Privacy policy

Information collected for orders and bank transfers

When you submit an order request, Timtix stores the information needed to process the order and any later bank-transfer review:

• Your name and email address.
• Your phone number, if you choose to provide it.
• The event ID and event name, admin-managed offer snapshot, selected quantity, amount, and currency.
• A generated order reference and the order's payment and fulfilment statuses.
• If you submit an order while signed in, an internal reference linking it to your Timtix account. Guest orders have no account reference.

The order form does not ask for payment-card or customer bank account details. If you choose bank transfer, Timtix stores your submitted transaction reference, transfer date, claimed amount and currency, and the admin review history. Do not send account numbers or payment-card details through Timtix forms.

Bank-transfer instructions are shown only when an authenticated admin has configured and explicitly enabled the account, transfer method, and currency. ACH and wire are different methods and may have different eligibility, fees, and processing times. Supported methods and currencies depend on the verified account; Timtix does not claim worldwide local-transfer support. A submitted transfer reference is a claim, not confirmation that funds arrived.

Why we use this information

Timtix uses these details to administer your order, review transfer claims, and manage the order's fulfilment after payment verification.

Submitting an order reserves the selected admin-managed quantity. It does not verify supplier inventory or payment. Transfer claims are reviewed manually against the bank account. Only an authenticated admin can verify cleared funds. Payment verification does not guarantee ticket fulfilment. Event information and displayed offers can change.

Customer accounts

If you register, Timtix stores your name, email address, and a password hash used to verify sign-in. The password itself is not stored. When you sign in, the server issues a private session cookie and stores a non-reversible token hash in the PostgreSQL database. The cookie is HttpOnly and is not readable by browser scripts. Sign-out revokes the database session and clears the cookie.

Account registration and sign-in requests are rate-limited. Orders submitted while signed in are associated with that account so they can appear in its private history. Guest activity remains unassociated, and historical guest requests are not automatically assigned to an account. There is no password reset or account deletion feature.

Where information is stored and who can access it

Account details, password hashes, and session-token hashes, as well as submitted order details, are stored in a PostgreSQL database configured by the site owner. The application connects to it on the server using a private connection setting. The actual database provider, hosting provider, storage region, backups, and infrastructure logging depend on the owner's deployment configuration and are not specified by this project.

The site owner and authorized database operators may access stored account and order data. The private admin dashboard does not display customer names, email addresses, or phone numbers. A signed-in customer can see only order requests associated with their verified account; customer order data is not available through a public order-lookup page.

Event information and service providers

Timtix currently uses the Ticketmaster Discovery API as a technical source for event discovery and event details. Search terms and event identifiers are sent from Timtix's server to that API to retrieve listings and verify the selected event when a request is submitted. The order API does not send your name, email address, or phone number to Ticketmaster.

Event images are loaded by your browser from the image URLs supplied with event data. The relevant image host may therefore receive a request from your browser, including standard network and browser information such as your IP address and user-agent. The image host can vary by event.

The application code does not identify the production hosting or database vendor; the owner must confirm those providers and their applicable privacy information before launch. Infrastructure providers may process request, security, or database logs as part of operating the deployed service. Timtix does not use a payment gateway or automatically access bank account activity; an admin manually verifies transfers.

Retention and deletion

The database schema does not set a retention period for customer accounts or order requests. Expired session records and old rate-limit records are cleaned up during later authentication activity, but account records and order requests are not automatically deleted. The project has no customer-facing account deletion or correction request process. The owner must decide how long account data, requests, and backups are kept, how they will be securely deleted, and how customers can ask about or request changes to their information. No retention period is claimed here.

Cookies and site operations

The admin sign-in uses a signed, HttpOnly session cookie to protect the private dashboard. It is for administrator access, not a customer account or advertising feature. The reviewed application code does not include an analytics or advertising integration. Hosting and database providers may have their own operational logs, depending on the deployment configuration.

Privacy questions

A customer privacy contact has not been provided in the project. The owner must add a working privacy contact method here before launch so customers know where to send questions or requests about their information.