Privacy policy

The short version

Racket is a free calendar of local shows in Vancouver, plus which friends are going. This page says what we keep about you, why, who can see it, where it lives and how to delete it.

• Everything we keep is listed below.
• We don't sell your data or show ads. We use Google Analytics for basic stats, and it's never tied to your account.
• Most of what you do is for your friends only, unless you choose otherwise.
• You can delete your account yourself, any time.

Who we are

Racket is a small side project run by a few friends in Vancouver. "We" means the people who run it. Questions about your data go to (owner fills in, see O7).

What we keep about you

• Your account: your email, your password (scrambled one way, so nobody can read it, us included), your username and your display name.
• A profile picture, if you add one. We keep it as a small square copy with no location or camera data, and the file you upload is deleted once the copy's made.
• If you sign in with Google: Google gives us your email, your name, a link to your Google profile photo and sign-in tokens. We keep them with your account, and Racket never shows Google's name or photo. Your @username is made from the part of your email before the @ (other characters become _, cut to 18, plus a few digits if that's taken), and you can't change it yet. Your display name starts as the same until you change it.
• Sign-ins: each time you sign in we keep a session so you stay signed in. It doesn't keep your IP address or which browser you used.
• RSVPs: interested, going, got my ticket and I went, with when you tapped each one. You can tap I went on a show once it's started, even if you never said you were going.
• Friends and follows: your friends, friend requests you've sent and received, and the bands and venues you follow.
• Plans: go-together plans you make, and your answers (in or out) on anyone's plan.
• Pages and shows: what you put on an artist or venue page or a show, like names, bio, links, a venue's address and capacity, times, prices, ticket links and posters. We also note who made a page or posted a show, who's a member of a page, its tag setting and which pages it trusts.
• Booking inquiries: the dates, message and links, the artist page it came from, the venue it went to, and who sent it.
• Guests on plans: if you answer a plan without an account, the name you type, your answer and a random guest id, which is also kept in a cookie in your browser. If you sign up or sign in in that browser within 60 minutes, that one plan's answer moves to your account (if your account had already answered that plan, its answer stands, and a guest answer under your own display name or username is dropped). Nothing attaches once the show has started. A guest answer is also folded away if the account answers that same plan from the same browser. Otherwise the guest answer stays a guest's, and anyone with the plan's link sees the name until the show starts.

We don't ask for your age, gender, phone number, location or contacts, and there are no payments on Racket.

How you found us

When you open a link with a tag on it (like ?src=instagram on a link from Instagram) or come from another website, we remember that channel while your browser's open. It's saved on the RSVPs, follows, friend requests and plan answers you make, so we can tell whether posters or Instagram bring more people.

When you sign up, we also save once how you first found Racket (the channel, the website that sent you and the first page you landed on) and the last link you came in on. You can't change these, and they're for adding channels up, not for looking at you.

Global Privacy Control doesn't stop any of this. It only stops visits, the racket_vid cookie and Google Analytics (below).

Visits (our own stats)

We count visits ourselves. A visit is pseudonymous. It holds the hour it happened (rounded), the page (with usernames, plan links and anything after a ? taken out), the channel, the website that sent you, whether it was a phone or a computer, and a random visitor id.

• A visit has no IP address, no browser details and no account, and it's never joined to your account.
• The visitor id lives in the racket_vid cookie. It's a random id plus a signature, so only ids we made count, and it resets every 30 days.
• We don't record visits from known bots, or any visits at all if your browser sends Global Privacy Control.
• Visits are kept for as long as Racket runs. They aren't deleted with your account, because nothing in them points to you.
• Only admins see the stats, and only as totals.

Google Analytics

We also use Google Analytics for basic stats, like how many people looked at the calendar this week.

• What Google gets: the page you're on, cleaned up the same way as our own visits (usernames, plan links, page ids and anything after a ? taken out), the address of the website that sent you if you came from another one (just the site, like instagram.com, not the page), your browser and device details (like the browser and system version, screen size and language), and a rough location worked out from your IP address. Google says it doesn't store the IP address.
• What it never gets: your account, your name, your username or plan links. Page titles go to Google as the same cleaned-up page, because titles can hold names.
• Only Racket's admins can see the Google Analytics reports, and nothing in them says who you are.
• Its _ga cookies last 13 months, and Google keeps the detail for 2 months.
• To turn it off: send Global Privacy Control from your browser, or use the switch on this page.

Why we keep it

• To run Racket: sign you in, show the calendar, show you which friends are going, and keep your plans and history.
• To send the emails you need: verifying your email, resetting your password, and booking inquiries.
• To work out which channels bring people in, as totals.
• To keep Racket safe and working: stopping spam and abuse, and fixing things that break.

We don't sell your data, rent it out or use it for ads.

Who can see what

• Anyone, even signed out, can see your display name, your @username, how many friends you have and how many bands and venues you follow. Anyone can find you by your @username. How many people are going to a show is always public.
• Before a show starts, who sees your name on its show page is up to you (go-together plans are the exception, see below), at Profile, then Privacy, under "Who can see my plans?": Friends (the default), People who follow the same bands and venues (anyone who follows the venue or any act on the lineup), People going to the same show (anyone who has tapped Interested or going on that show), or Anyone. Your friends always see you, whatever you pick.
• "What can venues and bands see?" on the same screen (My name, Only a count, which is the default, or Nothing) is about the people who run a venue or band on a show you're going to. With My name, they see you the same way anyone else does, including through following the same bands or going to the same show. With Only a count or Nothing, those two routes don't work for them, so they only see your name if you're friends or your plans are set to Anyone. There's no separate list for hosts yet, so Only a count and Nothing work the same today.
• Once a show has started, only your friends see your name on it, and everyone else just counts you. The same goes for your went history and fan badges on your profile: only you and your friends see them.
• The bands and venues you follow: you and your friends see the list, and everyone else only sees it if your plans are set to Anyone.
• Your profile picture shows wherever your name shows, to the people who can see your name there.
• Go-together plans: anyone with a plan's link sees the show, who made the plan and who's in, until the show starts. From the start, the link only names the viewer's own friends and the viewer's own answer, and everyone else is a number.
• Your email address is never shown on Racket, with one exception. When you send a booking inquiry, it goes to the venue's owners by email with your address to reply to, and the venue's members see your address next to the inquiry. For a venue nobody has claimed yet, that's Racket's admins. If you signed up with Google, though, your @username is made from the part of your email before the @ (other characters become _, cut to 18), and that's shown wherever your username is. Your display name starts as the same until you change it.

Pages, tags and verified badges

• People who run a venue page see the booking inquiries sent to it (only venues get inquiries). People who run any page see the shows other people have tagged it on. A tag request shows the name of the page that posted the show, never the person.
• They decide whether a tagged show appears on their page: approve it, remove it (the show keeps the name as plain text), or approve and trust the page that posted it, so its next tags go straight on. "Tags from other pages" on the page decides whether they're asked first.
• A verified badge means an admin checked, outside Racket, that a page really is that band or venue. Only pages get verified, never people, and renaming a page takes the badge off.
• Admins are the few people who run Racket. In the app they can make and edit pages nobody has claimed yet, edit shows posted by no page or by an unclaimed page, verify pages, remove someone's profile picture, see visit totals, and get booking inquiries for venues nobody has claimed. They can see an unclaimed venue's inquiries with the senders' reply addresses. When a page's last owner deletes their account, the inquiries sent to it before then are hidden from admins and from whoever claims it later. Admins can also work directly in the database.

Cookies and your browser

None of these cookies are for ads. They're all Racket's own except _ga and _ga_<id>, which are Google Analytics'.

• __Secure-better-auth.session_token: keeps you signed in. It lasts 7 days and is renewed once it's a day old while you use Racket, so it runs out 6 to 7 days after you last used it. Signing out removes it.
• better-auth.state: only while you sign in with Google. 5 minutes.
• racket_src: the channel of the link you came in on. Gone when you close your browser.
• racket_ft: how you first found Racket (the channel, the website that sent you and the first page). 1 year.
• racket_lt: the last link you came in on. 1 year.
• racket_vid: the visitor id for visits, with its signature. 30 days, and never set if your browser sends Global Privacy Control.
• racket_guest: a random guest id, so an answer you give on a plan without an account is remembered, and joins your account if you sign up or sign in in that browser within 60 minutes, for the plan you just answered. 1 year. It's set on any plan link, even with Global Privacy Control, because the plan page needs it to work.
• racket_plan_intent: the show you tapped Make it a plan on while signed out. 5 minutes.
• racket_plan_attach: the plan you just answered as a guest, used up when you sign up or sign in. 60 minutes.
• racket_rsvp_intent, racket_follow_intent and racket_friend_intent: the RSVP, follow or friend request you tapped while signed out, so it happens once you sign in. 5 minutes each.
• racket_just_verified: says your verify link just worked, only on the verify page. 10 minutes.
• _ga and _ga_<id>: Google Analytics' own, a random id so it can tell browsers apart. 13 months from your last visit. Never set if your browser sends Global Privacy Control or you've turned Google Analytics off, and turning it off deletes them.
• racket_no_ga: only remembers that you turned Google Analytics off in this browser. 1 year.

racket_src, racket_ft and racket_lt are set whether or not your browser sends Global Privacy Control, and nothing clears them before they run out. They're copied into your account when you sign up (first and last touch) or tap something (the channel on RSVPs, follows, friend requests and plan answers). A new account made later in the same browser picks up the same first touch. Only visits, racket_vid and Google Analytics respect Global Privacy Control.

Racket also keeps one note in your browser's local storage, racket_session_refreshed_at, so it renews your sign-in at most twice a day.

Where it's stored, and who helps us

Your data is stored and handled outside Canada as well as in it. Canadian privacy law (PIPEDA, and PIPA in BC) allows that, and we're telling you here. While it's in another country, that country's law applies to it, and authorities there may be able to get at it.

• Neon: our database, in Oregon, US (us-west-2).
• Vercel: runs Racket, in the US. Its request logs hold your IP address, your browser and the pages you asked for, usernames and plan links included. Our own server logs there can hold ids too, like a show's id inside a poster's file name. All of it is kept for as long as Vercel keeps logs.
• Amazon Web Services: S3 stores posters and profile pictures (the only images on Racket) and Lambda makes the sizes Racket shows, both in Montreal, Canada (ca-central-1). CloudFront delivers posters and caches copies on Amazon's servers around the world. The processing function's logs (AWS CloudWatch) hold poster file names only.
• Resend: sends our emails. It keeps its own delivery logs, with addresses and what each email said, for as long as its own rules say.
• Google (Google LLC, United States): signing in with Google, only if you use it.
• Google Analytics (Google LLC, United States): our basic stats, see Google Analytics above.

When you upload a poster and save it to a show, Lambda makes the copies Racket shows, takes out location and camera data, and then deletes your original upload. Until that's done, the show page shows the original file. If you upload a poster but it never gets saved to a show, that upload and its processed card and full copies stay in storage.

How long we keep it

• Your account and everything on it: until you delete your account.
• Your profile picture: until you change or remove it, or delete your account.
• A sign-in stops working 6 to 7 days after you last used Racket, and signing out deletes it. One you never signed out of is deleted within about a day of running out.
• Password reset links work for 1 hour, and verify links for 24 hours.
• Wrong password tries on the delete account page: a note of each try (not the password) counts for 1 hour, so the limit on tries works, and it's deleted within about a day after that.
• Visits: as long as Racket runs.
• Google Analytics: Google deletes the detail (each event, like a page view) after 2 months, and its summary reports keep only totals. The _ga cookies last 13 months from your last visit.
• Guest answers on a plan: as long as the plan is there.
• Shows, posters and pages: we don't delete them. They stay up even after the person who posted them leaves.
• Booking inquiries: kept for the venue. If its last owner deletes their account, the ones sent before then are kept but hidden.
• Emails and logs at Resend and Vercel: as long as they keep them.

Deleting your account

Go to Profile, then Delete my account, and type your username and your password. If you only sign in with Google, you need to have signed in within the last day, or it asks you to sign in again first. It happens straight away and can't be undone.

What goes:

• your account: email, password, Google sign-in tokens, and every sign-in
• password reset links that haven't been used
• your profile: username, display name, both privacy settings, and how you found Racket
• every RSVP, with its steps, times and channel
• your friends and friend requests, both ways
• the bands and venues you follow
• plans you made, with every answer on them, guests' too
• your answers on other people's plans
• your membership of any artist or venue page
• your profile picture file, if there is one

What stays:

• Pages you made or ran. If nobody else owns one, it stays public, becomes unclaimed and is run by Racket's admins, and loses its verified badge and its other members. The booking inquiries sent to it before then are hidden from admins and from whoever claims it next.
• Shows and posters stay with their page, listed as before.
• Booking inquiries you sent keep their dates, message and links for the venue, and still name the artist page they came from, but not you or your email.
• Other people's RSVPs that came from your plans.
• Guest answers you left on other people's plans without signing in, unless they moved to your account (see Guests on plans), stay on those plans, because they belong to the guest and not your account. The racket_guest cookie stays in that browser until it runs out or you clear it.
• The racket_src, racket_ft, racket_lt and racket_vid cookies stay in your browser until they run out or you clear them, and a new account made in that browser picks up the same first touch.
• Visits, because nothing in them points to you.
• Google Analytics data, because it was never tied to your account, so there's nothing of yours to delete there. Google deletes the detail after 2 months, and what's left is totals.
• Emails already sent (verify, reset, inquiries) stay in people's inboxes, and in Resend's logs for as long as Resend keeps them. Vercel's server logs stay for as long as Vercel keeps them.

Your username is free for someone else to take straight away.

If you signed in with Google, deleting your account deletes our copy of your Google tokens. To take Racket off your Google account too, remove it in your Google account's settings.

Seeing and changing your data

Most of it you can see and change yourself:

• Your display name: Profile, then Edit profile.
• Who sees your plans, and what venues and bands see: Profile, then Privacy.
• Friends: Profile, then Friends, or Remove friend on their profile.
• Follows: Unfollow on the band or venue's page.
• RSVPs: Undo on the show.
• Your account: Profile, then Delete my account.

For anything else, like a copy of what we hold about you, fixing something you can't edit, or a question, email (owner fills in, see O7). We'll answer within 30 days.

If you're not happy with our answer, you can complain to the Office of the Information and Privacy Commissioner for British Columbia.

Kids

Racket is for people 13 and older. If you think someone younger has an account, email (owner fills in, see O7) and we'll delete it.

Changes

When this page changes, so does the date at the top.