LUX · Amsterdam event discovery
Privacy policy
Last updated 16 October 2026. Applies to the LUX website and app and everything reached from it.
Want to download or delete your data? Your data: download or delete it shows every step. Cookies are listed below. All legal pages: Privacy & legal.
The short version
No account is needed to browse. Nothing is measured until you say yes. An account holds only what you type in, is hidden from other people until you choose otherwise, and can be downloaded or deleted by you at any time, in one tap, without asking us. We use no third-party analytics, advertising or tracking service.
Who is responsible
This policy describes LUX as it runs on luxsocialmap.com and in the app built from it. LUX is not run by a company yet; if that changes, this page will name the company.
LUX is a proof of concept run by Luk, in Amsterdam, the Netherlands. Luk is the controller of the personal data described on this page. LUX is independent: no sponsor or partner receives your account, profile, messages or measurement records; anything we share outside LUX is aggregate numbers (counts and rates) only. LUX is an unofficial guide and is not affiliated with, endorsed by or connected to Amsterdam Dance Event or its organisers.
Questions, requests and complaints about this policy: blueimpactfund@gmail.com. We answer within one month.
What we hold, why, and for how long
Each row is one purpose. “Contract” means the thing you asked the site to do for you; “consent” means you can withdraw it at any time. A clean-up job runs once a day and deletes what is past its period.
| Purpose | Data | Legal basis | Kept |
|---|---|---|---|
| Browsing the map | Nothing on our servers. Your theme, filters and picks stay in your browser, and so do your stars until you sign in; signed in, they are also saved to your account (see Stars and chat). | — | Until you clear the site data |
| Measurement | A random id made in your browser, a session id, which pages and events you open, save, share and tap, the campaign link you arrived on, your answers to short questions, which version of the site you were shown | Consent | Raw records 90 days; totals after that |
| Signing in | Your email address; a one-time link (stored hashed) with a salted hash of your IP address to stop abuse | Contract | Link 15 minutes; email until you delete the account |
| Staying signed in | A session token (stored hashed) in one cookie | Contract | 30 days, or until you sign out |
| Your language | The language you chose for LUX (English, Dutch or Spanish), so every page, a new phone and our emails use it | Contract | Until you change it or delete the account |
| Username and password | The username you choose for signing in (other members never see it) and, only if you save one, your password as a salted scrypt hash that nobody can read back; failed sign-in attempts per account and per network (the network stored hashed) | Contract: letting you sign in | Username and password until you change or remove them or delete the account; failed attempts 15 minutes |
| Your profile | Alias, visiting or local, interests, languages, dates in the city, first or repeat ADE, what you are looking for at a party (optional, up to two), visibility choice, an optional photo (with camera metadata removed), your 18+ confirmation | Contract | Until you change or delete it |
| Beta Lounge verification | That a founder saw your ID next to your face on a call or in person, who did it, when, and your year of birth; who invited you; which version of the Lounge terms you accepted. Never a copy, photo or number of your ID | Legitimate interest: making sure everyone you can meet is a real adult; your acceptance of the terms | Until you delete the account; access log entries 12 months |
| Going and Here now | Which event, when, and the visibility you picked. “Here now” is a manual check-in at event level; the site never reads your device location | Contract | Here now: 8 hours or 2 hours after the event ends, then 30 days for totals. Going: 90 days after the event |
| Emails | Your choices: friends activity emails (on unless you switch them off: someone sent you a friend request, accepted yours, or sent you a private message, never what it says) and news about your friends and ADE (only if you opt in, at most one a week; we keep when you agreed and to which words, and when you withdrew). A record of which emails we sent you and when, to send no more than that | Activity: contract (telling you about your account). News: your consent, which you can withdraw any time | Your choices until you change them or delete the account; the sent-email record 90 days. Every email has a link to stop all emails |
| Friends | Your choice of who can find you (the whole LUX community by name, or only people with your friend code), your friend code, your friend requests and friendships, and a count of your name searches for the last hour (to stop anyone walking the member list). Others only ever see your name as you wrote it and how many friends you have in common; never who your friends are | Contract: letting the people you choose find and add you | Your choice and code until you change them or delete the account; a friendship until either of you removes it, blocks, or deletes the account; the record of your searches after 24 hours |
| Stars and chat | The events you star (so your list follows you to a new phone), and the messages you write to a friend. Messages travel encrypted (HTTPS) and are stored encrypted with a key that only the LUX operator holds, kept apart from the database; they are not end-to-end encrypted. We open a message only to act on a report or when the law requires it. We also keep who wrote to whom and when. Messages written before 6 October 2026 were end-to-end encrypted on your phone and stay that way | Contract: keeping your list and carrying your conversation | Stars until you remove them or delete the account; a conversation 90 days after its last message, or 90 days after either of you blocks the other. If you report someone from a chat, your phone sends the last 20 messages as it reads them, and we keep them with the report as evidence, for as long as the report is kept |
| Points and surveys | Your founding-member points (how many, when and why: a survey, or a thank-you from the LUX team) and, if you answer a survey, your answers. Only you and the LUX founders see them | Contract: keeping your points; legitimate interest: improving LUX from your answers | Until you delete the account |
| Genre suggestion | If you pick “Other…” when you join, the genre you type. Only the LUX founders see it; it never shows on your profile | Legitimate interest: keeping the genre list complete | Until you delete the account |
| Friends see your Going | Your choice whether friends may see the parties you marked Going (off unless you turn it on, on the Friends screen) | Contract: showing your plans to the friends you chose | Until you change it or delete the account |
| Meeting people | Requests you send and receive, their short note, accepted or declined, and the contact method you chose to reveal after acceptance | Contract; revealing a contact method is your explicit choice each time you accept | Unanswered requests 30 days; others 90 days after they are answered |
| Blocking | Who you blocked | Legitimate interest: your safety | Until you unblock or delete the account |
| Reporting | Who reported whom, the reason and note, what an operator decided | Legitimate interest: keeping the service safe | Open reports until handled; handled reports 12 months |
| Pro purchase | Your account id, what you bought, when, the amount, the campaign link, refunds. Never card details: in this test version the checkout is a mock page of our own that takes no payment; with real payments it will be the provider’s hosted page | Contract; keeping records is a legal obligation | As long as tax law requires once real payments exist; in this test they stay after you delete the account, with an account number that points at nobody |
| Comparison test | Whether your random id (and, once signed in, your account) was shown the version with or without the meeting-people features | Consent, as part of measurement | Deleted with the raw measurement records |
| Sharing links and who brought whom | When you share an event, your night, your Passport or LUX itself, the link carries your referral code (seven characters; it is not your friend code and cannot be used to add you as a friend). When someone opens such a link we record whose code it was, the event, where it was shared (for example WhatsApp, a story, copied), the page, and the visitor: their account number if they are signed in, otherwise a shortened salted hash of their IP address, never the address itself. The same visitor on the same link counts once an hour; opening your own link counts for nothing. Only if the visitor has said yes to the usage-stats question does their browser keep the code in the lux_ref cookie for 30 days (the newest link wins); without that yes, the code stays only in that browser tab, for the invitation itself. If, while the code is there, they create an account, say Going, star an event or become friends with someone, that is credited to the member whose link it was. Nobody is told who brought them, and you are never shown by name who joined through you, only how many | Legitimate interest: showing members the reach of what they share, and understanding how LUX grows. The cookie: your consent | The shortened IP hash 30 days; a visit 12 months. Credits for Going and stars until 90 days after the event; credits for sign-ups, friendships and ticket orders while both accounts exist. All of it goes when either account is deleted |
| Influence levels | Your level (Explorer; Connector from 5; Selector from 25; Curator from 100; Scene Builder from 500) is counted from the number of different people who joined something through your links, with your own numbers (sign-ups, Going, ticket taps). Only you see your level and numbers. The founders see totals per event and the members who brought the most people, by alias, to learn what works. A level is recognition only: it gives no money, no perks you can claim and no rights, and no decision with legal or similarly significant effect on you is based on it | Legitimate interest: recognising members who bring friends | Counted again each time from the credits above; nothing extra is stored |
| Ticket links | Every Get tickets button goes through a LUX link (/go/…) on its way to the ticket shop. We record a click id, the event, where on the site you tapped, the ticket page address, your account number if you are signed in, and the member whose link brought you, if any. The ticket shop receives the click id (lux_click) and tags in the address (utm_source=lux, utm_medium=social and the sharing member’s referral code); never your name, email or account number, and the referring page is not sent. LUX does not sell tickets: you buy from the shop under its own terms and privacy policy. If a ticket shop sends us its sales list, it holds the click id, order number, amount and status, never the buyer’s name, email or payment details. The founders can note what a shop would pay per order and a member’s share of it to test the bookkeeping; no money is paid to members and none is promised | Legitimate interest: knowing which links lead to tickets, and matching a ticket shop’s report | Your account number is removed from a click 90 days after the event unless a ticket order was matched to it; clicks, orders and bookkeeping notes are deleted after 24 months (no money moves in this test; if a share were ever paid, its record would be kept 7 years, as Dutch bookkeeping law requires). When an account is deleted, its number is removed from clicks at once and any unpaid share is cancelled |
| Connected profiles (when switched on) | The Instagram, Spotify or Snapchat username or profile link you type in yourself, and whether to show it. LUX does not sign in to those services and receives nothing from them; a handle is labelled as added by you, not verified. On show, it is visible to you, your friends and people who can already see your card at an event, nobody else. LUX never shows or ranks by follower counts | Contract: showing the profile you chose to add | Until you remove it (Disconnect) or delete the account |
| Social Passport and share pictures | Your Passport is worked out when you open it, from your own Going, Here now and stars, the cities and sounds of those events, how many people you met and how many joined through you. Its story picture is drawn on our server when you ask for it and handed to your phone; it shows your first name, those numbers and your referral link. An event story picture shows the event and, if you add it, your first name. We do not store these pictures; once you post one, the app you post it in decides who sees it | Contract: making the picture you asked for | Not stored |
| Testing the new LUX | If you open a tester link from the LUX team: which link, when you first and last came, how often, which screens you opened, and whether you went back to the classic LUX | Legitimate interest: improving LUX with the people who chose to try it | Until 90 days after ADE (26 January 2027); the founders see it |
| Ticket wallet | The ticket file stays on your phone and is never uploaded. LUX keeps which party you added a ticket for, how (Wallet pass, PDF, picture or link), the seller’s name and a scrambled code (HMAC) of the ticket’s barcode, so one ticket cannot unlock party chats for several accounts. Never the file, the barcode itself or the name on the ticket | Contract | Until you remove the ticket or delete your account |
| Party chats | Your messages in the chat of a party you are going to with a ticket, stored encrypted. The members of that chat see them; the founders see a message only when it is reported | Contract | The chat closes 12 hours after the party; its messages are deleted 7 days later |
| Let people find me on LUX | Only if you switch it on in your profile: your photo (or first letter), first name, up to three sounds and where you’re from are shown to everyone who opens LUX, signed in or not, on Home and Meet your crowd. Never the parties you go to, your chats or where you are. Members can say hi with the normal request; blocks still apply | Consent, which you withdraw by switching it off (your face disappears at once and the old photo address stops working) | Until you switch it off or delete your account |
| We met | When you tap “We met” for a friend after a party you were both going to. Only you and the LUX team see your marks; the founders see totals | Legitimate interest: measuring whether LUX helps people meet | Until you undo it or delete your account |
| Checking new profile photos | The photo, once, by Anthropic’s AI; the outcome (pass, refused, held) | Legitimate interest: a safe community, also for people who see faces without an account | Outcome while the account exists; a refused photo is never stored |
| Running the server | Short-lived request logs at our hosting providers, Railway and Vercel (IP address, page, time) | Legitimate interest: security and operation | Days, not weeks |
What is never asked for: your phone number, precise location, contacts, a device fingerprint, or anything from other apps. If you choose WhatsApp as the contact method to reveal after an accepted request, that handle is your number; it is shown to nobody else.
What other people can see
Nothing, by default. Your profile starts hidden. When you choose to be visible, this is the whole of what is shown:
- People going to the same event or, if you pick it, anyone signed in: your alias, visiting or local, interests and languages, what you are looking for at a party if you said, plus that you are going or are there now. Your photo is not shown to others in this version. Never your email, your dates or your account id.
- Someone whose request you accepted, or who accepted yours: additionally the one contact method you saved, if any. You can remove it at any time and it disappears for everyone.
- Your connected profiles (Instagram, Spotify, Snapchat), if you added them and left them on show: your friends and people who can already see your card at an event. Your influence level and numbers are seen only by you, and by the founders as described above.
- Operators (the people running the test) see aliases and account ids in the moderation queue and the purchase list, never email addresses in the live deployment. They see who reported whom, by alias, in order to act on it. They can hide a profile or photo if it breaks the rules.
- No other visitor sees whom you blocked, whom you reported, your measurement records or your answers to the short questions; the readout only ever shows totals.
Blocking is mutual and immediate: neither of you sees the other again, and any open request between you is closed.
The Beta Lounge
During the ADE test, seeing who is going and meeting people is open only to members of the Beta Lounge: people invited by a member and verified by one of the founders. Verification is done by showing, never sending: on a short video call or in person you hold your ID next to your face, and the founder checks that it is you and that you are 18 or over. We do not take a photo, screenshot or copy of your ID, and we do not store your document number. We record only that you were verified, by whom, when, and your year of birth. The rest of the map works without any of this.
You can also join through the shared invite-only link (/join/lux). There you tell us who shared it with you, by first and last name, or the link carries that member’s number. We use it only to connect you to that person in the invite tree and to decide whether to approve you; only the founders see it. If a mailer is set up, we send a 6-digit code to confirm your email address; the code and your sign-up details are kept for at most 15 minutes until you confirm. Joining from one place too many times an hour is refused, using your IP address, which is kept in memory for an hour and never stored. A founder approves or declines each person, and each decision is written to the access log. Declined sign-ups are kept so the same person is not asked twice, and are deleted when the account is.
You join through a personal invite link from a member. Joining asks for your email address, that you are 18 or over, and that you accept the Lounge terms. In the beta we do not send you mail to confirm the address; we keep it to find your account again and to contact you about the beta, and it is never shown to other members. If you lose access (a new phone, cleared cookies), a founder can make you a personal sign-in link that works once, for 24 hours; making one is written to the access log.
A founder may also share one group link for a night, usable by a limited number of people and expiring within a day. Joining also asks for your first and last name, three music genres you like and, if you want, a photo. Other members see your first name, the first letter of your last name, your genres and your photo; your full last name is seen only by the founders, for safety. Instead of the ID check, a founder who knows you in person may verify you by confirming that you are 18 or over; in that case no year of birth is kept. Your names are included in your data download and deleted with your account.
Trust between members: inviting someone counts as vouching for them, and any verified member can also mark “I know them” on another member and take it back at any time. When you look at another member you see only the friends you both have, by alias, and they see the same about you; a friend means a two-way tie (one of you invited the other, you connected, or you vouched for each other). Everything else is shown only as numbers: how many people vouch for them, whether a founder verified them, and how many invite steps they are from a founder. The founders can see the full map of invites and vouches, for safety only; each look is written to the access log. Blocked people are never shown to each other. Vouches you gave and received are in your data download and are deleted with your account.
Founders and moderators look at private information (reports, the people involved, verification records) only to keep people safe, and every such action is written to an access log with who did it and why. The lab pages that show member data open only for a signed-in founder or moderator, and each view is logged. Access log entries are deleted after 12 months. When you delete your account, entries about you stay until then but point at an account number that no longer belongs to anyone. Your data download includes the Lounge records about you and the staff actions on them.
The “Share my night” message and the “Home safe” reminder are made on your own device and sent through your own messenger to a friend you choose. They never pass through our servers and never contain a location. We suggest sharing live location with a close friend through your phone’s own Find My or Google Maps, which we never see.
Measurement
The first time you open the map it asks whether we may count how it is used. If you say no, nothing is recorded and you are not asked again. If you say yes, the records listed in the table above are stored in our own database under a random id created in your browser; it is not derived from anything about you. When you sign in, records made from then on also carry your account’s number, so the readout can tell travellers from locals; deleting the account leaves a number that points at nobody.
Some visitors see a version without the meeting-people features so we can compare the two. Which version you get is random, decided from your random id, and stored as a word next to that id and, once you sign in, next to your account number, so every device gets the same version. No decision with a legal or similar effect on you is taken automatically; the only automation is the order of the attendee list, which puts people with shared interests first.
Your current choice on this device: ….
Who else receives data
Your account, profile, messages, purchases and measurement records are kept in our own database at our hosting provider and are not given to anyone else. These things reach outside services, plus any outside link you tap yourself (directions, a WhatsApp share):
- Map tiles: the map is drawn from tiles and a map style served by CARTO (CartoDB S.L., Madrid, Spain) from basemaps.cartocdn.com, made from OpenStreetMap data. Your device requests them directly, so CARTO sees your IP address and the part of the map you look at, as with any website you visit. The classic map at /classic fetches its tiles from the OpenStreetMap Foundation instead, and the location picker on the venue-submission page from OpenFreeMap.
- Ticket shops: Get tickets takes you to the shop through our
/golink. The shop receives the click id and tags described under Ticket links above; from there its own terms and privacy policy apply. - Find my sound: the artist names you type in that box, and any “describe a vibe” sentence, are sent from our server (not from your device, so without your IP address or any id) to music catalogues to find out how an artist sounds: Deezer (France), MusicBrainz (MetaBrainz Foundation, United States) and, when configured, Last.fm (United Kingdom) and Google’s Gemini (United States) for a short description. Nothing else about you travels with the text. The sound-matching model itself is fetched once from Hugging Face and runs on our server.
- The pager and venue pages use a hosted database (Supabase) when it is configured; in this deployment it is not, so they store nothing.
Hosting. Railway hosts the server and the database in the EU (Amsterdam, the Netherlands); that is where your account, profile, stars and chats are kept, under Railway’s data processing terms.Vercel is the front door for luxsocialmap.com: it passes each request (with your IP address) on to that server and does not keep your account data. Vercel is a United States company, so passing requests through it is a transfer outside the EU; it relies on the EU–US Data Privacy Framework, under which Vercel is certified, and on the Standard Contractual Clauses in Vercel’s data processing agreement. The key that encrypts chat messages is kept as a separate secret, not in the database.
Email. Resend sends the emails with your sign-in and joining codes and the emails you chose above, from the EU (Ireland); it sees your email address and the email.
Fonts. The typeface is served from our own site; your browser does not contact Google Fonts.
Your personal data is never sold and is never shared with sponsors, promoters or advertisers in a form that identifies you; anything shared outside LUX is totals only.
Your rights
Under the GDPR you have the following rights, and each has a button rather than a form:
- Access and portability: Download my data under Profile → Settings gives you everything we hold about you as a JSON file, other people shown by alias only. People who joined through your links are counted, not named. Step by step: Your data.
- Rectification: every field on the profile page can be changed by you; to change the email address, write to us.
- Erasure: “Delete my account” under Profile → Settings removes your profile, photo, sign-ins and sign-in history, name searches, old chat keys, username and password, check-ins, stars, points, survey answers, requests, friendships, the chats you are part of, contact method, blocks, connected profiles, your referral code with the visits and credits through your links (and your own visits through other people’s links) and your place in the comparison test at once, and erases the text of any report you wrote. What remains: the fact of reports made by or about you (with the account number pointing at nobody), an operator’s record of any moderation action on the account, one entry noting the deletion, staff access log entries until their 12 months are up, purchase records the law requires us to keep, ticket clicks without any account number, and measurement rows that carry that same number until their 90 days are up. A full copy of the database that a founder downloaded as a backup still holds the account until that copy is deleted. If you cannot sign in any more, write to blueimpactfund@gmail.com and a founder deletes the account for you the same way; see Your data. The download and the deletion both include your tester visits, your ticket wallet records (not the ticket files, which are only on your phone), your party chat messages and your “We met” marks.
- Withdrawing consent to measurement: the Measurement section on this page, on each device. After that nothing on the server can be linked to you; send us the id shown there and we delete its records the same day.
- Objection and restriction: write to us at blueimpactfund@gmail.com.
- Complaint: you can complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or the authority of the country you live in.
Security
Sign-in links and session tokens are stored only as hashes. Cookies are HttpOnly and, in production, sent over HTTPS only. Anything that touches your account needs your signed-in session and either a JSON request or a method a cross-site form cannot send, and the few anonymous endpoints (measurement, the sign-in request, sponsor counts, the comparison test) are limited per address. Attendee cards carry a short-lived token instead of an id, so accounts cannot be enumerated. The meeting-people features have a kill switch an operator can flip in seconds, and a moderation queue. If a breach were to affect you, we would tell the supervisory authority within 72 hours and you without undue delay.
Photos
A profile photo is optional, limited to 200 KB, re-encoded in your browser before upload where the browser can, and always stripped of camera metadata (position, time, device) the moment it arrives; a file we cannot process is refused rather than stored. Your friends see it, and if you switch on “Let people find me on LUX”, everyone on LUX sees it next to your first name. Before anyone else sees a new photo, an AI model from Anthropic (a United States company, under its commercial terms, which do not allow training on your photo, and the Standard Contractual Clauses in its data processing terms) looks at it once: does it show a real person, and is it free of nudity, hate symbols, violence and ads. Anthropic keeps it only briefly, as its terms allow for abuse monitoring. A refused photo is not stored; if the check is unsure, only you see the photo until a LUX founder has looked at it. We keep a one-line note of each check (the outcome, never the image) while your account exists. An operator can hide or remove a photo that breaks the rules and switch off photo uploads for an account. Deleting the photo or the account removes it.
ADE programme pictures and artists
During Amsterdam Dance Event, LUX shows each party’s flyer, its line-up and the artists’ photos as they appear in the official ADE programme on amsterdam-dance-event.nl, with a credit and a link to the party’s own page. For other nights in Amsterdam, the flyer comes from the organiser’s or venue’s own page, credited and linked the same way. The pictures stay on their servers; we store only their address. For artists this is the professional information they or their promoter published to promote their show (stage name, country, photo, sets), shown on the basis of legitimate interest: helping people find the music they came for. We add nothing about an artist from elsewhere, and opening an artist page is counted, never linked to the artist’s private life. An artist, agent or promoter who wants a picture changed or removed can write to blueimpactfund@gmail.com; a founder takes it out the same day, without a new release.
Pro and sponsors
ADE Pro is a one-off purchase. In this test version the checkout page is our own and takes no payment; with real payments it will be a payment provider’s hosted page. Either way we never see card details. Some rows on the map are sponsored: always labelled, only in two agreed places, never changing how the rest of the list is ordered. That a sponsored row was shown to you or opened is counted once a day under the same random id as everything else, and only if you said yes to measurement. Merchandise links open the shop in a new tab; we count the tap and nothing else, and the shop’s own privacy terms apply there.
Map tiles and sharing
The background map is drawn from CARTO’s tiles (basemaps.cartocdn.com), made from OpenStreetMap data. When you move the map, your device requests those tiles directly from CARTO, which sees your IP address, as with any website you visit. CARTO’s policy is at carto.com/privacy; the OpenStreetMap Foundation’s (for the classic map) is at osmfoundation.org. When you share an event, your night or your Passport, the site hands a link (with your referral code), a short caption and, for stories, a picture to your phone’s share sheet; what happens next is governed by the app you pick. Find my sound looks the artists you type up in the music catalogues named above, through our server; the artists you pick are saved in your browser only.
The pager and event hosts
The site carries a pager (messaging a friend by scanning their code) and venue-submission pages inherited from the map it grew from. When configured they use Supabase as their database: the pager stores an anonymous identity with the public half of a key pair made on your device, your pager number and emoji, and messages encrypted on your device before they are sent, which nobody can read; venues and promoters sign in with a one-time link and their email address is stored to know who submitted what. In this deployment neither is configured and nothing is stored for them.
Age
The events listed are nightlife events for adults. The site is not directed at children and we knowingly collect no data from anyone under 18. Becoming visible to others or contacting anyone requires confirming you are 18 or over.
Changes
If any of this changes, this page changes with it and the date at the top moves. Anything that would use your data for a new purpose is asked for, not assumed.
made by luk :) have fun