OpenCON — Privacy Policy
Last updated: 28 October 2026
OpenCON is a conference platform developed and operated by Digital Cube d.o.o., Belgrade, Serbia. Each conference uses its own edition of the OpenCON app. This page covers the edition OpenCON - SFSCON (iOS, Android and the web app at https://sfscon.opencon.dev), the companion app of SFSCON 2026 — South Tyrol Free Software Conference, organised by NOI Techpark Südtirol/Alto Adige.
This policy explains what personal data the app — this edition of the OpenCON app, on iOS, on Android and on the web — processes, why, and what your rights are.
1. Who is responsible
Digital Cube d.o.o. is the provider of the OpenCON platform: it develops the app and operates the servers of every edition. For this edition of the app the responsibilities under the GDPR are:
- Data controller: the organiser of the conference this edition of the app is made for. The organiser decides what the app is used for and what is published in it. For this edition that is NOI Techpark Südtirol/Alto Adige, Via A. Volta 13/A, 39100 Bolzano/Bozen, Italy — info@sfscon.it.
- App provider and data processor: Digital Cube d.o.o., Belgrade, Serbia (company registration no. 21151491, tax id 109262972; digitalcube.rs) — info@opencon.dev. Digital Cube develops the app and runs the servers it talks to on behalf of the organiser, under a data processing agreement (Art. 28 GDPR).
For any question about this policy or your data, write to the organiser at info@sfscon.it. For technical questions about the app you can also write to the app provider at info@opencon.dev.
2. You can use the app without an account
Browsing the programme, speakers, side events, supporters and venue information works as a guest. Nothing that identifies you is collected for that. An account is only needed for personal features: your own schedule and reminders, rating talks, posting photos, and your profile.
3. What we collect, and why
| Data | When | Why (legal basis) |
|---|---|---|
| Account data: username, first and last name, e-mail address, password (stored only as a one-way hash), optionally phone number, organisation or school and student status | When you register or are invited as a speaker | To give you an account and let you sign in (contract, Art. 6(1)(b) GDPR) |
| Profile photo | Only if you add one | Shown next to your name in the app (consent, Art. 6(1)(a)) |
| Your schedule: sessions you star | When you star a session | To show "My events" on all your devices and send reminders before a session starts (contract) |
| Questions to speakers (Q&A) and poll votes | When you ask, upvote or vote during a session | To run live Q&A and polls. A question can be posted anonymously; otherwise your display name is shown with it (contract / consent) |
| Session ratings, feedback and comments | When you rate a talk or answer the conference survey | So the organiser can improve the conference (legitimate interest, Art. 6(1)(f)) |
| Photos and videos you post to the conference album, with their caption | When you post | To publish them in the conference album. Before publication a moderator reviews them (consent) |
| Metadata inside those photos and videos: date taken, camera model and, if the file contains it, the GPS location where it was taken | When you post | To help moderators sort and verify the album. Location and camera data are visible only to moderators and are never shown publicly. The app never reads your current location |
| Questions to the conference assistant (AI chat) | When you use the assistant | To answer questions about the programme (contract / consent) |
| Push notification token with platform and language | When you allow notifications | To send you reminders and conference announcements (consent — you can switch notifications off at any time in the system settings) |
| Technical data: IP address, time of request, app version, error messages | On every request to our servers | Security, abuse prevention (e.g. limiting failed sign-ins) and fixing errors (legitimate interest). Error reports do not contain your name, username or e-mail |
We do not use advertising, we do not track you across other apps or websites, we have no analytics or advertising SDKs in the app, and we never sell personal data.
4. Device permissions
All permissions are optional and asked only when you use the feature that needs them:
- Camera — to take a profile picture, take photos or short videos for the conference album, or scan a session QR code.
- Microphone — only to record sound with a short album video.
- Photos — to choose a profile picture or album media, and to save a poll QR code to your library.
- Notifications — session reminders and announcements.
The app does not request access to your location, contacts or calendar. "Add to calendar" hands an event to your calendar app without reading it.
5. Who receives data
We share data only with service providers who process it for us under a data processing agreement:
- Hosting — our servers and database are in a data centre in the European Union (Germany).
- Expo (650 Industries, Inc.) — delivers push notifications to Apple Push Notification service / Firebase Cloud Messaging and delivers app updates. Receives the push token and the notification text.
- Apple and Google — deliver push notifications to your device.
- Brevo (Sendinblue SAS, France) — sends account e-mails (invitation, e-mail verification, password reset). Receives your name and e-mail address.
- Mistral AI (France) — answers questions to the conference assistant and helps moderators review album photos (it receives a small preview image and the caption, never the location data). Data is processed in the EU.
Expo is based in the USA; transfers are covered by the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses. Digital Cube, the app provider, is based in Serbia; its access to personal data on behalf of the organiser is covered by the European Commission's Standard Contractual Clauses. The data itself stays on the servers in the European Union described above.
Publicly visible in the app: speaker profiles (from the official conference programme), questions that were not posted anonymously, and album photos after moderation.
6. Data stored on your device
The app stores your sign-in session in the secure storage of the operating system (iOS Keychain / Android Keystore), and keeps an offline copy of the public programme and your assistant conversations on the device so they work without a connection. Signing out removes your session; uninstalling the app removes everything.
7. How long we keep data
- Account and profile data: until you delete your account.
- Your starred sessions and calendar feed: as long as your account exists.
- Your session ratings, poll votes, questions (and answers in a question's thread), question upvotes and your answer to the conference feedback question: as long as your account exists. When you delete your account they are anonymised, not deleted: they stay with the session so its results and Q&A still add up, but the link to your account is cut, your name is removed from them and a question asked under your name becomes anonymous. Nothing left can be traced back to you.
- Album photos and videos: until you delete them or your account, or until the organiser removes the album.
- Push tokens: until you sign out, switch off notifications, the token expires or you delete your account.
- Server logs: only as long as needed for security and error analysis.
8. Deleting your account
You can delete your account yourself, at any time, directly in the app: Menu → My profile → Delete account. On the website the same action is in the user menu → Delete account. You confirm with your password; the deletion is immediate and cannot be undone, and every sign-in session of the account ends.
Deleted with the account: your profile (name, e-mail, phone, organisation, profile photo), your sign-in sessions, push tokens and notification settings, starred sessions, calendar feed, conference ticket and check-ins, assistant conversations, and the photos, videos and comments you posted to the album (including the files themselves). Kept, but anonymised, as described in section 7: your ratings, poll votes, questions and the conference feedback answer. If you are a speaker, your public speaker profile is part of the programme and stays; it is no longer linked to your account — write to us if you want it removed.
If you cannot use the app, you can also ask for the deletion by e-mail to info@opencon.dev — the app provider handles such requests on behalf of the organiser under the data processing agreement — or the organiser at info@sfscon.it, from the address registered on the account; we delete it within 30 days. Your own photos, comments, stars and assistant conversations can also be deleted one by one in the app.
9. Your rights
Under the GDPR you have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, to data portability, and to withdraw a consent at any time (this does not affect processing done before). Write to info@opencon.dev — the app provider handles such requests on behalf of the organiser under the data processing agreement — or directly to the organiser at info@sfscon.it. You also have the right to lodge a complaint with a supervisory authority — in Italy the Garante per la protezione dei dati personali (garanteprivacy.it).
10. Children
The app is meant for conference participants and is not directed at children under 16. We do not knowingly collect data from children under 16.
11. Security
All traffic between the app and our servers is encrypted (HTTPS). Passwords are stored only as a salted one-way hash. Access to personal data is limited to the people who run the conference and the platform.
12. Changes
If this policy changes, we publish the new version at this address and change the date at the top. Significant changes are announced in the app.