Privacy notice

Short version: we collect only what the site needs, we never sell it, and SpeedSocial details are deleted 30 days after each event.

Who is responsible

Algarve Offseason is run by a private individual, Dev Nain, in Portimão, Portugal. He decides what happens to your data (the "controller" under the EU's General Data Protection Regulation, GDPR). Contact: hello@algarveoffseason.com. The rules for using the site are in the terms of use.

Your account

To add places, events or housing, or to sign up for SpeedSocial, you need an account. We store your email address and a display name. If you sign in with Google, Google tells us your email and name. There is no password: we email you a six-digit code instead. You need an account for these because they let us stop spam and let you change what you added.

Pages you open while signed in

While you are signed in, we note which pages of this site you open and when: the page address only, such as /events or /gamenight, never what you type, your IP address or anything about your device. Only the organiser sees it, to understand which parts of the site members use and to look after the community. Each note is deleted after 90 days. Nothing is noted when you are not signed in. Our reason is the legitimate interest of running and improving the site (GDPR Article 6(1)(f)); you can object by emailing us, and we will stop noting your visits.

What you add

Places, events, housing listings, ratings, confirmations and reports are linked to your account. Places, events and housing listings are public. Your ratings are shown only as an average.

Places and business owners

When you check a place (on its page or in Quick check), we keep your answer so you aren't asked again and so the points can go to the right people. Other members only see totals, never who answered.

If you claim a business, we keep the claim: the code we gave you, the link where you showed it, any note, and what the organiser decided. The organiser sees your name and email to check the claim and to email you about it. The claim is kept for as long as you manage the listing, so we can show who it was given to and why.

Owners see how many times their place's page was viewed and how often its Call, Directions, Website and social links were tapped, as totals per day. To count each visitor once a day, the site notes in your session (the one cookie described below, nothing extra) which places you've viewed today. Nothing about who you are is stored with those counts.

Housing

• Photos you add to a listing are public with it. The site saves a fresh copy of each one, which removes everything hidden in the original file, including the GPS position phones record. Photos are deleted 30 days after the listing ends (rented, taken down or expired).
• Messages about a listing are seen only by you and the other person. We email you when a new message arrives; neither of you sees the other's email address. A message that looks like a common scam gets a warning shown to the reader; nothing is blocked or read by a person. Conversations are deleted 90 days after the listing ends. If either of you reports a conversation, the organiser may read that conversation to deal with the report.
• WhatsApp button: only if you add your number and tick the box. The number isn't written on the page; a signed-in member who taps the button is sent to WhatsApp with your number. You can remove it any time by editing the listing.
• Search alerts: the filters you save, so we can email you new matching listings. Every email has a link to stop them, and you can delete alerts on your account page.

Algarve Offseason is a free noticeboard, not an estate agency: it doesn't act for owners or renters, and takes no fees.

Services people offer themselves

If you list a service you offer yourself under Neighbours for Hire (as a handyman, driver, teacher and so on), we show the name, description, area, price and the contact details you choose to give, on a public page. The organiser sees your account email while checking your listing. You can change or remove it any time.

If you post a job (under Neighbours for Hire), signed-in members see what you need, the town, the area you give, when and your budget, with your display name; people who do that kind of work get the same by email. Your email address, and your phone number if you add one, go only to the person you choose, and they see them on the job page too. If you offer to do a job, the person who posted it sees your name, note, price and, if you add one, your phone; if they choose you, they also get your email address. The organiser can see both sides' contact details to help match people. Job emails can be stopped with the link in each one, or at /jobs/help.

When the person who posted a job says whether it was done, we keep that answer with the job. To keep Neighbours for Hire points fair, the site checks, for the two people involved, how old each account is, how many points each already has, whether they earned job points together recently, and whether the two email addresses look like the same person's. Only the result is shown to you (for example "No points this time: both accounts need to be at least 14 days old"); the organiser sees the points, who they were between and any warnings, so they can stop points gained by cheating.

Trips

When you post a trip, its details and your display name are public, and people who join see your email address so they can arrange it with you. When you join a trip, the organiser sees your display name, your email address and any note you write, and the others going see your display name. If you ask to hear about trips to certain places, we keep that list to email you, until you untick them. Who joined a trip is deleted 60 days after it. Trips are arranged between members: any money changes hands between you, never through this website.

Notification emails

If you ask for emails about new events (on your account page, or with a "Notify me" button), we keep which kinds you ticked and a list of what we have already told you about, so nothing is sent twice. You get at most one email a day, only when something new matches. Every email has a link to stop them, and you can untick them on your account page. Nobody else sees your choices. The list of what we told you about is deleted a week after each event.

SpeedSocial events

• First name, gender and age: to print your card, plan the seating and balance the rounds.
• What you're open to (friendship, dating, business): shown on your card.
• Dating preferences (who you'd like to meet, and their age range): only if you tick dating. These can reveal your sexual orientation, which the GDPR treats as a special category of data. We use them only with your explicit consent, given in a separate tick box (GDPR Article 9(2)(a)). You can withdraw consent at any time by deleting your registration.
• Your seating plan, your picks, and whether you arrived and paid the deposit.

Other guests see only what's on your card: first name, badge number and stickers. If you and another guest both ticked each other for the same thing, we email each of you the other's first name, badge number and email address. Nobody is told about picks that weren't mutual.

Some events are run at the venue by a host on the organiser's behalf. A host sees only what is on the cards: your first name, badge number and stickers. They also see the seating plan (who sits at which table each round) and whether you've arrived. A host never sees your email, age, gender, dating preferences, deposit, picks or matches.

On the night, your seating plan and tick boxes are on a page with its own private link, which we email only to you. Anyone with that link can see your card (your tables, the first names and stickers of your partners, and your ticks), so don't share it.

Everything about you for an event is deleted automatically 30 days after it. You can delete it sooner yourself on the My events page.

The deposit is paid outside this website, by MB WAY. We never see your bank details.

Events run by an independent organiser. Some events are organised and sold by someone else, named on the event's page. You pay them directly, using the details they give, and they handle refunds. They see the same as a host, plus whether you have paid them and your payment reference, and they get an email with your first name, badge number and payment reference if you cancel. They never see your email, age, gender, dating preferences, picks or matches. Whatever reaches them through your payment (for example the name and number on an MB WAY transfer) is theirs to look after, and they agree to use it only for that event. Everything else about these events works as described above.

Points

You earn points for things you do on the site (see how points work). Your own points and where they came from are on your account page. The monthly top scorers are shown publicly by display name on the points page and in the sidebar. The site's organisers are never listed there.

When you check in at an event run by a partner group (by scanning the QR code its organisers show), we record which event and when, and add its points. That group's organisers see your display name in their check-in list, never your email address.

Deals

When you use a member deal, we record which deal, when, and the code you were given, so the deal's limits (such as once a week) work. The business sees your first name, the deal, the code and the time, so they can check it at the till or match it to a booking. If the owner has asked for it, they also get that by email. They never see your email address or your points. These records stay with your account.

Meeple Mondays (board game night)

The scorekeeper records who came each Monday, which games they played, and who placed 1st, 2nd and 3rd. For Mexican Train, the score of each round is kept too. This is what the points and standings are made from.

• Name and email. If you give the scorekeeper your email, we keep your results under it, send you one welcome email, and join the results to your account when you sign in. Without an email you play as a guest: your name is used only on the night, public pages show "Private player", and a week later the name is replaced with "Guest".
• What's public. The standings, the stats pages and the page for each night show your display name, points, wins, the games you played and the nights you came. Each player has a stats page with those numbers. To hide your name, untick the box on your account page. You then appear as "Private player", and your games still count.
• How long. Results stay until you ask us to delete them, because the all-time standings depend on them. Email us and we'll delete them all.

The legal basis is our legitimate interest in running a points league that the people who play asked for (GDPR Article 6(1)(f)), together with the opt-out above.

Who processes the data for us

These companies work for us under data-processing agreements and may not use your data for anything else:

• Supabase stores the database. Its servers are in Ireland (EU).
• Oracle Cloud runs the web server, in Madrid, Spain (EU). Its logs record which pages are requested, without IP addresses.
• Amazon Web Services sends all the site's emails, including sign-in codes, SpeedSocial emails and notification emails, from the United States. Amazon is certified under the EU–US Data Privacy Framework.
• Google, only if you choose "Continue with Google" to sign in.

The housing map pages load map pictures from OpenStreetMap and the map code from cdnjs (Cloudflare). Like any website, those services see your IP address when your browser asks them for those files. No other page loads anything from another company.

Legal basis and how long we keep things

We use your data to provide what you asked for (GDPR Article 6(1)(b)), except dating preferences, which need your explicit consent. Your account stays until you ask us to delete it. Notes of pages you opened go after 90 days. Housing listings expire on their own. SpeedSocial details go 30 days after each event.

Your rights

You can ask to see, correct, export or delete your data, object to how it's used, or withdraw consent. Email hello@algarveoffseason.com and we'll reply within a month. If you're unhappy with how we handle your data, you can complain to Portugal's data protection authority, the CNPD.

Cookies

Two cookies, both needed for the site to work: one keeps your session (who you are once signed in, and the towns you picked), and one keeps you signed in on that device for 90 days, so you are not signed out in the middle of something. We store only a scrambled copy (a hash) of the second one, so it cannot be rebuilt from our database. Signing out deletes it. No analytics services, tracking pixels, social-media buttons or third-party fonts. The page notes described above are kept on our own server and database, not by any outside company.