Privacy Policy
1. Who we are
DevFest.cz 2026 is organised by GUG.cz, z.s. (formerly GDG Czech Republic), a registered association (zapsaný spolek) and the data controller for the personal data described here. For privacy-related enquiries, contact us at devfest@gug.cz.
2. Data we collect and why
a) Newsletter sign-up
When you submit your email address via the notification form, we store it in SmartEmailing (our email service provider) to send you conference updates such as ticket availability announcements and event news. Legal basis: consent (GDPR Art. 6(1)(a)). You may unsubscribe at any time via the link in every email.
b) Analytics
We use Google Firebase Analytics (measurement ID G-L5NK2S2EZ0) to understand how visitors use the site, so we can improve it. It runs only if you accept analytics cookies in the cookie banner.
Before you decide, and if you decline: analytics does not run. The site loads no Google Analytics code, sets no analytics cookie, and sends Google no measurement data about your visit.
If you accept: analytics loads and sets the _ga cookies listed below, which give you a random analytics identifier. That lets us count returning visitors and follow sessions across pages — pages visited, session duration, browser type. We never collect your name, email, or any other information that identifies you personally. Legal basis: consent (GDPR Art. 6(1)(a)). You can withdraw consent at any time by clicking "Decline" in the cookie banner (clear your browser storage to see it again).
Alongside page views we also record a few interaction events: opening the ticket checkout, completing a newsletter sign-up or a ticket purchase, and submitting a company invoice request. These record the action itself — which ticket wave, its price, how many tickets — and never your name, email, company details, or anything else that identifies you.
The data is used only for analytics — never for advertising, ad personalisation, or profiling.
c) Server logs
Our hosting provider (Firebase Hosting) automatically records standard access logs (IP address, browser, requested URL). These are retained for up to 30 days for security purposes. Legal basis: legitimate interests (GDPR Art. 6(1)(f)).
d) Bot protection (reCAPTCHA)
To protect our ticketing data from automated scraping and abuse, the site uses Google reCAPTCHA Enterprise (via Firebase App Check). reCAPTCHA runs in the background to tell humans from bots, analysing signals such as your interactions with the page, device and browser information, and IP address. This data is shared with Google and processed under the Google Privacy Policy and Terms of Service. Because this is a security measure, it runs regardless of your cookie choice. Legal basis: legitimate interests (GDPR Art. 6(1)(f)).
e) Company invoice requests
If you request a company invoice via the company invoice form, we collect your company name, registration number (IČO), VAT identification number (DIČ, if provided), billing address (street, city, ZIP, country), contact email, and the number of tickets requested. We use this data to issue the invoice, process your payment, and send you a discount code to claim your tickets on ti.to. The request is stored in Google Firestore, the invoice is issued through iDoklad, and the discount code is created in ti.to. Legal basis: performance of a contract (GDPR Art. 6(1)(b)) and compliance with our legal accounting and tax obligations (GDPR Art. 6(1)(c)). Issued invoices and related accounting records are retained for up to 10 years, as required by Czech tax and accounting law.
3. Cookies
We use the following cookies:
| Name | Purpose | Duration |
|---|---|---|
cookie-consent | Stores your cookie preference (localStorage) | Until you clear browser storage |
_ga, _ga_* | Google Analytics — only set after consent | 2 years |
_GRECAPTCHA | Google reCAPTCHA — bot protection (set for security, not consent-gated) | 6 months |
4. Data sharing
We do not sell your data. We share it only with the processors listed below, under data processing agreements and only to the extent necessary to provide the services described:
- SmartEmailing — newsletter delivery
- Google Firebase (Hosting, Analytics, Firestore) — website hosting, analytics, and storage of invoice requests
- Google reCAPTCHA Enterprise (via Firebase App Check) — bot protection
- iDoklad (Solitea a.s. / Seyfor, idoklad.cz) — issuing company invoices
- ti.to — ticket sales and discount-code redemption
5. Your rights
Under GDPR you have the right to:
- Access the personal data we hold about you
- Request correction or deletion of your data
- Withdraw consent at any time (this does not affect prior processing)
- Lodge a complaint with the Czech Data Protection Authority (uoou.cz)
To exercise these rights, email us at devfest@gug.cz.
6. Changes to this policy
We may update this policy as the website evolves. The "last updated" date at the top reflects the most recent revision. Material changes will be announced via our newsletter.
7. Mobile app
This section covers the DevFest.cz mobile app for iOS and Android (bundle and package id cz.devfest.app). The data controller is the same as for the website: GUG.cz, z.s., devfest@gug.cz. The app is not directed at children.
You can use the programme without logging in. Logging in with your ticket is optional and is needed only for networking and for keeping your favourites on your account.
a) What the app collects and why
| Data | Source | Purpose | Retention |
|---|---|---|---|
| Registration reference / ti.to ticket code | Typed by you, or read from your ticket's QR code, when you log in with your ticket | Look up your ticket in the ti.to check-in list | Until the account is deleted |
| Full name and email address | Taken from the matched ti.to ticket, never typed in the app | Your account and ticket verification | Until the account is deleted |
| 6-digit email verification code | Generated by our backend and sent to the ticket email via Resend | Confirm that you own the ticket email | Stored only as a salted hash, expires after 30 minutes, purged nightly |
| Favourite session ids | Your taps in the agenda (ids of public programme sessions) | Your personal agenda and session reminders | Until the account is deleted |
| Networking connections: the name and company of each attendee whose badge you scan (what the badge already prints), their ticket identifier and the time of the scan. Never their email | The QR code on the other attendee's badge, scanned by you after logging in with your ticket | Your list of people you met. After the conference we email you that list via Resend | At most 500 entries, until your account is deleted |
| Account metadata (Firebase user id, created and updated timestamps) | Firebase Authentication | Run your account | Until the account is deleted |
| Usage analytics: screen views and a closed set of events (tab switched, session opened, session favourited or unfavourited, onboarding finished), app-instance id, device model, OS version, coarse location derived from IP address | Firebase Analytics | Understand how the app is used. No user id is set, no event contains personal data, and the advertising ID is not collected | 14 months (Google default) |
| Crash reports: stack traces, device model, OS version, installation id | Firebase Crashlytics | Fix crashes | 90 days (Google default) |
| Device attestation signals | Firebase App Check with Play Integrity (Android) or App Attest (Apple) | Protect our backend from abuse | As set by Google and Apple for each platform |
| Push notification subscriptions: topics for announcements, general sessions and one per favourited session | Firebase Cloud Messaging. The device token is held by Google and is never stored in our database | Send announcements and reminders for sessions you favourited. Notification permission is optional | Until you unsubscribe, turn notifications off or uninstall the app |
| App update check: app id, app version, platform and a random per-install id | Sent to Shorebird when the app starts | Deliver code updates to the app | As set by Shorebird |
| Backend logs, which can contain your user id and the matched ticket email | Google Cloud Logging | Operate and debug the backend | 30 days |
b) Networking: if your badge is scanned
Another attendee who is logged in to the app can scan the QR code on your badge. If they do, the person who scanned it gets your name and company, the same details your badge already shows, and the app keeps them on that person's account. Your email address is never shared. After the conference we email each attendee the list of people they scanned. The entry is deleted when the person who scanned you deletes their account, and you can ask us to remove it earlier (see section 8).
c) Camera
The app uses the camera only to scan a ticket or badge QR code. The camera frames are processed on your device and are not uploaded or stored. On Android, scanning uses Google's ML Kit barcode model, and Google receives its own usage telemetry from ML Kit.
d) Stored only on your device
Whether you finished onboarding, which reminder topics you chose, and an inbox of up to 100 received notifications are kept in the app's storage on your device. They never reach our servers, are not backed up, and are removed when you uninstall the app.
e) Legal basis
The account, ticket verification, personal agenda, networking connections and push notifications are processed to provide the app you asked for (GDPR Art. 6(1)(b)). Usage analytics, crash reports, device attestation, update checks and backend logs are processed on the basis of our legitimate interests in keeping the app working, secure and useful (GDPR Art. 6(1)(f)).
f) Analytics and crash reports are always on
Unlike the website, the app has no consent switch: usage analytics and crash reporting are always on, and there is no in-app opt-out. They carry no name, email or user id, and they are never used for advertising, ad personalisation or tracking. If you do not want them sent, please do not use the app.
g) Processors
We do not sell app data, do not share it with third parties acting as independent controllers, and do not use it for advertising or tracking. All data is encrypted in transit. It is processed only by:
- Google (Firebase Authentication, Firestore, Realtime Database, Cloud Functions, Analytics, Crashlytics, Cloud Messaging, App Check / Play Integrity, ML Kit, Cloud Logging) — running the app and its backend
- Apple (App Attest, push notification delivery, App Store) — device attestation, notifications and app distribution on iOS
- ti.to — ticket lookup
- Resend — sending the verification email and the post-conference list of people you scanned
- Shorebird — app code updates
Your rights from section 5 apply to app data too.
8. Deleting your app account
In the app: go to Profile > Delete account. This immediately deletes your Firebase Authentication account, your user record (name, email, registration reference, favourite sessions and networking connections) and any pending verification codes.
Without the app: email devfest@gug.cz from the email address on your ticket with the subject "Delete my DevFest app account". We delete the same data within 30 days.
What is not deleted: usage analytics, crash reports and App Check signals are not linked to your account, so they cannot be picked out and deleted; they expire on their own (analytics after 14 months, crash reports after 90 days). Data kept only on your device goes away when you uninstall the app. If another attendee scanned your badge, your name and company stay in their list until they delete their account; email devfest@gug.cz and we will remove them. Your ti.to ticket itself is not affected.
The same instructions are on a page of their own at devfest.cz/delete-account.