Legal

What: Your email address, date of birth (to confirm you are at least 18), and a password stored only in hashed form — we never store your password as plain text. If you sign in with Google, we also store the stable identifier Google assigns to your Google account, and we use the email address and, where your Google account shares one, the date of birth that Google provides. An account created via Google sign-in has no password unless you later set one. We never receive or store your Google password. We also store which in-app tips you have dismissed, so they are not shown to you again on any device, and the language you have selected for belongi (English or German), so that emails and notifications are sent to you in that language.

Why: To create and manage your account — sign-in (by password or via Google), age eligibility, verification, password reset, and support.

belongi's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Legal basis: Performance of a contract (Article 6(1)(b) GDPR).

Kept for: As long as your account is active. If you delete your account yourself, a one-way hash of your email is retained for 30 days to prevent immediate re-registration, then removed; your live email address is removed from your account record immediately, and the account record itself is permanently deleted 30 days later. If you don't sign in for 1 month, we'll send a one-time email to your registered address letting you know your account will be deleted after 2 months of inactivity unless you sign in again — in that case, once 2 months of inactivity is reached, your account and all associated data are permanently deleted immediately, with no 30-day grace period (a one-way hash of your email is still retained for 30 days to prevent immediate re-registration).

What: Username, optional nickname, chosen preset avatar (illustration — not a photo of you), avatar background colour, gender, personality type, bio, interest tags you select, and the languages you speak.

Why: To match you with relevant hangouts and other users, to show a consistent identity in the app, and to ensure you and a hangout's participants share at least one common language. We also use it to determine which notifications about new hangouts and partner events are sent to you, by comparing your gender, age and languages with the criteria of the hangout or event.

Who can see it: Your profile is only visible to people you share a hangout with — specifically, other members who matched into that same hangout based on shared interests with its organiser — or people you are friends with (see section 3i). For 7 days after a hangout ends, its participants can still view each other's profiles (see section 3o). It is never visible to unrelated users browsing the app. Your nickname is visible only to your friends, never to anyone else.

Legal basis: Performance of a contract (Article 6(1)(b) GDPR).

Kept for: As long as your account is active. Deleted when you delete your account.

What: IP address and browser type are logged only when a request errors or is rate-limited — not on every request. Request timestamps are recorded for all requests, without IP or browser type attached.

Why: To operate the service, prevent abuse, enforce rate limits, and protect against attacks.

Legal basis: Legitimate interests (Article 6(1)(f) GDPR) — keeping the service secure and available.

Kept for: Server and security logs are automatically deleted after 7 days, unless longer retention is needed to investigate abuse or comply with law.

This covers two separate things: anonymous website traffic analytics, and internal usage statistics we generate from account data we already hold.

Website traffic (Umami)

What: Page views, visit counts, approximate country (derived from IP address but not stored), browser type, and device type.

Why: To understand how the app is used in aggregate and improve the product.

How: We use Umami, a privacy-respecting analytics tool that we self-host on our own servers. It does not use cookies, does not fingerprint your device, and does not share any data with third parties. Your IP address is used only to derive an approximate country and is never stored.

Legal basis: Legitimate interests (Article 6(1)(f) GDPR) — understanding product usage to improve the service, with no personal data retained.

Kept for: Aggregated analytics data is retained indefinitely. No personally identifiable information is stored.

Internal usage statistics (account data)

What: Aggregate counts derived from account data described in 3a — for example, how many accounts exist, how many were created in a given period, and how many signed in recently (used to report daily/weekly/monthly active users). This does not create or store any new data about you; it counts existing fields (account creation date, last sign-in time, account status).

Why: To understand overall product usage and growth. These are aggregate totals only — this reporting is never used to look up or profile any individual user's activity, and is visible only to belongi's administrator.

Legal basis: Legitimate interests (Article 6(1)(f) GDPR) — understanding and improving the service.

Kept for: This reporting is generated live from existing account data and does not extend its retention — see 3a for how long that underlying data is kept.

Anonymous event counters

What: Tallies of specific actions happening in the app — for example, a hangout being created, someone viewing a hangout they can't join, tapping "Apply", leaving a hangout, a hangout or event link being shared or opened, a notification email being sent, or a hangout taking place, recorded only as its weekday and time of day (for example, Friday evening). Each tally is just an event name and either a timestamp or, for the most frequent events, a day and a running count — it does not record who did it, which hangout or event it relates to, or any other detail beyond that weekday and time of day.

Why: To see, in aggregate, which parts of the app people actually use, so we can fix what's confusing and improve the product — for example, understanding how many people see a hangout they can't apply to helps us design a better first-time experience. We also use them to show event organisers, in aggregate, when members tend to go out.

Legal basis: Legitimate interests (Article 6(1)(f) GDPR) — understanding and improving the service, with no personal data involved.

Kept for: Indefinitely, since it's just anonymous counts with no way to trace an entry back to you or to a specific hangout.

Inactivity feedback

What: If you click a reason link in an inactivity-warning email (see section 3a), we record which reason you picked and any optional free-text detail you choose to add. This is stored with no link back to your account, email, or identity — by design, it can't be traced back to you. To stop the same link being used to submit multiple times, we briefly keep a one-way hash (not reversible back to your account) recognising that the link was already used; this hash is deleted after 30 days.

Why: To understand, in aggregate, why people stop using belongi, so we can improve the product.

Legal basis: Legitimate interests (Article 6(1)(f) GDPR) — understanding and improving the service, with no personal data involved.

Kept for: Indefinitely, for the same reason as anonymous event counters above.

What: Information you send us when you report a concern (for example by email), or information we process when investigating reports about you.

Blocking another member: When you block a member, we store who blocked whom, the reason you selected, any note you added and the date. You can only block a member you are connected to on belongi: a friend, someone you are in a hangout with or attended one with in the last seven days, someone who applied to join your hangout, or someone who sent you a friend request. The blocked member is not told that you blocked them.

Member reports: For some reasons, a block also opens a report for our moderators. The report contains the reason, your note, and a record of how the two of you were connected when you blocked them: the titles and dates of hangouts you were in or attended together (including who organised them), whether you were friends, the text of any request they sent to join your hangout, and whether they sent you a friend request. We save this record with the report because hangouts are deleted once they end. The report also stores a one-way hash of the reported member's email address, so that a ban can still be applied to that address if they delete their account before the review is complete. For the most serious reasons, the reported account is paused (“under review”) until a moderator decides, and its owner is informed by email that a report is being reviewed. We never tell the reported member who made a report. The moderator's decision (dismissed, warning or ban) is stored with the report, and a warning is added to the reported account.

Why: To investigate potential violations of our Community Guidelines and Terms of Use, to let members stop contact with people they no longer want to meet, and to keep the community safe.

Legal basis: Legitimate interests (Article 6(1)(f) GDPR) — specifically, protecting users and enforcing platform rules.

Kept for: As long as needed to complete the investigation and any related enforcement action. Records involving serious violations (e.g. bans) may be retained longer.

A block is kept until you remove it or until either account is deleted. A member report, including the record of how the two members were connected, is kept at least until a moderator has decided on it. While a report about an account is open, that account is not permanently deleted: if its owner deletes it, it is removed from belongi immediately, but its remaining data is only erased once the review is complete, and an inactive account is not removed until then. After the decision, the report is kept for as long as the reported account exists and is deleted with it. If the member who made the report deletes their account, the report is kept without their identity.

What: A one-way hash of your email address if your account is banned.

Why: To enforce the ban and prevent that email address from being used to create a new account — including after the ban is lifted, so that a banned account can't be reinstated and then used to register a fresh account, bypassing the ban. This protects the safety of the community.

Legal basis: Legitimate interests (Article 6(1)(f) GDPR) — protecting other users from repeat harm.

Kept for: Permanently, even if the ban is later lifted, unless removal is required by applicable law.

What: Hangout details you create or apply to — title, description, location postcode, venue or address notes where provided, timing and duration, maximum number of participants, categories, languages, cost information, an optional event link, accessibility notes (wheelchair accessible, sensory-friendly, dogs allowed), and optional age, gender, or language filters for participants. Where the organiser leaves the date to be decided later, we store a decide-by date and the organiser's general weekly availability (days of the week and times of day) instead of a start time. Where the organiser leaves the place to be decided later, we store up to three possible postcodes instead of a venue. Both are shown to every member who can view the hangout, and are removed once the organiser sets the date or the place.

Why: To provide the core hangout discovery and coordination service.

Legal basis: Performance of a contract (Article 6(1)(b) GDPR).

Kept for: We aim to delete hangout data after the hangout has ended. If a hangout is cancelled before it takes place, its data (including group chat) is kept until either the original scheduled end time passes, or one hour after every participant has seen the cancellation notice — whichever happens first — so the chat remains available to participants during that window. Data may be retained longer where needed for safety, abuse prevention, or legal reasons. For a hangout that took place, its title, start time and list of participants are kept for a further 7 days after it ends (see section 3o). A hangout whose date is still to be decided is deleted at the end of its decide-by date if no date has been set by then, and its participants are notified.

What: Text messages you send within hangout group chats, and a timestamp of when you last read the chat.

Why: To enable hangout participants to coordinate plans, and to know when an unread-messages reminder email is worth sending (at most one per streak of unread messages).

Legal basis: Performance of a contract (Article 6(1)(b) GDPR).

Kept for: The chat closes automatically when the hangout ends. We aim to delete message data at the same time, except where retention is needed for safety or legal reasons.

What: Your list of confirmed friends, pending friend requests (sent and received), and your personal friend link/QR code (a random code that reveals no other data).

Why: To let you form friendships with other users — friends can see each other's nickname, their hangouts are prioritised in your feed, and they can view and apply to hangouts you've marked as "friends only."

Who can see it: Your friends list is private — no one but you can view it, including your own friends viewing each other. Your friend link shows a stranger only your nickname or username and avatar before they log in.

Legal basis: Performance of a contract (Article 6(1)(b) GDPR).

Kept for: Until you end the friendship or delete your account. On self-service account deletion, all friendships and friend requests are deleted immediately, independent of the 30-day retention period that applies to other account data (see section 3a).

What: When you propose a hangout directly to a friend, this covers the same hangout details as section 3g, plus the time(s) proposed during negotiation (including counter-offers) and who proposed the current time.

Why: To let two friends agree directly on a hangout time before it becomes a hangout visible to anyone else.

Who can see it: Only the proposer and the invited friend. Once both agree on a time, it becomes a regular hangout (see section 3c), and the original negotiation data is deleted once that hangout ends and is cleaned up.

Legal basis: Performance of a contract (Article 6(1)(b) GDPR).

Kept for: A proposal that receives no response within 7 days expires automatically. Declined or expired proposals are permanently deleted 30 days later. If a proposal is accepted, its negotiation data is deleted once the resulting hangout ends and is cleaned up (see section 3g).

What: Emails or messages you send us via Contact.

Why: To respond to your enquiry and keep a record of support interactions.

Legal basis: Legitimate interests (Article 6(1)(f) GDPR).

Kept for: As long as reasonably necessary to resolve the matter.

What: If you register after arriving via a marketing link carrying campaign parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term), we record those values once, at the moment your account is created. Nothing is recorded if you did not arrive via such a link.

Why: To measure which marketing channels and campaigns lead to registrations.

Legal basis: Legitimate interests (Article 6(1)(f) GDPR) — measuring marketing effectiveness.

Kept for: As long as your account is active. Deleted when you delete your account, on the same schedule as the account data described in section 3a.

What: Whether you registered via another member's personal referral link (see section 3i) — not which member referred you. This stays "no" if you did not arrive via such a link.

Why: To measure how many registrations come from members referring other members.

Legal basis: Legitimate interests (Article 6(1)(f) GDPR) — measuring referral effectiveness.

Kept for: As long as your account is active. Deleted when you delete your account, on the same schedule as the account data described in section 3a.

What: The title and description of a feature you propose, whether you chose to show your username or post as "Anonymous User", and a record of which suggestions you voted for.

Why: To run a feature-request board where users can propose and vote on what we should build next.

Who can see it: Suggestion text and vote counts are visible to all signed-in users. If you post anonymously, your account is never linked to the suggestion in anything other users or admins can see. Your individual votes are never shown to anyone.

Legal basis: Legitimate interests (Article 6(1)(f) GDPR) — specifically, understanding what our users want us to build.

Kept for: Until the suggestion is picked up for development, or you delete your own suggestion (which you can do at any time). Votes are deleted along with the suggestion they belong to, or when you delete your account.

What: When a hangout with at least two participants ends, we keep, for each participant, the hangout's title, its start time and the list of the other participants. If you give kudos to another participant, we store that you gave kudos to that member and when.

Why: To let participants give each other kudos or send each other a friend request after the hangout, and to show on a member's profile how many different members have given them kudos. Each participant also receives one email after the hangout, subject to their notification settings (see section 3p).

Who can see it: The list of participants is visible only to the members who took part in that hangout. The number of members who gave a member kudos is shown as a badge on that member's profile, to anyone who can view the profile (see section 3b). No member can see who gave them kudos.

Legal basis: Performance of a contract (Article 6(1)(b) GDPR).

Kept for: The hangout's title, start time and list of participants are deleted 7 days after the hangout ends. Kudos are kept until the member who received them deletes their account. If the member who gave kudos deletes their account, the kudos remain on the recipient's badge but are no longer linked to any account.

What: Your notification preferences (e.g. whether you have enabled email notifications for hangout events such as application updates, acceptances, or reminders; whether you have separately enabled email and push notifications for a friend creating a new hangout and for a partner organiser publishing a new event; if you are an organiser, whether you receive the recap of your events by email; which hangout categories, if any, you have excluded from those notifications; and whether you have chosen to receive them even when they conflict with your connected calendar).

Why: To send you only the notifications you have opted into, and to honour opt-outs.

Legal basis: Consent (Article 6(1)(a) GDPR). Email notifications are optional — you can enable or disable them at any time in your account settings. Withdrawing consent does not affect the lawfulness of processing before withdrawal.

Kept for: As long as your account is active. Deleted when you delete your account.

The inactivity warning email described in section 3a is sent regardless of this setting, since it relates to your account's status rather than optional engagement content — the same treatment as verification and password-reset emails.

What: If you connect your Google Calendar while proposing a hangout, we store an encrypted copy of the OAuth refresh token Google issues, plus a one-way hash of your Google account's stable identifier (used only to prevent the same Google account being connected to two different belongi profiles). We never store your calendar's content — no event titles, attendees, or locations. We only ever read live "free/busy" time blocks from Google at the moment you open a suggested-time view, and we don't retain that information afterward.

Why: To show you (and, where relevant, the friend you're proposing a hangout to) suggested free time slots when scheduling a hangout, without either of you needing to manually check your calendar. If you have joined a hangout whose date is still to be decided, your free/busy data is also used to show its organiser times that are free for every participant.

Who can see it: Only you see the suggested slots derived from your own calendar, on your own screen. If you and a friend are proposing a hangout time to each other and both have connected a calendar, each of you sees slot suggestions based on the intersection of both calendars' free/busy data — never the other person's raw calendar or event details. If you are a participant in a hangout whose date is still to be decided, its organiser sees suggested times based on the combined free/busy data of every participant with a connected calendar, and the number of calendars checked. The organiser does not see which participant is busy at which time, nor any calendar content.

Legal basis: Consent (Article 6(1)(a) GDPR) — connecting a calendar is entirely optional and requires your explicit authorisation via Google's own consent screen. You can disconnect at any time from your profile, which also revokes belongi's access on Google's side.

Kept for: The encrypted refresh token and account hash are kept until you disconnect your calendar or delete your account, whichever happens first. Free/busy data is never stored — it's read from Google at the moment a suggested-time view is shown and discarded immediately afterward.

belongi's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What: If you enable push notifications in your browser or the mobile app, we store the technical identifier needed to deliver them — in the browser, a push subscription (your browser's endpoint URL and encryption keys); in the mobile app, a device-specific push token. This identifier is linked to your account only to route notifications to your device.

How it is delivered: Push notifications reach your device through the push service of your device or browser provider. In the iOS app, we send your push token together with the notification's title, text and type and the page in belongi that it opens, over an encrypted connection, to the Apple Push Notification service (APNs), which delivers it to your device. In the browser, we send the notification to the push service assigned by your browser (operated by the browser's provider, such as Google, Mozilla or Apple). Its content is encrypted with your browser's keys, so that service cannot read it.

Why: To deliver push notifications for hangout events (e.g. new applications, accepted applications, or a friend creating a new hangout), where you've enabled this.

Legal basis: Consent (Article 6(1)(a) GDPR) — push notifications require your explicit permission via your browser's or device's own prompt and are entirely optional.

Kept for: As long as your account is active and the identifier remains valid. Identifiers a delivery attempt reports as invalid (e.g. after uninstalling the app or revoking permission) are removed automatically. Deleted when you delete your account.

What: If your account has been granted organiser access, the organisations your account represents, and the events published on behalf of those organisations, including which account published each one: title, description, venue name and street address, postcode, date, time and duration, cost information, an optional event link, categories, languages, optional age and gender restrictions, and accessibility notes (wheelchair accessible, sensory-friendly, dogs allowed). We also record, per event, the number of members who viewed it on each day, the number of hangouts members created from it on each day, the number of members notified when it was published, and, once the event has ended, how many of those hangouts had at least two participants, how many people took part in them in total, and which interest tags the participants of those hangouts had in common, with the number of hangouts that shared each one, and the event's categories. These are counts only. We do not store which member viewed which event: a temporary technical marker prevents the same member being counted twice in one day, and it is discarded within 48 hours.

Why: To display events to members, to let every account that represents an organisation manage that organisation's events, and to show organisations how many people their events reached.

Who can see it: Event details are visible to all logged-in members, together with the organisation's name and the display name of the organiser who published the event. Events and reach statistics are visible to every account that represents the organisation that published the event, and to our administrators. The full list of organisations an account represents is visible only to that account and to our administrators; members see an organiser's link to an organisation only through the events that organiser has published for it. Other organisations never see reach statistics individually. They see only a median across the events of at least five organisations in the same category, which does not identify any single organisation or event.

Legal basis: Performance of a contract (Article 6(1)(b) GDPR) for recording the organisations you represent and for publishing the event; legitimate interests (Article 6(1)(f) GDPR) for the aggregate reach statistics, which allow organisers to assess the value of the service and contain no personal data about viewers.

Kept for: Event data is deleted once the event has ended, on the same basis as hangout data in section 3g. Reach statistics, together with the event's title and date needed to label them, are retained for one year after the event date and then deleted automatically. Reach statistics belong to the organisation, not to the individual organiser, and are kept for that period when an organiser stops representing the organisation or deletes their account. They contain no personal data about that organiser. The record that your account represents an organisation is deleted when you stop representing it or when your account is deleted. If you delete your account, your display name is removed from any event you published that has not yet ended, and the event remains listed under the organisation's name.

Invitations to people without an account: Our administrators may invite a person who does not yet have a belongi account to represent an organisation. For this purpose we store the email address the invitation is sent to, the organisation, an optional note from our team and the date the invitation expires, and we send one email to that address in the language our team selected. The email address is visible only to our administrators. The legal basis is our legitimate interest (Article 6(1)(f) GDPR) in inviting organisations to publish events on belongi. Invitations are only sent to people who have previously agreed to receive one. If the recipient registers with that email address and confirms it, the invitation is linked to the new account and is then handled as described above. Otherwise the email address and the invitation are deleted when the invitation expires, 14 days after it is sent, or earlier if our team withdraws it.

What: If you hide kinds of pins on the hangouts map (for example friends' hangouts or partner events), which kinds you have hidden. This is stored under the key belongi:mapKinds in your browser's local storage.

Why: So the map shows the same kinds of pins the next time you open it on this device.

Legal basis: Section 25(2) No. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG). The storage is strictly necessary to apply the setting you have chosen. It is not sent to us and is not linked to your account.

Kept for: Until you clear belongi's site data in your browser. Showing all kinds again leaves the stored list empty.

What: When you sign in, belongi stores:

• an access token under the key accessToken in your browser's local storage. It is sent to us with each request so that we can confirm you are signed in;
• a renewal token in a cookie named refreshToken. Scripts on the page cannot read it, and your browser sends it only to belongi's sign-in addresses, so that we can issue a new access token when the current one expires. In the belongi mobile app, the renewal token is also kept in your device's secure storage (iOS Keychain or Android Keystore);
• if you sign up with Google and we still need your date of birth, a cookie named googleSignup holding a signed token for that last step of sign-up.

Why: To keep you signed in and to confirm that requests made with your account come from you.

Legal basis: Section 25(2) No. 2 TDDDG. The storage is strictly necessary to provide the signed-in service you request. We process these tokens on our servers for the performance of a contract (Article 6(1)(b) GDPR).

Kept for: The access token is valid for 15 minutes and is replaced by a new one while your session continues. The refreshToken cookie expires 30 days after it was last issued, and a new one is issued each time your access token is renewed. The googleSignup cookie expires after 15 minutes and is removed once sign-up is complete. Signing out removes the access token and the renewal token from this device.

What: Settings you choose for this device, each stored in your browser's local storage:

• belongi:locale: the language you have selected (English or German). While you are signed in, it is kept in line with the language stored on your account (see section 3a). If you have not selected a language and are not signed in, nothing is stored and belongi follows your browser's language setting.
• belongi:locale-unsynced: a marker set while a language selected on this device has not yet been saved to your account, for example because you selected it while signed out.
• belongi:theme: light or dark mode, if you have switched it. Otherwise nothing is stored and belongi follows your device's setting.
• belongi:brand-color: the colour theme you have selected. Nothing is stored until you select one.
• belongi:organiser-organisation: if you are an organiser, the organisation you last selected in the organiser area, so that it opens with that organisation again.

Why: So that belongi keeps the settings you have chosen the next time you open it on this device, and shows the right colours as soon as a page starts loading.

Legal basis: Section 25(2) No. 2 TDDDG. The storage is strictly necessary to apply the settings you have chosen. The stored values are not sent to us. Your language is also stored on your account, as described in section 3a, and the organiser area loads the data of whichever organisation is selected.

Kept for: Until you clear belongi's site data in your browser. The belongi:locale-unsynced marker is removed as soon as your account has stored your language.

What: Short-lived information that lets belongi finish something you started or keep a notice you dismissed out of the way:

• belongi:hangout-draft (local storage): while you are creating a hangout, what you have entered in the form, saved automatically as you type, with the time it was saved. It is restored if you return to the form within 24 hours.
• belongi:hangout-proposal-counter-draft (session storage): if you connect your calendar while suggesting a different time for a hangout proposal (see section 3j), the proposal's identifier and the time you were suggesting, so that the proposal reopens where you left it.
• belongi:hangout-flash (session storage): after you cancel a hangout or hand it over to another participant, the hangout's title and, for a handover, the new organiser's username, so that the next page can confirm what happened.
• belongi:wrapUpDismissed (session storage): a marker that you closed the hangout wrap-up prompt (see section 3o) without finishing it, so that it is not shown again in the same browser tab.
• belongi:blockNoticeDismissed: followed by a hangout's identifier (local storage): if members you have blocked are in a hangout with you and you choose to keep their messages hidden, the identifiers of those members and the time the hangout ends, so that the notice about them is not shown again until that group of members changes.
• belongi:register-throttle-until (local storage): if registration attempts are temporarily limited, the time from which you can try again, so that the registration form can show a countdown.

Why: So that what you have entered or chosen is not lost when a page reloads, when you leave it briefly, or when you are sent to another service and back, and so that notices you have dismissed stay dismissed.

Legal basis: Section 25(2) No. 2 TDDDG. The storage is strictly necessary to complete the action you started or to apply the choice you made. These values are not sent to us. A hangout draft reaches us only when you submit the form, and is then handled as described in section 3g.

Kept for: Your browser deletes values in session storage when you close the tab, and the hangout proposal and confirmation values are removed as soon as they have been used. The hangout draft is removed when the hangout is created, when you start again or clear the form, and when you sign out or delete your account. A draft older than 24 hours is no longer restored and is removed the next time you open the form. The registration limit is removed once the registration form finds that the time has passed. A dismissed block notice is removed the first time you use belongi while signed in after its hangout has ended, and all of them are removed when you delete your account.

What: If you open one of the following links while you are not signed in, what is needed to take you back to it afterwards, stored in your browser's local storage:

• belongi:pendingReferral: the code from a member's personal friend link (see section 3i). It is also stored if you are signed in but have not yet completed your profile.
• belongi:pendingSharedHangout: the identifier of the hangout from a shared hangout link. It is also stored if you are signed in but have not yet completed your profile.
• belongi:pendingSharedEvent: the identifier of the organiser event from a shared event link. It is also stored if you are signed in but have not yet completed your profile.
• belongi:pendingRedirect: the address of the belongi page you were trying to open when you were asked to sign in, for example from a link in one of our emails.

Why: So that after you sign in, register or complete your profile, you arrive at the friend link, hangout, event or page you opened rather than the start page, and, for a friend link, so that the friend request can be sent to the member who shared it.

What is sent to us: When you register, the friend link code, which we use only to record whether you registered via a referral link (see section 3m), and whether a shared hangout link or shared event link was stored, without its identifier, which we count anonymously (see section 3d). When you complete your profile, the friend link code is sent again so that the friend request to that member can be created (see section 3i).

Legal basis: Section 25(2) No. 2 TDDDG. The storage is strictly necessary to take you to the link you opened. What is sent to us is processed on the legal bases stated in sections 3d, 3i and 3m.

Kept for: Until the value has been used, which happens when you next sign in with your email address and password, when you complete your profile, or, for the first three, when you open the same link again while signed in with a completed profile. If more than one is stored, they are used one at a time, so a value can wait for a later sign-in. If you never sign in, they are kept until you clear belongi's site data in your browser.

What: If you arrive at belongi via a link carrying campaign parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term), their values are stored under the key belongi:attribution in your browser's local storage. Only the first such link is kept; later visits do not overwrite it.

Why: So that the campaign that brought you to belongi can be recorded if you register later, as described in section 3l.

What is sent to us: The stored values, once, together with your registration. Nothing is sent if you do not register.

Legal basis: Section 25(2) No. 2 TDDDG for storing the values in your browser. Recording them with your account is based on legitimate interests (Article 6(1)(f) GDPR), as described in section 3l.

Kept for: Removed from this device once your registration has gone through. If you do not register, it is kept until you clear belongi's site data in your browser.