Privacy Policy
How we handle your data on FunTicket — what, why, for how long, with which rights.
1. Who we are
Toxicode is a group of independent developers running FunTicket as a hobby project. Because we author and operate the app (iOS and Android) and the site funticket.musme.app, we decide the purposes of the data processing — so under GDPR we are the data controller. Reach us at it.funticket@gmail.com for any question about this policy or to exercise your rights.
There is no company behind FunTicket: the project is non-profit, we don’t sell data, and we don’t charge users.
2. The short version: what we don’t do
Before the legalese, the actual commitments:
- On-device OCR. Text and codes are recognized locally. With an account, tickets and assets may be uploaded to FunTicket services for synchronization, backup and restore.
- We don’t sell your data to anyone. Ever. It’s not the business model.
- No third-party advertising trackers in the app. No Google Analytics, Facebook Pixel, AppsFlyer, or similar.
- No mandatory account. You can use FunTicket in guest mode: tickets stay only on the device.
3. What we collect
3.1 Account (only if you register or sign in via SSO)
When you create an account, manually or with Sign in with Apple / Google Sign-In (via native idToken, no browser redirect), we receive:
- Email address (needed for sign-in and password recovery)
- Name / display name (optional, editable in Settings)
- SSO provider (apple/google, if used)
- Unique user identifier (UUID we generate at first sign-in)
For users migrated from the legacy Firebase setup we also keep the original firebase_uid to preserve continuity of their tickets.
3.2 What you create
- Tickets (title, date, venue, section, seat, flight/cinema-specific fields)
- Customisations (colours, picked fonts, selected template)
- Synchronized content: images and, in versions supporting originals, PDFs/photos and notes may be stored in private Storage and retrieved through temporary signed URLs.
- Notifications and scheduled reminders
- Memory photos and notes you add to a ticket: they stay on your phone and, with an account, sync like your other content.
3.3 Technical data
When the app talks to our backend for sync and template downloads, we log — for security and debugging:
- IP address (masked after 30 days)
- User-Agent
- Timestamp of requests
- Errors (code, path, correlated request id from our internal logger)
These logs are rotated and deleted after 30 days.
3.4 Invites and rewards
If you invite a friend or accept an invite, we record who invited whom, when the invite was accepted and when the friend synced their first ticket. We use this only to grant rewards (the Couple, Reveal and Gold styles, including your personal Gold number). Your display name, if you set one, is visible only to the other person of your pair. The invite link contains no tickets, entry codes or other personal data.
3.5 Event search
When you search for an event in the app, the text you type goes through our backend to Ticketmaster’s search service, without your account, email or any other identifier. Your phone’s country stays on our server and is only used to order the results. The app loads result images (artist and event photos) directly from Ticketmaster’s servers, which therefore see your phone’s IP address. Ticketmaster handles this data under its own privacy policy.
3.6 Free events
If you book an event published by an organizer:
- we record the booking (event, seat, date), the pass with its code and, when you get in, the time of entry;
- if you book on the website without the app, we use your email to send you a sign-in code and the pass. If the code is never used, the account created is deleted automatically after 24 hours. The page uses Cloudflare Turnstile to block bots: Cloudflare sees the IP address and some technical browser data;
- if you turn on event alerts, we store your device’s push identifier; notifications go through Expo’s push service and then Apple or Google.
The organizer does not receive your name or email: they see only counts and, at the scanner, whether a pass is valid, already used or invalid.
If you organize an event, we keep your request (organization name, kind of events, contact, optional link), the version of the terms you accepted and the data of the events you publish, including images. The event’s title, date, place and images are visible to anyone with the link. To find the event’s address the app uses the phone’s map service (Apple or Google); if you choose to use your position, it reads it once and stores it only as the event’s place.
4. What we don’t collect
- Background location. The app asks for your location only from organizers, when they choose to search for or set an event’s place (see 3.6).
- Contacts, calendar, photos from other albums (only the images you choose to import).
- Audio / microphone (permissions are declared in the manifest only because the camera SDK requires them, but the microphone is never activated).
- Web browsing history.
5. Why we process your data (GDPR legal basis)
| Purpose | Legal basis |
|---|---|
| Service delivery (login, ticket sync, notifications) | Contract performance (art. 6.1.b GDPR) |
| Security, anti-abuse, error logging | Legitimate interest (art. 6.1.f GDPR) |
| Invites and rewards (who invited whom, rewards granted) | Contract performance (art. 6.1.b GDPR): the rewards programme you join by inviting or accepting |
| Event search via Ticketmaster | Contract performance (art. 6.1.b GDPR), only when you use search |
| Free events: bookings, passes, entries, alerts, organizer requests and events | Contract performance (art. 6.1.b GDPR) |
| Bot protection for website bookings (Cloudflare Turnstile) | Legitimate interest (art. 6.1.f GDPR) |
| Legal compliance (e.g. lawful requests) | Legal obligation (art. 6.1.c GDPR) |
| Promotional communications (we send none today) | Explicit consent (art. 6.1.a GDPR) |
6. Where your data lives
All user data is hosted on self-hosted Supabase on servers in the European Union. No extra-EU transfers for user content. The only exceptions are:
- Apple / Google SSO: the initial auth flow touches their servers (United States), but we only receive the
idTokenand the verified email. - Apple Push Notification Service / Firebase Cloud Messaging: required for push notifications, handled by Apple/Google under their standards.
- Ticketmaster (event search, see 3.5): receives the search text through our backend and, when the app shows result images, your phone’s IP address. It is a US-based service.
- Cloudflare Turnstile (website bookings, see 3.6): sees the IP address and technical browser data to tell people from bots. It is a US-based service.
- Expo (event alerts, see 3.6): forwards push notifications to Apple and Google. It is a US-based service.
7. Retention
| Data type | Retention |
|---|---|
| Active user profile | As long as you keep the account |
| Tickets and customisations | Until you delete them |
| Invites and rewards (who invited whom, rewards granted) | While you keep your account; rewards you already unlocked stay yours even if the friend deletes theirs |
| Bookings, passes and entries | As long as your account and the event exist; deleted with the account |
| Accounts created on the website and never confirmed | Deleted automatically after 24 hours |
| Organizer request and published events | As long as you keep the account |
| Account after deletion | Wiped within 30 days (cloud tickets immediately) |
| Technical logs (IP, UA) | 30 days |
| Security backups | Up to 90 days after deletion |
8. Your rights
Under GDPR articles 15-22 you can at any time:
- Access your personal data
- Rectify inaccurate data
- Erase (“right to be forgotten”)
- Restrict processing
- Portability (export your tickets as JSON from the app, Settings → Export data)
- Object to legitimate-interest processing
- Lodge a complaint with the Italian DPA (www.gpdp.it) or your local supervisory authority
Email it.funticket@gmail.com to exercise any of these. We answer within 30 days.
9. Security
- Encrypted HTTPS transport between the app and cloud services.
- JWT HS256 with rotating access/refresh tokens, native secure storage (Keychain on iOS / EncryptedSharedPreferences on Android)
- Data access: the database applies RLS to requests subject to its policies; the backend checks ownership for administrative operations using the service role. RLS cannot protect against a compromised backend holding that key.
- On-device OCR and parsing: images never leave your phone to be interpreted
- Technical checks: automated tests and checks of sensitive flows; no absolute guarantee of defect-free software.
10. Changes
We update this policy when the practices change. The “Last updated” date at the top is authoritative. Substantial changes are announced via email (if you have an account) and via in-app banner.
11. Contact
Toxicode (group of independent developers) — for any question about personal data processing: it.funticket@gmail.com
We didn’t appoint a mandatory DPO (the criteria under GDPR art. 37 don’t apply), but the email above is the official channel for any privacy-related request.