Privacy Policy

1.About this Policy & your consent

“Personal information” means information or an opinion about an identified individual, or an individual who is reasonably identifiable, as defined in the Privacy Act 1988 (Cth). This Policy covers all personal information we handle through the Service.

By creating an account, connecting or forwarding email to us, or otherwise using the Service, you acknowledge this Policy and consent to us collecting, holding, using and disclosing your personal information as described here. If you do not agree, please do not use the Service. Our Terms of Service also apply to your use of the Service.

Because a core function of the Service is reading your ticket confirmation emails, some of the information we handle can be detailed. We only ever access the mail you choose to give us — by forwarding it, connecting a mailbox and then tapping Scan inbox, or configuring an inbox poll. Connecting a mailbox does not read it: nothing is read until you tap Scan inbox for that mailbox. After that first scan, the app keeps that mailbox up to date while you are using it: when you open the app it finishes any import still in progress and checks for new ticket emails, at most about every 12 hours.

Background inbox checks are separate, optional and off unless you turn them on for a mailbox. The app explains them and asks you first (after a scan of that mailbox, or when you turn on Keep checking for new tickets for it in Ticket sources). While they are on, our servers check that mailbox about every 4 hours during the day (9 am to 9 pm in the time zone of your next event, or Sydney time if you have none), including while the app is closed, with the same search as Scan inbox: only emails from ticket sellers, and emails about the set times of events you hold tickets for (see section 3.5). New tickets are added to your passport, and we notify you when the email provably came from the seller (see section 10). The checks pause for a mailbox whose owner has not used the app for 30 days. Turning them off stops the scheduled checks straight away: a check already under way stops within seconds and opens no further email. Disconnecting a mailbox stops all reading of it immediately.

2.What the Service does

TicketPassport is a ticket wallet for event-goers. It brings tickets bought across many Australian ticketing platforms into a single “passport” by reading the confirmation emails those platforms send you, extracting the event and ticket details, and displaying them — either as a scannable QR code (for static-barcode tickets) or as details plus an “open the official app / view ticket” link (for app-locked or hosted tickets). It also has an optional social layer that lets you add friends, see who else is going, and share the visibility of a ticket with a friend (which is not a legal transfer of the ticket).

Understanding these functions helps explain why we collect what we collect. Where a purpose is optional (for example, connecting a mailbox, importing contacts, or using the social features), we tell you at the relevant point in the app and you can choose not to use it.

3.Personal information we collect

The kinds of personal information we collect depend on how you use the Service. They include:

3.1 Account & identity information

• Your email address and a password (passwords are stored only as a salted hash by our authentication provider — we never see your plain-text password); or, if you use social sign-in, an identity token from Apple or Google.
• Your chosen username (unique across TicketPassport and shown to other users) and an optional profile photo (avatar) you upload.
• A system-generated user ID that identifies your account internally.

3.2 Phone number (required)

To help keep the community genuine and reduce duplicate or fake accounts, new accounts must verify a mobile phone number by SMS one-time code during onboarding. We store your verified number with our authentication provider. Your number is also used, if you use “Find friends from your contacts” or turn on “discoverable by phone”, to help friends find you when you both have each other’s number in your contacts (see 3.4).

3.3 Ticket & email content

This is the core of the Service. Depending on which ingestion method you use, we collect:

• The content of ticket emails you send to us or that we read from a mailbox you connect: the message subject, body, sender, dates and any embedded ticket information. This includes the set-times emails we read from a connected mailbox (see section 3.5): we store each one, with its images, like a ticket email, to extract the acts and their set times from it.
• Attachments to those emails, in particular PDF tickets. Ticket PDFs frequently contain the purchaser’s full name, an order or booking reference, seat/section details and sometimes a postal address.
• Photos and files of tickets you add in the app: a photo you take of a ticket, or an image or PDF you import. These can show your name, seat, order reference and barcode. We store the photo, image or PDF page, encrypted, with the ticket or its unsaved draft, and hold an imported PDF for about 2 hours while you import it.
• Extracted, structured ticket details such as event name, venue, date and time, seat and section, order/booking reference, ticket status, the ticketing vendor, deep links, and — for tickets that use a static barcode — the barcode / QR payload (decoded from the email, PDF, photo or image).

However an email reaches us (forwarded, or read from a mailbox you connect), our team does not see its content. Our support tools show only whose email it is, the sender’s web domain and how it was processed, unless you send us that email yourself from Emails we couldn’t read in the app: someone on our team then reads its sender, subject and message to add support for that seller. (An email sent there before 15 October 2026, when that screen did not yet say a person reads it, stays hidden from us.) You can take it back by deleting the email there.

3.4 Contacts (optional)

If you choose to use “Find friends from your contacts”, the app reads the phone numbers in your device’s contacts and converts each number into a one-way cryptographic hash on your device. Only these hashes are sent to us, and we compare them with the verified numbers of members who are discoverable by phone. We never receive your contacts’ names or their plain-text phone numbers, and we do not keep the hashes or any of your contacts’ phone numbers. When a number belongs to a discoverable member, we keep only a record that you have that member’s number (the two account identifiers and the date of your latest check).

Matching is two-way: you and another member see each other only when you both have each other’s number and are both discoverable (a member who is already your friend may also appear). Using this feature makes you discoverable; the app tells you this before you start. While it is on, the app checks your contacts again at most once a day and keeps your latest results on your device.

You can turn off “discoverable by phone” in your privacy settings at any time. Doing so deletes these records straight away, both whose numbers you have and who has yours, and clears the results on your device. Records that have not been refreshed for 180 days are deleted automatically, and all of them are deleted with your account.

3.5 Mailbox connection data (optional)

If you connect a Gmail or Outlook mailbox, we store the OAuth access and refresh tokens that let us read your mail once you have tapped Scan inbox for that mailbox (and then to keep it up to date while you use the app and, only if you turn them on, for background inbox checks, as described in section 1), along with the connected email address and sync status. We request read-only mail access and use it only to find two kinds of email:

• Emails from ticket sellers, such as order confirmations, ticket deliveries and changes to your orders. We extract your tickets from them. The acts an order email lists can also appear on that event’s line-up in the app.
• Emails about the set times or line-up of an event you hold a ticket for in the coming weeks, which may come from the promoter or venue rather than the seller. From these we extract only the acts, their set times and when the event ends, which we may show on that event’s line-up in the app, where anyone using the app can see them. Nothing else from the email is shown to other users. If our team checks a line-up before it appears, they see only the event, those facts, the sender’s web domain and any public web page the email linked to, never the email’s words or whose inbox it came from.

You can disconnect a mailbox at any time, which stops all reading of it and invalidates the stored tokens. For Gmail specifically, our use of that data is also governed by the Google API Services User Data Policy (see section 7.1, Limited Use).

Eventbrite account (optional). If you connect your Eventbrite account, we store the OAuth access token Eventbrite issues and the account’s email address, and use them only to read your orders: for each ticket, the event, its date and venue, the ticket type, the name on the ticket, the price paid and the barcode. We add those tickets to your passport, past and upcoming, and check for new or changed orders while you use the app. Eventbrite does not let apps limit what an access token can see, so apart from reading your account’s email address when you connect, we only ever call the part of its API that lists your orders. Eventbrite also returns other details of each ticket holder’s profile (such as an address, phone number or birthday); we discard them and keep only the name on the ticket. We only store a barcode for an event that has not ended yet. This data is read directly from Eventbrite and is not sent to an AI service. You can unlink Eventbrite in Ticket sources at any time, which deletes our copy of the token and stops all reading; tickets already added stay in your passport until you delete them, and a ticket you delete is not added again. To remove our access on Eventbrite’s side as well, remove TicketPassport from your Eventbrite account settings.

3.6 Social & sharing information

• Your friend connections, friend requests (sent and received) and any accounts you block.
• Ticket shares you send or receive (including who a ticket was shared with, whether it was accepted, and any note or the “who is this for” label you add), and public share links you create.
• Activity you post or interact with — added tickets that appear in a friends’ feed, reactions, comments and mentions — subject to your visibility settings.

Photo posts. Photos and clips you post from a night’s capsule, with your caption, are shown to all your friends, with their own likes and comments. If you post a photo someone else took, they are credited by name, told about it, and can see the post and take their photo out of it; anyone can keep their own shots out of other people’s posts. Posts use the capsule’s own photos rather than copies, so deleting a night (including when its creator deletes their account) removes the posts made from it.

3.7 Device & notification information

• A push notification token and your notification preferences, so we can deliver alerts you’ve opted into.
• An in-app notification history: a copy of each notification we send you (its text, which can include another user’s display name and a short excerpt of their comment, and the event it concerns) and when you viewed it, so you can catch up in the app.
• Basic device and app information such as device/OS type, app version and language, used to operate and support the app.

3.8 Technical, usage & diagnostic information

• Log and technical data, including IP address (used for security and rate-limiting), request identifiers, timestamps and the app build/version. We also keep how long our servers took to answer each kind of request (no addresses, identifiers or content), for 14 days.
• Usage analytics: a limited set of self-hosted product events, for example which screens and features you use, when you used them (by your device’s clock), grouped into app sessions, and how long parts of the app took to load. These records are restricted to counts, identifiers, short labels and durations; by design they cannot contain barcode, QR or order-reference values. You can turn usage analytics off at any time in Settings > Activity & visibility > Share usage data; reports about failures that we need to keep the service working are still sent. Individual usage events are deleted after 180 days; after that we keep only daily totals that do not identify you.
• What’s On activity, such as which shows you open or skip, how long you view them, what you send, answer or tap through to buy, the shows we recommended and which of them you saw, and the night videos you watch. We use this to recommend events (see section 6). It is separate from usage analytics, and turning off usage analytics does not stop it.
• Crash and error reports collected via our error-reporting provider to help us fix problems. These reports are configured to scrub ticket, barcode and email content, and the app does not record your screen.
• Scan metadata — records of when a scan ran and aggregate counts/cost, without the underlying ticket content.

We take active measures so that ticket barcode numbers and QR/SafeTix payloads are never written to our logs, metrics or alerts.

3.9 Friend Finder (optional)

Friend Finder helps two people at the same event find each other in a crowd: two members of the same night, or two friends who both have a ticket for the event. A find only starts when you ask to find someone, or agree when they ask, and it only runs while the Friend Finder screen is open on your phone. Nothing runs in the background.

• Who can ask to find you. Members of a night you’re in, while its camera is open, and your friends on TicketPassport when you both have a ticket for the same event (your own, or one shared with you that you accepted), from 3 hours before it starts until 12 hours after (for a pass that covers several days, until 12 hours after it starts on its last day). To decide that two tickets are for the same event, we compare the event, the venue and the start time on each ticket (we count a pass as starting at the same time on each of its days): they must start within 9 hours of each other, and either name what looks like the same venue (we compare the words in the venue names), or be for the same event on the same day where a ticket names no specific venue. Tickets for an online event, or that name different cities or states, never match. For a friend to see that they can find you at an event, you must be sharing your attendance with them (the same setting that shows them which events you’re going to); we never tell anyone whether a friend who doesn’t share it has a ticket.
• Your location. During a find, your phone shares its position with the friend in that find, so their arrow can point to you, and theirs is shared with you. Positions are end-to-end encrypted on your phone with a key made for that find alone, and relayed through our servers to the other phone. We cannot read them and we never store them. The app shares in both directions: it only shows you your friend’s position while it is sharing yours, and when either of you turns sharing off, both phones stop sending. This is how the TicketPassport app behaves, not something our servers can check: because we can’t read positions, we can’t tell whether a phone running a modified app keeps sharing turned on while sending nothing, or a wrong position. Sharing stops when the find ends, when either of you leaves the screen, or when the app goes to the background. The app only asks for location access when you use Friend Finder, and only while the app is in use.
• Precise finding. On phones that support it, the app measures the distance and direction to your friend’s phone directly, using Ultra Wideband (for example, Apple’s Nearby Interaction on iPhone). To set this up, each phone sends us a ranging token for that find, which only the two of you can read and which we delete when the find ends. Distances and directions are worked out on your phone and are never sent to us.
• Camera. On iPhone 14 and later, iOS uses the back camera to work out which way your friend is (ARKit camera assistance). It only runs during a find, once you are close to your friend. The images are processed by iOS on your phone; they are not recorded, stored or sent to us.
• Bluetooth. When precise finding isn’t available (for example, between an iPhone and an Android phone) and you are close to your friend, the app may use Bluetooth to tell you whether you’re getting closer. Each phone broadcasts an identifier made for that find alone, worked out on the two phones from the find’s encryption keys; it changes every find, contains nothing about you, and is never sent to us. Signal strength is measured on your phone and is never sent to us either. As with any phone using Bluetooth, nearby Bluetooth devices can tell a phone is there while it broadcasts, and on iPhone they may be able to see your phone’s name.
• What we keep. For each find we store who asked whom, on which night or at which event, when it was asked, answered and ended, how it ended, what kind of phone each of you used, and whether the screen flash was used. If you say no, the person who asked is not told: they see the same result as an unanswered request. These records are deleted 24 hours after the find ends. After that we keep only daily totals (for example, how many finds ended with the two of you finding each other), with no people or places in them.
  • If you stop someone asking you again, we keep that choice (who made it, about whom, when, and for which night or how long) until shortly after it ends, and delete it within three days of it ending. The person you stopped is not told.
  • When a find at an event can’t be started, we count that against the account that asked, for one hour, so Friend Finder can’t be used to check over and over who has a ticket.
  • If someone asks for a lot of finds in a short time, we record that they reached our limit (their account and the time, not who they asked). These records are kept as described in section 12.
  • While a find runs, we also note which of your signed-in sessions is sharing in it (an internal ID for that sign-in, not your location), so that signing that phone out stops its sharing. This note is deleted when the find ends.
  • We keep a note of what your phone can do with Friend Finder: the kind of phone, whether it can do precise finding and over what distance, whether it can open finds at events, which app version it runs, and a one-way scrambled fingerprint (a hash) of its notification token, so a find is only sent when the phone that would get the notification can open it. We can’t turn the fingerprint back into the token. The note is replaced each time your phone reports and deleted with your account. If it hasn’t been updated for 30 days, finds aren’t sent to you until your phone reports again.
• Notifications. We send you a push notification when someone asks to find you, when a friend says yes to a find you asked for, and when someone nudges you during a find. If you are asked to find people many times in a short time, we may skip some of these notifications; the requests still show in the app. You can turn these notifications off in the app’s notification settings (requests still show while the app is open), or stop one person asking again that night or at that event (on a pass that covers several days, until 3 hours before its next day starts, or, if you do it within about 7.5 hours before one of its days starts, until 3 hours before the following day starts).
• Your choices. Friend Finder is optional. You can say no to any find, and you can refuse or later withdraw location, Bluetooth, nearby devices or camera access in your phone’s settings; the app then falls back to flashing your screen so your friend can spot you.

4.How we collect your personal information

We collect personal information:

Directly from you

When you create an account, verify your phone, set up your profile, adjust settings, forward an email, connect or scan a mailbox, upload a ticket or attachment, add friends, share tickets, post activity, or contact us for support.

From your connected mailbox, with your consent

When you connect Gmail or Outlook and tap Scan inbox, afterwards when the app keeps that mailbox up to date while you use it, and, if you turn them on, during background inbox checks (see section 1), or when you configure an email forward or inbox poll, we receive the emails and attachments found by that method (see section 3.5).

From your Eventbrite account, if you connect it

When you connect Eventbrite, and afterwards while you use the app, we receive your Eventbrite orders and the tickets in them (see section 3.5).

Automatically, through your use of the Service

Technical, log, device, usage and diagnostic information is generated when you interact with the app or our servers.

From other people

If a friend shares a ticket with you, adds a label naming you, sends you a friend or profile invite, or has your phone number in their contacts while you are discoverable (we then keep a record that they have your number; see 3.4), we may receive information that relates to you from them.

If we receive personal information we did not solicit — for example, if a forwarded email contains information that is not a ticket, or contains information about other people — we handle it in accordance with APP 4 and will destroy or de-identify it where it would not have been lawful for us to collect it and it is not contained in a Commonwealth record.

5.Sensitive information

We do not seek to collect “sensitive information” (as defined in the Privacy Act, such as information about health, racial or ethnic origin, political or religious beliefs, sexual orientation, or criminal record). However, because we process tickets to events, the fact that you hold a ticket to a particular event could reveal or imply sensitive information (for example, attendance at a political, religious, cultural or health-related event). By forwarding or connecting your tickets to the Service, you consent to us collecting and handling that information for the purpose of providing the Service to you (that is, storing, organising and displaying your tickets; using which events you hold tickets to for recommendations to you; showing your friends that you’re going and recommending those events to them, subject to your visibility settings; looking up public information about those events (see section 9); the other features described in section 6; and — only where you choose — sharing a ticket’s visibility with a friend). We do not use this information for any other purpose, and we apply the same protections described in this Policy.

6.How and why we use your personal information

We use personal information for the following purposes:

• To create and manage your account, authenticate you, and verify your phone number.
• To provide the core Service — receiving your emails, extracting and normalising ticket details, storing your tickets and attachments, and displaying your passport, QR codes and links.
• To power optional features you choose to use: mailbox connection and scanning, background inbox checks, contact-based friend discovery, ticket sharing, “who’s going”, the activity feed, and public share links.
• To recommend events in What’s On. We choose and order the shows in For You using what you do in the app (such as which shows you open, how long you view them, what you save, like, hide, skip, send or tap through to buy, how you answer shows friends send you, and the night videos you watch), the artists and organisers you follow, which events you hold tickets to (each event’s name, date, venue and city) together with public information about those events and the line-ups we show everyone for them (see section 3.5), and the shows your friends are going to or have saved, weighted by how much you have in common with them (such as nights out together). We don’t read your emails for this.
• To send you transactional and account messages (for example, sign-in confirmations, verification codes, and share/friend-request notifications you’ve enabled).
• To secure the Service — detecting, preventing and responding to fraud, abuse, spam, and technical issues (including rate-limiting and duplicate-account prevention).
• To maintain, debug and improve the Service and develop new features, using analytics and crash diagnostics.
• To provide customer support and respond to your enquiries, requests and complaints.
• To comply with our legal obligations and to establish, exercise or defend legal claims.

We will only use or disclose your personal information for a purpose you would reasonably expect, a purpose set out in this Policy, a purpose you have consented to, or as otherwise permitted or required by law.

7.Automated processing & artificial intelligence

To read ticket details out of the varied and often messy HTML of confirmation emails, we send the relevant email content to a third-party AI provider, Anthropic (the maker of Claude), which returns structured ticket data. The email content is transmitted to Anthropic’s systems for this processing (see section 9 on overseas disclosure). We send the content as inert data within safeguards designed to prevent it from being treated as instructions. When you try to add a ticket from a photo or file in the app, we send Anthropic that image (or an image of the PDF page) to read its details in the same way.

This processing is automated and may be imperfect — extracted details can be incomplete or incorrect. It is not automated decision-making that produces a legal or similarly significant effect about you; it simply structures your own ticket information. You are responsible for checking that your ticket details are correct and that you present a valid ticket at an event (see our Terms of Service).

We do not use your email content, or any other personal information we hold, to develop, improve or train generalised artificial intelligence or machine learning models, including foundational models. Where we send email content or a ticket image to Anthropic for the extraction described above, it is processed under contract solely to return ticket data for your account, and is not used to train Anthropic’s models.

7.1 Google user data — Limited Use

TicketPassport’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, if you connect a Gmail mailbox:

• We request the read-only Gmail scope (gmail.readonly) to keep your ticket passport complete: finding the emails ticket sellers send you and the set times of events you hold tickets for (see section 3.5), and extracting the details shown in the app. We also use which events you hold tickets to for For You recommendations, as described below.
• If you turn on background inbox checks for a Gmail mailbox, the scheduled checks use the same scope and the same search, and follow the same Limited Use requirements: they read only those emails, about every 4 hours, only while the checks are on and you keep using the app (they pause after 30 days without it), and only to add your tickets, fill in the set times of your events, and tell you they arrived. Those tickets then count like any other. You can turn them off at any time in Ticket sources, and disconnecting Gmail ends all access.
• We use that data only to provide and improve these user-facing ticket features, and one other feature we tell you about before you connect: For You recommendations in What’s On. Once a ticket is in your passport, we use the fact that you’re going to that event (its name, date, venue and city), together with public information about the event and the line-up we show everyone for it (see section 3.5), to recommend other shows to you. We don’t read your emails for this, or use your seat, order number, barcode or what you paid. We do not use it for advertising, and we do not sell it or transfer it to data brokers, information resellers or advertising platforms.
• We do not use it to develop, improve or train generalised AI or ML models, including foundational models.
• No human at TicketPassport reads your email content, except with your explicit consent (for example, if you ask us to investigate a ticket that did not import correctly), where necessary for security investigations or to comply with applicable law, or where the data has been aggregated and de-identified for internal operations.
• Apart from what you choose to share (see section 3.6), we show other people only the acts and set times we find for an event, on its line-up in the app (see section 3.5), and, subject to your visibility settings, that you are going to an event. Subject to the same settings, your ticket can also lift that event in your friends’ For You recommendations. To find public information about an event, we look up details of it, such as its name, acts, genre, venue, city and date, on public sites and search services (see section 9); we don’t add your name, email or account to those lookups. Otherwise we transfer it only to the service providers that operate the Service on our behalf, under confidentiality and data-protection obligations (listed in section 9), where required by law, or as part of a business transfer described in section 8.

Connecting a mailbox is entirely optional: you can use TicketPassport by forwarding confirmation emails instead, and you can disconnect a connected mailbox at any time, which invalidates the stored tokens.

8.When we disclose your personal information

We do not sell your personal information. We disclose it only as follows:

• To other users, at your direction — when you share a ticket, accept a share, add a friend, appear in “who’s going”, post to the activity feed, or create a public share link, the relevant information becomes visible to the people you choose (and, for public links, to anyone with the link). Your username and avatar may be visible to other users as part of the social features.
• To service providers (sub-processors) who host and operate the Service on our behalf under confidentiality and data-protection obligations. The current key providers are listed in section 9.
• To professional advisers (such as lawyers, accountants and insurers) where reasonably necessary.
• In connection with a business transfer — if the Service or our business is reorganised, sold or merged, personal information may be disclosed to the successor, who will be required to handle it consistently with this Policy.
• Where required or authorised by law — for example, to comply with a court order, subpoena, or a lawful request from a regulator or law-enforcement agency, or to protect the rights, safety or property of you, us or others.

9.Overseas disclosure & our service providers

We store the core of your data — your account, tickets and files — in a database and file storage hosted in Australia (Sydney), and the back-end servers that process it run there too. However, some of our service providers operate or store/process data overseas, principally in the United States. That means that in the course of providing the Service, your personal information may be disclosed to, or accessible by, recipients located outside Australia. Before disclosing personal information to an overseas recipient we take reasonable steps to ensure it is handled consistently with the APPs, but you acknowledge that overseas recipients may be subject to different privacy laws.

To find public information about events, such as line-ups, artwork and music previews, we also send details of an event, such as its name, acts, genre, venue, city and date, to public sites and search services, including Resident Advisor, Brave Search and Apple’s iTunes search, which may be outside Australia. Anthropic also researches line-ups and reads event artwork for us from these details and public images. We don’t add your name, email or account to these lookups.

This list may change as the Service evolves; we will keep this Policy up to date. Some providers are only engaged if you use the related optional feature (for example, mailbox providers, or the SMS provider once phone verification is enabled).

10.Notifications, messages & direct marketing

Most messages we send are transactional — verification codes, account and security notices, and the social/ticket notifications you have switched on. You can manage or turn off push notifications in the app’s notification settings or in your device settings. Turning a push off stops it reaching your device; the app still keeps an in-app history of your notifications (friend requests, tickets added, replies and similar) so you can catch up there.

When we add tickets from an email (one you forwarded, or one a background inbox check found), the notification names the event and venue only. It never contains a barcode, a QR code or an order number. A background check notifies you only between 9 am and 9 pm (in the time zone of your next event, or Sydney time if you have none), and only when the email provably comes from the seller of the tickets: your email provider confirmed it was sent from that seller’s own web domain. Otherwise the tickets are added without a notification, and any question about them (such as a possible duplicate order) waits for you in the app.

We do not currently send marketing emails. If we ever send you promotional or marketing messages, we will do so consistent with the Spam Act 2003 (Cth) and APP 7: only with an appropriate basis to contact you, always identifying us as the sender, and always including a simple way to opt out or unsubscribe. You can also ask us at any time not to receive marketing communications by emailing ticketpassportapp@gmail.com.

11.How we protect your personal information

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure, including:

• Encryption in transit (HTTPS/TLS) for data moving between the app, our servers and our providers.
• Encryption at rest: ticket codes, ticket files and links, the bodies of ticket emails we store, and connected-mailbox access tokens are encrypted with a key unique to your account, which is itself protected by a hardware-backed key service (AWS KMS) in Sydney.
• Row-level security in our database so that, as a rule, each record is scoped to its owner and a ticket is only visible to someone else via a share you have granted and they have accepted.
• Least-privilege access — highly privileged keys are held server-side only and are never embedded in the mobile app.
• Redaction by design — barcode/QR payloads are structurally kept out of logs, metrics and alerts, and crash reports are scrubbed of ticket, barcode and email content.
• Authentication protections — hashed passwords, phone verification, bot/abuse protection, and rate-limiting.
• Access controls and auditing on administrative tooling.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You also play a part: keep your device, email account and login credentials secure, and be careful who you share tickets or public links with. If you believe your account has been compromised, contact us immediately.

12.Data retention & deletion

We keep personal information for as long as your account is active and for as long as we need it to provide the Service, and after that only as long as necessary to comply with our legal obligations, resolve disputes, prevent abuse and enforce our agreements. Ticket and event data is generally retained while it is useful to you (for example, past events remain in your passport history) unless you delete it. Your in-app notification history is kept for 90 days and then deleted automatically. An entry is removed sooner if the comment, activity update, night or photo it refers to is deleted, or if you or the sender deletes their account. Friend Finder records are deleted 24 hours after each find ends (a choice to stop someone asking you, within three days), and positions shared during a find are never stored (see section 3.9). Records that an account or IP address reached one of our rate limits (for example, too many requests or too many finds in a short time) are deleted after 180 days, or within a day of that account being deleted. Records that you have another member’s number in your contacts are deleted after 180 days without a refresh, or straight away when you turn off “discoverable by phone” (see section 3.4). Our log of what you open, view, skip, answer, watch, send and tap through to buy in What’s On is deleted after 365 days, and records of which shows we recommended and which you saw after 180 days. Your saves, likes, hides and follows have no time limit: they stay until you remove them or delete your account, except that a save goes when its listing leaves our catalog and we keep only your latest 500 likes and hides. The taste profile we build from all of this is deleted when you delete your account.

You can delete individual tickets in the app, and you can delete your entire account from Profile → Delete account. Deleting your account removes your profile and associated database records and deletes your stored files (such as ticket PDFs, QR images and your avatar) from our storage. Some information may persist for a limited period in encrypted backups, or where we are required to retain it by law, before being overwritten or destroyed. De-identified and aggregated data that no longer identifies you may be retained.

13.Accessing, correcting & controlling your information

Under the APPs you have the right to:

Access your personal information (APP 12)

You can view and manage much of it directly in the app. You can also request a copy of the personal information we hold about you by emailing us.

Correct your personal information (APP 13)

You can update your profile, handle, avatar and settings in the app. If information we hold is inaccurate, out of date, incomplete, irrelevant or misleading, you can ask us to correct it.

Control optional data uses

You can disconnect a mailbox, turn off “discoverable by phone”, change your activity/attendance visibility, block other users, revoke shares and public links, and manage notifications — all in the app.

Withdraw consent / delete

You can delete tickets or your whole account at any time. Withdrawing consent or deleting your account may mean we can no longer provide some or all of the Service.

To make an access or correction request, email ticketpassportapp@gmail.com. We may need to verify your identity first. We will respond within a reasonable period (usually within 30 days). Access and correction are generally free; if a request is complex we will tell you of any reasonable cost before proceeding. If we refuse access or correction, we will give you written reasons and information about how to complain.

14.Anonymity & pseudonymity

Where lawful and practicable, you may deal with us anonymously or by a pseudonym — for example, you present to other users under a chosen handle rather than your legal name. However, the core Service cannot function without an email address (to receive your tickets) and a verified phone number (to secure the account), so these are required to register.

15.Children & minors

The Service is intended for users aged 16 and over. It is not directed at children under 16, and we do not knowingly collect personal information from them. If you are a parent or guardian and believe a child under 16 has provided us with personal information, please contact us and we will take reasonable steps to delete it.

16.Third-party services & links

The Service works alongside third parties that have their own privacy policies and terms, including ticketing vendors (such as Ticketek, Ticketmaster, Moshtix, Megatix, Oztix, Humanitix, TryBooking, Eventbrite, Leap (formerly Ticketbooth) and others), mailbox providers (Google, Microsoft), and the Apple App Store and Google Play. When you open an official vendor app or a hosted ticket page, or sign in with a third-party provider, that party’s privacy policy governs its handling of your information. We are not responsible for the privacy practices of third parties. We are not affiliated with, or endorsed by, any ticketing vendor or event organiser.

17.Our website, cookies & analytics

Our marketing website (ticketpassport.app) is a simple, largely static site. We do not use advertising cookies or third-party ad trackers on it. Our hosting/CDN provider (Cloudflare) processes standard technical request data (such as IP address) to deliver and secure the site, and we use a privacy-respecting bot-protection challenge (Cloudflare Turnstile) on some sign-in flows. Within the app we use the limited, self-hosted analytics and crash diagnostics described in section 3.8.

18.Data breaches

We maintain processes to detect and respond to data security incidents. If a data breach occurs that is likely to result in serious harm to any individual whose personal information is involved, we will assess and respond in accordance with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth), including notifying affected individuals and the Office of the Australian Information Commissioner (OAIC) where required.

19.Changes to this Policy

We may update this Policy from time to time to reflect changes to the Service, our providers, or the law. The “Last updated” date at the top shows when it last changed. If we make a material change, we will take reasonable steps to notify you — for example, by an in-app notice or by updating this page before the change takes effect. Your continued use of the Service after an update means you accept the revised Policy.

20.How to contact us & make a complaint

If you have a question about this Policy, want to access or correct your information, or wish to make a privacy complaint, contact us:

TicketPassport — Privacy
Email: ticketpassportapp@gmail.com
Operated by Nicholas Jamou (ABN 20 977 061 730), Victoria, Australia.

We take complaints seriously. Please give us enough detail to investigate. We will acknowledge your complaint, investigate it, and aim to respond within a reasonable period (usually within 30 days). If you are not satisfied with our response, you can refer your complaint to the Office of the Australian Information Commissioner (OAIC): www.oaic.gov.au, phone 1300 363 992.