Privacy Policy

Čekin is a B2B tool for checking attendees into events — conferences, workshops, and festivals. It is provided to event organisers as a software service and consists of two components:

• The web app cekin.cz for organisers (event management, attendee import, statistics).
• The iOS app Čekin for check-in staff (QR scanning, badge printing).

This document describes what personal data Čekin processes, in which role, and under what conditions.

Čekin is not a public application. Users cannot register themselves — they are always invited: an event organiser is invited by the Čekin operator, and check-in staff are invited by the organiser. Every user therefore knowingly enters a business relationship with the platform.

Key point: for event-attendee data Čekin acts solely as a processor. The controller is the event organiser who uploaded the data. An attendee wishing to exercise their rights (erasure, rectification) should first contact the organiser. Čekin provides technical assistance to fulfil such requests.

Event organisers (after invitation)

• Email, first and last name
• Organisation name, optional VAT ID and address
• Password — stored only as a bcrypt hash in Supabase Auth
• Login events (IP, timestamp, user-agent)

Check-in staff

• Email, name, password (hash)
• Organisation memberships
• Login events
• Device information they sign in from (user-agent)

Event attendees (data owned by the organiser)

• First and last name
• Email
• Ticket ID, ticket type
• Optional badge field (company, role — max 25 characters)
• Check-in state: when checked in and by whom

Data is uploaded by the organiser via CSV import or (in the future) API integration.

Check-in logs

• Reference to the attendee and event
• Reference to the staff member who performed the check-in
• Timestamp
• Scanned value (typically the ticket ID)
• Result: success / duplicate / not_found
• Device information (iPhone model, OS version) for audit and anomaly detection

Technical data (all roles)

• IP address
• User-agent (browser or iOS version)
• Server error and operational logs

Users have the right to:

• access their data,
• rectification,
• erasure (the right to be forgotten),
• restriction of processing,
• data portability,
• object to processing.

Requests can be sent to privacy@cekin.cz. We respond within 30 days.

Complaints can be filed with the Czech Office for Personal Data Protection — uoou.cz.

For event attendees: please contact the event organiser (the data controller) first. Čekin, as a processor, will provide technical assistance to fulfil the request.

• All traffic is encrypted via HTTPS / TLS 1.2+.
• Passwords are stored as bcrypt hashes in Supabase Auth.
• iOS session tokens are stored in the Keychain (hardware-backed secure storage).
• Row-Level Security is enabled on the database — every query is scoped by the user’s role and organisation or event membership.
• Critical server functions (e.g. check_in_attendee) require authentication via auth.uid() and verify event_staff membership; the anonymous role has no execute privilege.
• Employee access to the production database is restricted to platform admins only.

Web

• Supabase session cookie for authentication — strictly necessary.
• localStorage: Supabase session tokens and the profileLastSeenAchievementIds key used to visualise newly unlocked achievements.
• No third-party analytics or marketing cookies.

iOS app

• Session tokens stored in the Keychain.
• UserDefaults: selected printer preference and seen-achievement IDs.
• No tracking SDKs.

Some subprocessors (Vercel, Apple) operate servers in the USA. Such transfers take place under Standard Contractual Clauses (SCC) with additional technical and organisational safeguards.

Čekin is a B2B tool for professional use (event organisers and their staff). It is not intended for persons under the age of 16 and we do not knowingly collect data from children.

Any changes to this policy will be published on this page. Material changes will be announced to registered organisers by email at least 30 days in advance.