresses and long digit strings are stripped from those logs automatically.

We use your email and password to run your account and let you log in — that is performance of our contract with you (Art. 6(1)(b) GDPR). We send calendar invites to the address you chose, because you asked us to, each time you favourite an event — also contract. We keep aggregate view counts and error logs to keep the service working and secure, which is our legitimate interest (Art. 6(1)(f)); neither identifies you. We do not profile you, we do not advertise to you, and we never sell or share your data for anyone else's marketing.

Account data stays until you delete your account or ask us to delete it; you can do it yourself from the account page, and it removes your email, favourites and sessions immediately. Session tokens expire after 30 days, are deleted when you log out, and expired ones are swept hourly. Error logs are kept for 90 days and then deleted automatically. Aggregate view counts contain no personal data and are kept indefinitely.

Scaleway hosts the site and stores the database. Scaleway TEM delivers the emails we send you. DeepL translates event titles — it receives event titles only, never anything about you. OpenStreetMap serves the map tiles — when you open the map view your browser fetches them directly, so they see your IP address and the area you are looking at, and nothing else about you; open no map and they are never contacted. If you click a partner link (accommodation or ticketing) you leave our site and that company's own privacy policy applies from that click on. These providers act on our instructions under data processing agreements; where processing happens outside the EEA it is covered by the European Commission's standard contractual clauses.

You can ask us for a copy of your data, correct it, have it deleted, restrict or object to how we use it, and receive it in a portable format. Write to service@dotoday.eu; we answer within one month. If you are not satisfied you can complain to your local data protection authority, or in our case to Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7 (uoou.gov.cz).

One essential cookie when you log in, plus a few preferences stored locally in your browser (your language, your country, your consent choices). No advertising cookies, no analytics cookies, no third-party trackers. The Cookies page lists every single one and lets you change your choices.

Traffic is encrypted in transit, passwords are hashed and never stored in readable form, and the session cookie is HttpOnly, Secure and SameSite-restricted. If a breach ever puts you at risk we will tell you and the authority within the deadlines the law sets. We update this notice whenever what we collect changes, in the same release as the change itself. Questions: service@dotoday.eu.