Privacy Policy
Last updated: October 6, 2026
The short version
- You don't need an account. We never ask for your email, phone number or password to use ClaimASlot.
- We store only what you type into a sheet (like a title, slots and the names people sign up with), and only for as long as needed: sheets are deleted automatically 30 days after their last date (or 180 days after the last change if they have no dates).
- We don't sell or share your personal information, don't build profiles and don't use tracking cookies.
- We plan to pay for the site with a few small ads. Ads are not active yet. Before they are, we will update this policy and ask for your consent where the law requires it.
- Sheets are hidden from search engines. Anyone you give the link to can see the sheet, so don't put sensitive information on it.
- You can delete your data yourself at any time, or ask us to.
1. Who we are
ClaimASlot (claimaslot.com) is a small independent project based in the Netherlands ("we", "us"). We are the data controller for the personal data described in this policy. You can reach us at hello@claimaslot.com or through our contact page.
2. What data we process
When you create a sheet (organizers)
The sheet's title, description, location, the optional organizer name you enter, the slots (names, dates, times, number of spots and notes) and whether names are shown publicly. We also record when the sheet was created and changed. We generate a secret organizer link for you; we store only a one-way cryptographic fingerprint (SHA-256 hash) of it, never the link itself.
When you sign up (participants)
The name you enter, an optional note, which slot you chose and when you signed up. We generate a private link that lets you change your sign-up; again, we store only a fingerprint of it.
Technical data
Like every website, our servers receive your IP address and basic browser information when you visit. Our hosting provider, Cloudflare, processes this to deliver pages and protect the site against attacks. To prevent spam and abuse, when you create or change something we count requests per network per hour. We never store your IP address itself: only a pseudonymized hash of your network, made with a secret value that changes every day and is then deleted, so old counters can't be linked back to you. Counters are normally deleted after about two hours.
Website statistics
We don't use analytics scripts or trackers on our pages. We only look at the aggregated traffic totals our hosting provider reports (such as the number of requests per day), which don't identify individual visitors.
Abuse reports and messages
If you report a sheet or email us, we process what you send us, including any contact details you choose to give.
Data stored only on your device
To let you manage your sheets and sign-ups without an account, your browser's local storage keeps your organizer links, your sign-up links and the name you last used. This information stays on your device and is not sent to us except when you use it (for example to edit your sheet). See our Cookie Policy.
What we don't collect
We don't ask for email addresses, phone numbers, payment details, precise location or any sensitive data. Please don't enter sensitive information (such as health details, financial information or ID numbers) into a sheet.
3. Why we use it and our legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Providing the service: storing and showing sheets and sign-ups | Sheet content, sign-up names and notes | Performance of our agreement with you (art. 6(1)(b)) |
| Keeping the service secure and preventing spam and abuse | Pseudonymized network hash, request counts, technical data | Our legitimate interest in a safe, working service (art. 6(1)(f)) |
| Handling reports of illegal content and complying with the law | Report details, affected sheet | Legal obligation, including the EU Digital Services Act (art. 6(1)(c)), and legitimate interest (art. 6(1)(f)) |
| Understanding how much the site is used, in aggregate | Traffic totals from our hosting provider | Legitimate interest (art. 6(1)(f)) |
| Answering your messages | What you send us | Legitimate interest (art. 6(1)(f)) |
We don't use your data for automated decision-making or profiling, and we don't use it to train AI models.
4. A note for organizers
When you organize a sheet, you decide what to ask for and who you share it with. Please collect only what your event needs, tell participants what the sheet is for, and don't add other people's personal data without their permission. For school or children's activities, first names are enough. If you use ClaimASlot on behalf of an organization, that organization may have its own responsibilities under data protection law for the names it collects.
5. Who can see your data
- People with the sheet link can see the sheet. If the organizer chose to show names, they can also see the names and notes of people who signed up. If you sign up while names are hidden, your name stays hidden from other guests even if the organizer later chooses to show names. Sheets are marked so search engines don't index them, but anyone you share the link with can pass it on.
- The organizer can always see all names and notes on their sheet and can download them.
- Cloudflare, Inc. hosts our website and database and provides security and statistics, acting as our processor under a data processing agreement.
- Authorities, only if we are legally required to share data, for example under a valid court order.
We don't sell personal information, don't share it for cross-context behavioral advertising and don't give it to data brokers.
6. International transfers
The database that stores sheets and sign-ups is located in the European Union. Cloudflare operates a global network to deliver the website quickly, so requests may pass through servers in countries outside the European Economic Area, including the United States. Cloudflare is certified under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions), and transfers are also covered by the European Commission's Standard Contractual Clauses.
7. How long we keep data
| Data | Kept for |
|---|---|
| Sheets and all sign-ups on them | Until 30 days after the last date on the sheet, or 180 days after the last change if it has no dates (at most two years). Then deleted automatically. Organizers can delete a sheet at any time, and participants can remove their own sign-up. |
| Pseudonymized network hashes and request counts | Normally about 2 hours; the daily secret used to make them is deleted after a day |
| Abuse reports | 180 days, or longer if needed for a legal claim or obligation |
| Emails you send us | As long as needed to handle your question, at most 2 years |
| Data in your browser's local storage | Until you clear it; you control this |
Deleted data may remain in Cloudflare's backup systems for a short period before it is overwritten.
8. How we protect your data
- All connections are encrypted (HTTPS).
- Organizer and sign-up links contain long random secrets; we store only fingerprints of those secrets, so a database leak would not reveal them. Our pages remove these secrets from your browser's address bar as soon as they open.
- Our pages currently load no third-party scripts, trackers or fonts.
- Strict browser security headers, input validation and rate limiting protect against common attacks.
- Data is deleted automatically when it is no longer needed.
No system is perfectly secure. If a breach affects your personal data, we will notify the authorities and, where required, you.
9. Your rights
Depending on where you live, you have the right to:
- access the personal data we hold about you and get a copy of it;
- correct inaccurate data;
- delete your data;
- restrict or object to how we use it;
- data portability: receive it in a common format;
- complain to a data protection authority.
The fastest way: remove your sign-up yourself on the sheet, or as an organizer delete the sheet. Otherwise email hello@claimaslot.com with the sheet link and the name you used. Because we don't have accounts, we may ask for details to confirm that a request is genuinely yours. We respond within one month. Exercising your rights is free.
In the EU you can complain to your local data protection authority. Our lead authority is the Autoriteit Persoonsgegevens (Dutch Data Protection Authority), autoriteitpersoonsgegevens.nl.
10. Additional information for US residents
This section applies to residents of California and other US states with consumer privacy laws (such as Colorado, Connecticut, Virginia, Utah, Texas and Oregon).
- Categories we collect: identifiers (a name you choose to enter), internet or network activity (technical data described above), and any other content you choose to type into a sheet. Sources: you, and your browser.
- Business purposes: providing and securing the service, debugging, and aggregate statistics, as described in section 3.
- Sale and sharing: we do not sell personal information or share it for cross-context behavioral advertising, and have not done so in the past 12 months. We do not knowingly sell or share data of consumers under 16. Because we don't sell or share, there is nothing to opt out of, but we honor Global Privacy Control (GPC) signals.
- Sensitive personal information: we don't collect or use it.
- Your rights: to know, access, correct and delete your personal information, and not to be discriminated against for using these rights. You can use an authorized agent. Send requests to hello@claimaslot.com.
- Retention: see section 7.
11. Other regions
If you are in the United Kingdom, you have the rights described in section 9 under the UK GDPR and can complain to the Information Commissioner's Office (ico.org.uk). Residents of Canada (PIPEDA), Brazil (LGPD), Switzerland (FADP), Australia and other countries have similar rights; contact us to use them.
12. Children
ClaimASlot is a general-audience service and is not directed at children under 13. In the EEA, people under 16 should only use it with permission from a parent or guardian. Parents and teachers may add a child's first name to a sheet for school activities; please don't add more information than needed. If you believe a child has given us personal data without permission, contact us and we will delete it.
13. Changes to this policy
We will update this policy if our practices change, for example when we switch on advertising. For significant changes we will show a notice on the site, and where the law requires your consent (such as for advertising cookies), we will ask for it first. The date at the top shows the latest version.
14. Contact
Email us at hello@claimaslot.com.