Privacy Policy

Last updated: 21 October 2026

MyLifeInMilan is a small, non-commercial, invitation-only project that gathers publicly available events and community posts in and around Milan into one place. This page explains what data we handle and why.

1. Who we are

The data controller is the operator of MyLifeInMilan, contactable at [email protected].

2. What we keep

• Your account: your email address and, if you sign in with Google, your name and basic profile info. If you use a password, it's stored hashed. Used only to log you in.
• Your preferences: settings you pick, like your area and category filters. For distances, you enter an address. Your profile stores coordinates and the selected address; you can clear them in Settings.
• Saved events: the events you save, until the event is over.
• Planner: if you turn it on, your tasks and their notes, repeating tasks, weekly goals and the categories you create. They stay until you delete them or close your account. For linked calendars, see below.
• Technical cookies: a session one that keeps you signed in (14 days), a security one for forms (1 year) and one that remembers your language (1 year). No profiling or tracking cookies: we only use technical cookies, which is why there's no banner.
• Usage stats: deleted automatically after 60 days and never shared with third parties.

The events and posts you see in the app come from public sources and always link back to the original.

3. Legal basis

We process your account data, preferences, saved events and planner to provide the service you asked for (Art. 6(1)(b) GDPR). We collect public listings and usage stats under our legitimate interest in running a non-commercial local events directory (Art. 6(1)(f) GDPR).

4. Who we share data with

Only the technical services that run the app: Cloudflare (network and protection), Northflank (hosting), Neon (database), Google (if you sign in with Google) and Resend (invite and password-reset emails). We don't sell your data or use it for advertising. Some providers may process data outside the EU under the safeguards the GDPR requires (such as standard contractual clauses).

“Find events” chat. What you type and your voice recordings go to Cloudflare (Workers AI), possibly on servers outside the EU, only to generate the answer: Cloudflare doesn't train models on them and doesn't keep them after answering. If your browser transcribes your voice itself, the audio goes to its vendor (for example Google or Apple) under its own privacy policy, and Cloudflare only receives the text. We don't save conversations: they stay in your browser until you close the tab. For the usage limits we keep only the times of your requests for 24 hours, tied to a pseudonymous code, not your name or email. Please don't type or say personal details in your questions.

Linked calendars. If you link a calendar to the planner, we keep its secret address and read it every few minutes only to show you your events. We don't sell it, share it with anyone or use it for anything else. The events aren't saved in our database. When you unlink the calendar or close your account, we delete the address; you can also invalidate it yourself in Google (“Reset”) or stop publishing it in Outlook.

Maps load tiles from OpenStreetMap, which receives your IP address, this site's domain, and the map area you view. Address suggestions and searches send the typed text to HeiGIT/openrouteservice.

5. Retention

For as long as your account is active; if you close it, your data is removed. Listings remain visible through their final day and are removed by the next daily cleanup, along with their saved references. Community listings have a 60-day retention window. Usage stats are deleted automatically after 60 days.

6. Your rights

You can request access, rectification, erasure, restriction, objection, or portability of your data at any time by emailing [email protected]. You may also lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali, garanteprivacy.it).

You can also download a copy of your data yourself from Settings (a JSON file). The secret address of linked calendars isn't included: it works like a password, so it never leaves the server.

7. Changes

If this policy changes, we'll update the "last updated" date at the top.