Privacy Policy

Who we are

Charm City Culés is an independent FC Barcelona supporters community based in Baltimore, Maryland. This policy explains how we handle information when you visit our website, sign up, RSVP, or contact us. For privacy questions, email hello@charmcitycules.com.

Information we collect

• Accounts and membership: email address, first and last name, and phone number. A phone number is required when signing up and can be updated in your profile. We keep account identifiers, signup and membership status, member number, relevant dates, and administrative decisions or notes. Membership currently has no payment processing.
• Authentication: Supabase processes your email, account metadata, sign-in/session information, and authentication timestamps. Sign-in uses emailed magic links; our forms do not ask you to create a password.
• RSVPs: contact name and email, selected event, number of additional guests, reservation status and timestamps, and your account identifier if signed in. RSVP records can include attendance status. We do not ask for the names of accompanying guests.
• Contact messages: name, email, subject, message, and records of when an inquiry was received or handled. Please avoid including sensitive information we do not need to answer your question.
• Email delivery: recipients, message content, message type, related account/event/inquiry references, scheduled and sent times, provider message identifiers, delivery attempts, and errors.
• Technical information: our hosting, authentication, and security providers process request information such as IP addresses, browser/device details, requested URLs, and timestamps. Our website derives a fingerprint from an IP address for RSVP and contact rate limiting; those rate-limit records store the fingerprint rather than the raw address. Infrastructure logs may still contain IP addresses.

How and why we use information

We use information to run the website, authenticate users, manage membership signups and accounts, reserve event places, send related emails and reminders, answer inquiries, prevent abuse, and troubleshoot problems. Authorized community administrators can review signups, manage members and RSVPs, handle inquiries, and review delivery records. Public event pages show event information and reservation counts, not a participant contact list.

Providing account, RSVP, or inquiry details lets us carry out the action you request. Necessary authentication and security technologies support these services. Optional analytics and Maps use your browser choices described below. These operational purposes do not mean that every privacy law applies to this community.

Service providers and sharing

We do not sell personal information. We share information as needed to operate the site with these providers:

• Supabase: account authentication, sessions, and storage of profile, membership, RSVP, contact, and email-job records.
• Vercel: website hosting, request handling, and operational logs. With your permission, Vercel Web Analytics measures visits to public pages without analytics cookies. It processes page visits, referrers, browser/device information, and approximate location derived from requests. We omit account, admin, authentication, and guest-management pages and strip query strings and fragments from the page URLs sent for analytics.
• Cloudflare: domain/DNS infrastructure and Turnstile bot protection for RSVP and contact forms. Turnstile processes browser and network signals to help distinguish legitimate submissions from abuse.
• Zoho ZeptoMail: transactional email delivery. The app sends message content, recipients, and delivery references through its email API; authentication emails use Supabase's configured SMTP delivery service.
• Google Maps: the optional embedded venue map. Once allowed, it connects your browser to Google, which receives request information and may read or set cookies under its own policies.

Providers may process information outside Maryland or the United States according to their service arrangements. We may also disclose information when needed to respond to a valid legal requirement or protect the community and website from abuse.

Provider information: Supabase, Vercel, Cloudflare Turnstile, Zoho, and Google.

Accounts and guest RSVP links

You can view and update account information and manage your reservations through your profile. Membership decisions and status are managed by community administrators. Cancelling a reservation releases places but does not erase the reservation record.

Guests can receive a private link to manage an RSVP without an account. Anyone with that link may be able to view or change the reservation, so keep it private. Contact us if you believe a link was shared with someone who should not have it.

Email communications

We send emails about authentication, signup and membership approval, RSVP confirmations, changes and cancellations, event reminders, and contact acknowledgements. Contact inquiries are also forwarded to the community's contact inbox. These messages support the action or reservation involved; they are not a newsletter subscription. There is currently no newsletter or marketing-email system.

App-generated emails disable ZeptoMail open and click tracking. Loading the public logo in an email may still make a request to our website host. Authentication-email delivery settings are managed separately through Supabase and its mail provider.

Retention and deletion

We keep information for community operations and the purposes described here, subject to administrative, security, and technical needs. The website currently has no general automatic deletion schedule for accounts, reservations, inquiries, or delivery records. Resolving an inquiry or cancelling an RSVP does not automatically erase it. Provider logs, email inboxes, and backups have separate retention arrangements.

The account controls on your profile include account deletion. This removes your account, profile, membership/signup records, and associated RSVPs, including guest reservations matching your account email, along with related app delivery records. A last remaining administrator must arrange another administrator first. Ending a membership alone does not delete the account.

Account deletion does not automatically erase separately submitted contact messages, emails already delivered to inboxes, or provider logs and backups. Email us to request deletion of other information. We may need to confirm your identity and consider any information that must be retained for security or applicable obligations.

Cookies, browser storage, and optional services

Authentication uses first-party session cookies; bot protection supports secure forms. We remember your privacy choices in this browser's local storage for up to 180 days. Optional Vercel analytics and Google Maps stay off until allowed. You can change these choices through privacy settings; withdrawing permission stops new analytics events or removes the embedded map. It does not erase information already received by providers or their existing cookies.

See our Cookie Policy for storage details and browser controls. Our social gallery uses locally hosted images and ordinary links, rather than embedded social feeds. Following social, venue, or other external links takes you to services with their own privacy practices.

Security

We use access controls, authenticated administrative actions, database permissions, bot checks, and other reasonable technical and administrative safeguards. No website or email system can guarantee complete security. Protect your sign-in and guest-management links and contact us about suspected misuse.

Children's privacy

This is a general supporters-community website. We do not ask for dates of birth or knowingly seek personal information from children under 13. If you believe a child has provided personal information, contact us so we can review and address it.

Your choices and privacy requests

You can update your profile, manage an RSVP, use the account-deletion controls, or email hello@charmcitycules.com to ask about access, correction, or deletion. Depending on where you live and which laws apply, you may have additional rights. We may ask for enough information to verify a request without collecting unnecessary details.

Maryland residents

Maryland residents may have rights under applicable Maryland privacy law where that law applies. Contact us with your request or concerns about our response. This policy does not assume that the Maryland Online Data Privacy Act applies to Charm City Culés.

Changes and contact

We may update this policy as the website or our practices change and will revise its effective date. For questions or privacy requests, contact hello@charmcitycules.com or use our contact form.