What we collect and why
We collect what you give us (when you sign up, edit your profile, buy tickets, apply for a table or send a message), and a little that your browser sends with every request. We use it only to run ShowFloor for you and keep it safe.
- Identifiers and account details
- Email address, password (stored only as a one-way hash), display or business name, contact name, contact email and phone, sign-in history (when, from which IP address and browser).
- Used to create and secure your account, sign you in, and contact you about it.
- Legal basis: Providing your account (contract); sign-in history for security (legitimate interests).
- Profile and Card Back
- Bio, profile photo, what you sell, pickup ZIP code, time zone, social accounts you link, links and featured cards on your Card Back.
- Used to show the profile you choose to make public, and to verify linked accounts.
- Legal basis: Providing the service (contract). Making it public is your choice, and you can switch it off.
- Commercial information
- Tickets and orders (buyer and attendee names and emails, amounts), vendor applications, booths and inventory, wishlists.
- Used to sell and check tickets, run vendor applications, and match Treasure Hunt wishlists with inventory.
- Legal basis: Providing what you ordered or applied for (contract); keeping financial records (legal obligation).
- Messages
- Messages you send and receive, and announcements from shows you're part of.
- Used to deliver them, and to protect people from scams and abuse (see Message safety below).
- Legal basis: Delivering them (contract); safety screening (legitimate interests).
- Internet and device information
- IP address, browser, and the approximate area your IP address is in (worked out by our host for each request and not stored).
- Used to keep the site secure, stop spam and bots, and show shows near you.
- Legal basis: Security and showing relevant shows (legitimate interests).
- Age
- The year you were born, asked once at sign-up to confirm you're 13 or older. It isn't stored; only the time you passed the check is.
- Used to keep ShowFloor for people old enough to use it.
- Legal basis: Children's privacy law (legal obligation).
Your sign-in email and password count as sensitive personal information under California law. We use them only to let you sign in, never to infer anything about you.
Photos you upload have their hidden location and camera details removed before they're saved.
Who sees it
Everyone can see what you make public: your Card Back, and your display or business name if you leave “Show publicly” on. Your contact name, email and phone are never shown publicly.
A show's organizers see the orders and tickets you buy for their show (name and email, for entry), the applications you send them, and messages you send them. They may keep their own notes about vendors who apply; you can see those in your data download.
Our staff can see account details to give support, review reports, and review messages flagged by our safety checks (below).
Service providers handle data for us under contract, only to provide their service:
- Cloudflare hosts the site, database, files and email, and runs the bot check on sign-up (it sees your IP address).
- Have I Been Pwned checks new passwords against known breaches. Only the first 5 characters of a one-way hash of the password are sent, never the password.
- Instagram, Bluesky and Discord, only when you choose to link or verify an account there: we look up the public profile you name.
We may disclose information if the law requires it, or to protect people from fraud or harm. We don't share personal information with anyone for their own marketing.
Message safety
Messages are checked automatically when they're sent. Clearly abusive ones are refused. Ones that look like a common scam (for example, asking to pay outside the site or for a verification code) are delivered with a safety tip, and our staff may read those flagged messages to keep them or remove them. Other messages aren't read by staff unless someone reports them.
The automatic check only decides whether a single message is sent. Anything that affects your account, like removing a message, a photo or a Card Back, or disabling an account, is decided by a person. When that happens we email you what was done and why, and you can reply to ask for someone else to look at it again.
No selling, no sharing, no ads
We don't sell personal information or share it for cross-context behavioral advertising, and we haven't in the past 12 months. There are no advertising or analytics trackers on ShowFloor. Visit counts for show pages and Card Backs are totals; they don't identify you.
We honor Global Privacy Control: if your browser sends it, it's treated as a request to opt out of selling and sharing. Since we do neither, nothing else changes.
Cookies
We only use what's needed to sign you in, keep the site safe and remember settings you chose. No analytics or advertising cookies, so there's nothing to accept or reject.
- better-auth.session_token
- Keeps you signed in. Cookie, up to 7 days after you last visit.
- better-auth.session_data
- A signed copy of your session so pages load faster. Cookie, 1 minute.
- tbs_admin, tbs_view_as
- Site staff sign-in, and staff viewing the site as someone to help them. Cookie, staff only, hours.
- Instagram link state
- Checks that linking your Instagram was started by you. Cookie, minutes.
- sf_age_block
- Stops someone turned away by the age check from simply trying another year. Cookie, 1 day.
- Cloudflare bot check
- Cloudflare's check that sign-up isn't a bot may set its own security cookie. Cookie, set by Cloudflare.
- theme, dismissed banners
- Your light or dark choice, and announcements you closed. Stored in your browser only, never sent to us.
How long we keep it
- Your account and profile
- Until you delete your account.
- Sign-in sessions (with IP address and browser)
- Until the session expires, at most 7 days after you last use it.
- IP address you signed up from
- 90 days.
- Emails we send (in our outbox)
- 30 days.
- Invite, setup and password reset links
- 90 days after they're used or expire.
- Visit counters
- A keyed, one-way code for each visitor for 30 minutes; after that, only totals.
- Orders and tickets after you delete your account
- Kept for the show's and our financial records, without your name or email.
- Accounts disabled for breaking the rules
- 2 years, then deleted.
- Backups
- Database history is kept 30 days; offsite backups 90 days. Deleted data leaves them on that schedule.
Your rights and choices
Wherever you live, you can:
- Know and get a copy of the personal information we hold about you, in a file you can take elsewhere.
- Correct it: edit your profile, or ask us.
- Delete your account and personal information.
- Object to how we use it. Most of it you control directly: hide your profile, switch your Card Back off, or change Email preferences. For anything else, email us.
- Restrict our use while you dispute something (for example, whether it's accurate): we pause your account without deleting anything until it's settled.
- Choose your emails about messages and announcements in Email preferences. Account and ticket emails always go out.
California residents have these rights under the CCPA, along with the rights to opt out of selling or sharing and to limit the use of sensitive personal information (we do neither of those, so there's nothing to opt out of). We won't treat you differently for using any of them.
Signed in? Download your data or delete your account yourself on Your data. Otherwise email privacy@showfloor.me from the address on your account (or the one you used to buy tickets). We may ask you to confirm it's you, and answer within 30 days. Someone you authorize can ask for you with your signed permission.
If you run a show that other people have tickets or applications for, deleting your account is done with us, so those people keep their tickets.
If you're not happy with how we handled a request, tell us. You can also complain to the privacy regulator where you live (in California, the California Privacy Protection Agency).
Children
ShowFloor is for people 13 and older, and sign-up checks your age. We don't knowingly collect personal information from children under 13. If you think a child has an account, email privacy@showfloor.me and we'll delete it.
Security
Connections to ShowFloor are encrypted (HTTPS only), and our host encrypts stored data. Passwords are hashed, two-factor authentication is available to everyone (and required for staff), and sign-in links are stored only as one-way hashes. No system is perfectly secure, but we'll tell you promptly if a breach affects your information.
Changes and contact
When this policy changes, the date at the top changes too. Questions or requests: privacy@showfloor.me.