Privacy policy.

Effective 23 October 2026 · Tickitin, Inc.

This policy covers tickitin.com and its waitlist. The Tickitin app is not yet available; when it launches it will carry its own policy, which we'll point you to before you use it. If anything here is unclear, write to [email protected].

What we collect

Information you give us

• Email address, when you join the waitlist. This is the only thing we require.
• City, if you choose to tell us. It helps us decide where to open after New York.
• Friends' email addresses, if you ask us to hold seats for your group. You can add up to five. Please only add people who'd want to hear from us; see "If someone added your address" below.
• Anything you send us by email.

Information collected automatically

• How you found us. If you arrive through a link with campaign tags (such as utm_source) or a group-invite link, we record those tags and the page you signed up on. We keep the first set of tags from your visit for the length of your browser session.
• Abuse-prevention signals. To keep bots off the waitlist we use a hidden form field, a timing check, a per-network rate limit and Cloudflare Turnstile. For the rate limit we store a one-way hash of your IP address for up to one day; we never store the address itself. Turnstile analyses browser and device signals on Cloudflare's side to tell people from scripts.
• Usage analytics. We use Google Tag Manager to load analytics and advertising tags such as Google Analytics, and may add tags from advertising platforms we promote on, for example TikTok or Meta. These record pages viewed, waitlist signups and film plays, along with device and approximate-location information derived from your IP address, and may set cookies. See "Cookies and similar technologies".
• Server logs. Our hosting provider records standard request data (IP address, browser type, pages requested, timestamps) for security and reliability.

How we use it

• To keep your place on the waitlist and your group's seats next to yours.
• To send you a welcome email when you join, and news when we're close to launch and when we open in your city. We write rarely.
• To apply the founding credit to your account at launch.
• To understand which pages and campaigns bring people to Tickitin, and to measure promotions on platforms such as TikTok.
• To keep the waitlist honest: detecting bots, duplicate and fraudulent signups.
• To answer you when you write to us, and to meet legal obligations.

Where European or UK data-protection law applies, our legal bases are performance of our arrangement with you (keeping your place on the list and the credit that comes with it), our legitimate interests (security, understanding our audience, running a small company), and your consent where we ask for it, which you can withdraw at any time.

If someone added your address

If a friend asked us to hold a seat for you, we hold your address only for that purpose. We may send you a single message about the seat around launch. If you'd rather we didn't, email [email protected] and we'll remove it.

Who helps us handle your data

We don't sell personal information. We share it only with the providers that run the site for us, each bound by its own data-protection terms, and only as needed for the purpose described:

• Vercel hosts the site and runs the waitlist service.
• Supabase stores the waitlist database.
• Cloudflare provides our network layer and the Turnstile bot check.
• Resend delivers our emails.
• Google provides Tag Manager, Analytics and the fonts the site uses; your browser requests fonts directly from Google when a page loads.
• YouTube hosts our film. The player loads only if you press play, in YouTube's privacy-enhanced mode, after which YouTube's own policy applies.
• Advertising platforms whose measurement tags we use, as described under "Cookies".

We may also disclose information if the law requires it, to protect our rights or safety, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply to it.

Some of these providers process data in the United States and other countries. Where required, transfers are covered by standard contractual clauses or equivalent safeguards.

Cookies and similar technologies

The site itself sets no cookies of its own. Cookies and similar identifiers may be set by Google Tag Manager and the analytics and advertising tags it loads, by Cloudflare Turnstile, and by YouTube once you press play. Advertising tags may let a platform recognise that you visited this site and measure or tailor the promotions it shows you, which some laws treat as "sharing" personal information for targeted advertising.

You can control this through your browser's cookie settings, through the opt-outs each platform provides (for example Google's Analytics opt-out), or by turning on the Global Privacy Control signal in a browser that supports it, which we honour. Blocking cookies does not affect your place on the waitlist.

How long we keep it

Waitlist details are kept until the founding-member program ends after launch, or until you ask us to delete them, whichever comes first. Hashed abuse-prevention records are deleted within a day. Email delivery records are kept by our email provider for a short period for troubleshooting. Analytics data is retained according to each platform's settings, which we keep to their shortest practical option.

Your choices and rights

• Leave the waitlist or stop emails: write to [email protected] from the address you joined with. We'll remove you and your held seats.
• Access, correct or delete your data: same address. We'll respond within 30 days.
• California residents have the right to know what we collect, to delete it, to correct it, and to opt out of the sale or sharing of personal information, and the right not to be discriminated against for exercising these rights. We do not sell personal information. To opt out of sharing for targeted advertising, use the cookie controls above, the Global Privacy Control signal, or email us.
• EEA, UK and Swiss residents additionally have the rights to restrict or object to processing, to data portability, to withdraw consent, and to complain to your local supervisory authority.

We may ask you to confirm your identity before acting on a request, usually by replying from the address on file.

Security

The waitlist database is locked to our server; nothing in your browser can read it. Traffic is encrypted in transit. No method of storage is perfectly secure, and if a breach affects your information we'll tell you as the law requires.

Children

Tickitin is for adults. The site is not directed at anyone under 18, and we don't knowingly collect information from them. If you think a minor has joined the waitlist, let us know and we'll remove the entry.

Changes

We'll update this page when our practices change, with a new effective date at the top. For meaningful changes we'll email the waitlist.

Contact

Tickitin, Inc.
[email protected]