Privacy Policy & Legal Notice

Legal Notice

This website is operated by the organization identified below.

Who operates this site

Free Cities Foundation
30 North Gould Street, Suite R
Sheridan, WY 82801
USA

A U.S.-registered 501(c)(3) nonprofit organization, incorporated in Wyoming.
Federal Employer Identification Number (EIN): 99-0806210

Represented by

The Board of Directors:
Dr. Titus Gebel (Chairman)
Dr. Marc-Felix Otto (Director)
Alexander Voss (Director)
Peter Young (Director & Managing Director)

Contact

Email: info@free-cities.org

Representatives in the EU and UK (Art. 27 GDPR / UK GDPR)

European Union:
Hynek Fencl
Chodská 32
120 00 Praha 2
Czech Republic

United Kingdom:
Kynara Ltd
86-90 Paul Street
London, England, EC2A 4NE

Copyright

Except where third-party content is identified as such, the content and works on this site are © Free Cities Foundation. Reproduction, adaptation or any use beyond the limits of applicable copyright law requires our prior written consent. If you believe any content on this site infringes your rights, please contact us and we will address it without undue delay.

Privacy Policy

The Free Cities Foundation (“we,” “us,” “our”) respects your privacy. This policy explains what personal information we collect when you use our website and services — chiefly our donations, event registration and ticketing, newsletter and Member Portal — how we use and share it, how long we keep it, and the choices and rights you have. We are a U.S.-registered 501(c)(3) nonprofit incorporated in Wyoming, so assume the information we hold is stored on, or accessible from, servers in the United States. If you are in the European Economic Area, the United Kingdom or Switzerland, section 10 sets out your additional rights.

1 · Information we collect

Information you give us. Depending on how you interact with us, this includes:

• Donations — your name and email address and, where you provide them, postal address and phone number, together with the amount, currency, frequency, designated fund and date of your gift. We need this to process your contribution, issue the tax receipt required by law, and keep the financial records we are obliged to maintain.
• Event registration and tickets — your name and email address, billing and attendee details, the items ordered and the order/ticket reference, and anything you choose to add such as your organization or accessibility and dietary requirements. Age-limited rates, such as the Young Person ticket, also ask for the attendee's date of birth; we use it only to confirm eligibility for that rate, and staff see it at the door when the ticket is scanned so they can check it against photo ID.
• Member Portal accounts — your email address and the account record associated with it. Sign-in is passwordless: we email you a one-time, time-limited “magic link,” and we process authentication metadata (such as IP address and timestamps) to issue and validate it and keep the account secure.
• Member directory (optional) — if you choose to create a listing in the members-only directory, the name, one-line description and interests you enter there are shown to other eligible members while your listing is switched on. Listing yourself is strictly opt-in, you can hide or edit your listing at any time in the portal, and your email address and donation history are never shown.
• Member achievements — inside the Member Portal we keep an activity score (“XP”) for your account, derived from your interactions with us: giving milestones, referral results, event participation, and the document and date on which you first open a member publication. It is shown only to you and to our team, and donation amounts cannot be derived from it.
• Newsletter — the email address you submit, plus the date, time and IP address of your sign-up and your confirmation (so we can show that you opted in).
• Attendee surveys — after a conference we may ask the people who attended how it went. Answering is voluntary and every question is optional. We store your answers and a note of whether you were signed in to the Member Portal at the time. We do not store your IP address with a survey response and we do not link it to your account, so a response carries your name or email address only if you chose to write one into the form. If you use the survey to ask for our newsletter, that address goes through the ordinary confirmation step described above.
• Contacting us — the contents of any message you send us and the address you send it from. This includes an application to speak at our conference: what you write in that form is emailed to us and lives only in our inbox, as no copy is kept on the website.

Information collected automatically. When you visit the site, our hosting infrastructure records standard server log data — your IP address, the date and time of the request, the page or file requested, the referring URL, and your browser and operating-system type — to operate the site securely, prevent and investigate abuse, and keep it running well. Where you consent (where consent is required), we also collect usage and device information through the analytics tools described in section 4. We do not ask for, and you should not send us, sensitive information (such as government identifiers or health data), apart from the limited accessibility or dietary details you may volunteer when registering for an event.

2 · How we use your information

We use the information above to:

• process donations and issue the tax receipts and annual giving statements required by law;
• fulfil event registrations and ticket orders, and send you essential information about an event you signed up for (such as schedule changes or access instructions);
• confirm that you qualify for a reduced ticket rate that is limited by age, where you book one;
• operate the Member Portal and your account, including passwordless sign-in;
• send our newsletter, where you have asked to receive it;
• respond to your enquiries;
• secure our services, prevent fraud and abuse, and diagnose and fix technical problems;
• measure and improve our website, content and campaigns; and
• comply with our legal, tax and accounting obligations.

3 · How we share your information — service providers

We do not sell your personal information, and we do not share it except as described here. We rely on a small set of vendors who process data on our behalf, under contract and only on our instructions, to run our services. Our main providers are:

Hosting, infrastructure and email

• Cloudflare (Cloudflare, Inc., USA) hosts and serves the website and processes the server log data described above. It also provides Turnstile, the spam check on our contact and speaker-application forms, which receives your IP address and technical signals from your browser to tell a person from a bot; it sets no cookies. Privacy policy.
• Supabase (Supabase, Inc., USA) provides the database and authentication that store accounts, donations, receipts, memberships and event registrations. Privacy policy.
• Resend (Resend, Inc., USA) delivers our email — both the newsletter and transactional messages such as receipts, annual statements and sign-in links. Privacy policy.
• Sentry (Functional Software, Inc., USA) provides error and performance monitoring. We have configured it not to attach your IP address, request headers or cookies. A fault may attach a short session replay of the affected page; replays mask all text and input you type and block media. Privacy policy.
• Sanity (Sanity AS) is our content management system. Page content and images are delivered through Sanity’s image CDN, which receives your IP address when an image loads. Privacy policy.

Payments

Payments are handled by specialized payment providers. We do not receive or store your full card number or other complete payment-instrument details; only a transaction reference is returned to us. Depending on the method you choose:

• Card — Stripe (Stripe, Inc., USA). Privacy policy.
• PayPal — PayPal (PayPal, Inc., USA). Privacy policy.
• Bitcoin — processed through our own self-hosted BTCPay Server; no third-party payment processor is involved. The transaction is recorded on the public Bitcoin blockchain, which is permanent and outside our control.

Event ticketing

Our ticket shop runs on Pretix, ticketing software we host ourselves at tickets.free-cities.org, so your order and attendee details are processed by us and not shared with the makers of Pretix. Card payments there go through Stripe and Bitcoin payments through our own BTCPay Server, as above.

Other recipients

We may also disclose information when required by law or legal process, to protect our rights, safety or property, or in connection with a merger, acquisition or similar transaction. Our website footer links to our profiles on social networks; those are plain links, and visiting a network is governed by that network’s own privacy policy.

4 · Cookies, analytics and advertising; your choices

Cookies are small text files, and similar technologies (such as browser local storage), that store information on your device. We use two kinds:

• Strictly necessary — required for the site to work, for example to keep you signed in to the Member Portal, remember your choices during a donation or ticket checkout, and for security. These are always on.
• Optional — analytics and advertising tools, and third-party content such as embedded videos, that are not strictly necessary.

The optional analytics and advertising tools we use are:

• Google Analytics 4 (Google LLC, USA) — shows us which pages are visited and how visitors find us, including completed donations. We have configured it not to store your full IP address. You can opt out with Google’s opt-out browser add-on. Privacy policy.
• Meta Pixel (Meta Platforms, Inc., USA) — measures actions taken after you see or click one of our campaigns and lets us build audiences; Meta may combine this with your Facebook/Instagram account. Privacy policy.
• PostHog (PostHog, Inc., USA) — product analytics for our donation and sign-up flows, including anonymized session replays and heatmaps. Replays mask all text you type, and card data is entered inside the payment provider’s own frame and never reaches us or PostHog. Privacy policy.
• Embedded YouTube videos (Google LLC, USA) — when a page has an embedded video, your browser connects to YouTube to load the player, which may set cookies and receive your IP address; if you are signed in to Google, YouTube can associate the view with your account. We use YouTube’s privacy-enhanced mode where available. Privacy policy.

Your choices. In the United States these optional tools are on by default. You can opt out at any time using the provider links above, your browser’s cookie controls, or, for advertising, the industry choice pages at optout.aboutads.info and networkadvertising.org/choices. Blocking strictly-necessary cookies may break signing in or completing a purchase. Visitors in the EU/EEA, the UK and Switzerland are asked for consent before any optional tool runs — see section 10.

5 · Data retention

We keep personal information only as long as needed for the purposes described here, then delete it or render it anonymous. Donation, ticketing, receipt and other financial records are retained for the periods required by applicable U.S. tax and accounting law; newsletter data until you unsubscribe; account data while your account is active; survey answers for as long as they inform how we plan our events, since they are not linked to an account and cannot be traced back to you unless you wrote your name into one; and server logs until they are no longer needed for security and operations.

6 · Data security

We use appropriate technical and organizational measures to protect your information against loss, misuse and unauthorized access: encryption in transit (TLS/HTTPS), access controls and row-level database security, and never storing full payment-instrument data on our systems.

7 · Children’s privacy

Our services are directed at adults and are not intended for children. Consistent with the U.S. Children’s Online Privacy Protection Act (COPPA), we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it. A higher age threshold applies to visitors in the EU/EEA — see section 10.

8 · Your U.S. state privacy rights

Several U.S. states — including California (the CCPA, as amended by the CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon and Montana — give residents rights to know, access, correct and delete their personal information and to opt out of targeted advertising or its “sale.” Most of these laws exempt nonprofit organizations, so they may not apply to us. We extend those choices to everyone regardless: you can ask us to access, correct or delete your information, and opt out of marketing at any time, at info@free-cities.org. We do not sell your personal information. The optional tools in section 4 may count as “sharing” for targeted advertising under some state laws; the opt-outs are in that section. We will not discriminate against you for exercising these choices.

9 · International data transfers

We are based in the United States and most of our providers process data there, so your personal information will be transferred to and processed in the United States. If you are in the EU/EEA, the UK or Switzerland, such transfers are made under appropriate safeguards: many of our U.S. providers are certified under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions), and where a provider is not certified we rely on the European Commission’s Standard Contractual Clauses (with the UK Addendum) or another lawful transfer mechanism. You can request more information, or a copy of the relevant safeguards, at info@free-cities.org.

10 · EU/EEA, UK and Swiss visitors

For visitors in the European Economic Area, the United Kingdom and Switzerland the EU General Data Protection Regulation (GDPR) and the UK GDPR apply, and the controller is Free Cities Foundation (address in the Legal Notice above).

Consent for optional cookies. If you are in one of these regions, none of the optional analytics or advertising tools in section 4 run until you agree. We show a consent banner and load them only after you select “Accept.” You can withdraw consent at any time through the “Cookie settings” link in our footer; this does not affect processing carried out beforehand. To decide whether the banner applies, our hosting platform derives your approximate country from your IP address at the moment of your visit; it is not stored.

Legal bases. Where the GDPR/UK GDPR applies, we process your data on the basis of: the performance of a contract or pre-contractual steps (Art. 6(1)(b)) for donations, tickets and accounts; compliance with a legal obligation (Art. 6(1)(c)) for tax and accounting records; your consent (Art. 6(1)(a)) for the newsletter and optional cookies; and our legitimate interests (Art. 6(1)(f)) in operating, securing and improving our services.

Your rights. You have the right to:

• access a copy of your personal data (Art. 15);
• have inaccurate or incomplete data corrected (Art. 16);
• have your data erased, or its processing restricted, in the circumstances set out in Art. 17–18;
• receive the data you provided in a portable, machine-readable format (Art. 20);
• object to processing based on our legitimate interests, and to direct marketing at any time (Art. 21);
• withdraw consent at any time, with effect for the future (Art. 7(3)); and
• lodge a complaint with your local supervisory authority — in the UK, the Information Commissioner’s Office (ICO) (Art. 77).

We do not use your data for automated decision-making that produces legal or similarly significant effects (Art. 22). Our EU and UK representatives under Art. 27 are named in the Legal Notice above, and international transfers are explained in section 9. The minimum age of digital consent is 16, or the lower age set by your member state. To exercise any right, contact us at info@free-cities.org or our data-protection contact, Peter Young.

11 · Changes and contact

We may update this policy; the current version is always on this page, with its “last updated” date at the top. Where a change materially affects processing based on your consent, we will ask again. For any question about this policy or your information, contact us at info@free-cities.org.