Privacy Policy

When you create an account:

• Your email address and your name, and a phone number if you add one to your account.
• Whichever sign-in method you choose. If you sign in with Google or Apple, we receive your email and name from them — we never receive your password.
• A profile photo, if you choose to add one.

When you use the app:

• The tickets you claim or buy, and the events they are for.
• The name you put on each ticket, which may be someone else's if you are buying for them.
• If you transfer a ticket: the email address of the person you send it to, so we can move the ticket to their account.
• Your orders: what you ordered, the amount, the payment method, and whether it succeeded.
• A push notification token, if you allow notifications, so we can send you ticket and event updates.
• If you follow an organizer, we store that you follow them and send you notifications when they publish new events. You can unfollow at any time in the app under Me → Following, and deleting your account removes your follows.
• Your IP address, to limit how often an account or network can place orders, transfer tickets or make other sensitive requests. We store only a keyed hash of it (for IPv6, of its network prefix), for about two hours, and don't link it to your profile.
• When a ticket is scanned at an event door.
• Your device's location, only when you ask for directions to a venue and allow location access. It is sent to Mapbox to calculate the route and travel time; we do not store it or link it to your account.
• When you report an event: your account, the reason, any note you add, the event, and the time.
• Diagnostics: if the app crashes or hits an error, a report with your device model, operating system, app version and what the app was doing. A sample of app activity is also timed, so we can find slow screens. These reports do not include your name, email address or IP address.

Events you save and a copy of your tickets for offline use are stored on your device.

If you register as an organizer, we also collect your organization name and a contact phone number. Your organization name is shown publicly on your event listings. A logo and a public contact (WhatsApp, phone or email) are shown publicly too, but only if you add them; the phone number on your application is not shown publicly.

We do not track your location in the background, and we do not collect your contacts or anything from your photo library beyond an image you deliberately choose as your profile photo or an event banner. The camera is used only to scan ticket QR codes at the door; nothing is recorded or uploaded.

• To sell you a ticket and to let that ticket be admitted at the door.
• To pay organizers what they are owed, and to settle payment disputes.
• To tell you about your tickets and about changes to events you hold tickets for.
• For safety and moderation: to review reports about event listings and take down listings that break our Terms.
• To keep the service working, and to find and fix errors.

We do not sell your personal data, and we do not use it for advertising.

We use other companies to run the service. They process your data on our instructions and for no other purpose:

• Clerk — accounts and sign-in. Holds your email, name, phone number if provided, profile photo and sign-in credentials.
• Neon and Vercel — the database and the servers the app runs on.
• Monime and Vult — payment processing for card and mobile money. Card and mobile money details are entered with them, not with us; we never see or store them.
• Mapbox — venue maps, and directions when you request them (receives your location at that moment). The map also sends Mapbox anonymous usage data about how it is displayed and performs; this is not linked to your account.
• Resend — sending ticket, order, moderation and event-status emails.
• Expo, with Apple and Google (Firebase Cloud Messaging) — delivering push notifications to your device.
• Inngest — running scheduled and background tasks, such as sending emails and releasing unpaid ticket holds. It handles account and order identifiers and the email details those tasks need.
• ImageKit — hosting event banner images and organizer logos uploaded by organizers.
• Sentry — error reporting. It is configured not to attach your name, email address or IP address to error reports.

Organizers see the information they need to run their event: the names on the tickets sold to it, and whether and when each ticket has been scanned. They do not see your email address or your payment details. To scan tickets at the door without a data connection, the organizer's phone downloads and stores that guest list — ticket holder names and scan status — on the device until it is next refreshed.

If you report an event, TikiT staff see which account made the report so they can follow up. The organizer is not told who reported their event.

Some of these companies store and process data outside Sierra Leone, mainly in the United States and the European Union. We only use providers that protect personal data under their own published privacy and security commitments, and we share only what each one needs to do its job.

Everything the app and website send to us travels encrypted over HTTPS. Access to our databases and service dashboards is limited to the people who run TikiT, and payment card and mobile money details never reach our systems. No system is perfectly secure; if a breach affects your data, we will tell you and the relevant authorities as the law requires.

We keep your account data for as long as your account exists. When you delete your account, your name, email, phone number, profile photo and notification token are erased and your name is removed from your tickets and orders. Who you follow is deleted with your account. If you are an organizer, the public contact and logo on your organizer profile are removed too.

Records of orders and payments are kept after that, with your personal details removed, because they are financial records that organizer payouts and payment disputes are settled against.

Reports you make about events are kept as moderation records. If you delete your account, they stay linked to the anonymized account, as orders do.

To stop a duplicate order or ticket claim going through twice — for example if the app retries after losing connection — we briefly keep a scrambled fingerprint of the request (tier, quantity and ticket names, hashed, not stored as text) for up to 24 hours, then delete it.

• See or correct your data. You can change your name, photo and password in the app under Me → Edit profile. To get a copy of the data we hold on you, or to correct anything you cannot change yourself, email hello@tikitsl.com from the address on your account. We reply within 30 days.
• Turn off notifications at any time in the app under Me → Preferences, or in your phone's settings.
• Location and camera access are optional. You can refuse or withdraw them in your phone's settings; directions and door scanning need them, but the rest of the app keeps working.

You can delete your account from Me → Delete account in the app, at any time. The full explanation of what is deleted and what is kept is on our account deletion page. If you cannot access the app, email hello@tikitsl.com from the address on the account.

TikiT is not intended for children under 13, and we do not knowingly collect their data. If you believe a child has created an account, email hello@tikitsl.com and we will delete it.

We may update this policy. If a change affects how we use your data, we will tell you in the app or by email before it takes effect. The date at the top shows the latest version.

TikiT is operated by Nexil Labs. Questions about this policy, or about the data we hold on you, go to hello@tikitsl.com.