Privacy Policy

Club Space is software that student clubs use to publish events, sell or give out tickets, and check people in at the door. “We” and “us” means the people who run Club Space. Club Space is independent: it is not run by, affiliated with, or endorsed by any university.

Each event is run by a club, not by us. The club decides what to ask you at checkout and what to do with the answers. This policy explains what we do with your information and what the club can see.

• Account details: your email address and password (handled by our sign-in provider), and your name if you choose to give one. Your name is what clubs see on their order lists and at the door; leave it out and they see a placeholder instead. If you sign in with Google, Google shares your name and email address with us.
• Older profile details: an earlier version of signup also asked for your university, age, graduation date and (optionally) major. Signup no longer collects any of them. Accounts created while it did still have those answers stored privately, visible to nobody but you.
• Checkout answers: anything a club asks you when you buy or register, for example a dietary requirement or an accessibility need. Only answer what you are comfortable sharing with the club.
• Orders and tickets: which event, which tickets, how many, the price and fees, order status, any refund, and any promo code used. We store only a scrambled (hashed) form of each ticket's code, never the code itself.
• Payment records: the payment status and Stripe reference numbers for your order. We never see or store your card number; you type it into Stripe's own checkout page.
• Door check-in logs: when a ticket was scanned, by which club scanner device, and whether it was accepted.
• Technical and device data: your IP address and the requests your browser makes (in our hosting logs), and error and performance reports from the app.
• Things you send us or a club: waitlist sign-ups (email address, and your name if you give it), a donation's amount and, only if you tick the box for it, your consent to hear from the club about what your donation achieved, problem reports sent through Report a problem, and, for club officers, club and member records, event details, and a log of actions taken in the club.

We use this information only to run Club Space: to create your account and sign you in, to record your order and deliver your tickets, to let the club check you in at the door, to email you your tickets and account messages, to keep the club's books accurate, to prevent abuse and fraud, to fix errors, and to answer you when you contact us.

We do not sell your personal information, we do not use it for advertising, and we do not use tracking or advertising cookies. We use Vercel Web Analytics, a cookieless tool, to see in aggregate which pages are viewed and to count a few anonymous milestones, such as a checkout starting for an event. For each page view it receives only the page's address without its query (for example, an event page's address) plus any campaign tags (utm_ tags) the link carried; a milestone adds only the public name of the event and club it happened on. Your ticket page, door-scanner links, club invitations, unsubscribe links, and the sign-in and email-confirmation links we send you are never reported at all, and it never receives a ticket link, a sign-in or invitation token, an order number, a promo code, your name, your email, or any amount you paid. Like any website request, Vercel also sees general technical details such as your browser type, device type, approximate country, and the site you came from. It sets no cookie. If your browser sends a Do Not Track signal, we skip those milestone counts entirely. The only cookies we set are the ones that keep you signed in.

When you buy or register for an event, that club's officers can see your name (if you gave one), your order and its status, and your answers to that club's checkout questions. They do not see your email address through Club Space unless you gave it to them yourself, for example by joining that event's waitlist, where the club sees the email address and name you enter, or by ticking “Email me about what my donation achieved” (see Donations below). At the door, the club's scanner devices show the buyer's name for each ticket scanned.

The club is responsible for how it uses your information once it can see it — for example if an officer copies it, screenshots it, or shares it outside Club Space. Questions about a club's own use of your data should go to that club. Officers can delete checkout answers, and answers are deleted when the club deletes the question or the event.

If an event takes donations, you can add one to your order. The donation goes to the club running the event: the club is the merchant of record, receives the money, and is responsible for what it does with it. Club Space takes no platform fee from a donation. The club's officers see each paid donation's amount and date, not who gave it.

Next to a donation there is a box, unticked unless you tick it: “Email me about what my donation achieved.” Only if you tick it do we store your consent with your order — your email address, the order, the club, and when you agreed — and only then can that club's officers see your email address beside your donation and download it, so they can tell you what it paid for. Every such email must carry an unsubscribe link; once you use it, the club no longer sees your address there. Leave the box unticked and nothing about you is kept for this purpose.

We use these service providers to run Club Space. Each receives only what it needs for its job:

• Supabase — our database and sign-in provider. It stores the information described above and sends account emails such as sign-up confirmation and password reset.
• Stripe — payments. You pay on Stripe's own page, and the payment goes to the club's own Stripe account. Stripe collects your card details and contact details under its own privacy policy. We send Stripe the ticket names, amounts and our own reference numbers, not your name or email address. We never see your card number.
• Resend — email delivery. It receives your email address and the message: your ticket links, a club invite, or a waitlist notice.
• Vercel — hosting. Every request to the site passes through it, including your IP address, and it keeps our server logs. It also runs Vercel Web Analytics, our cookieless page-view and milestone counter described under “Why we use it” above.
• Upstash — rate limiting, to stop abuse. It receives your account ID or IP address as a counter key, which expires within minutes.
• Sentry — error and performance monitoring. It receives crash reports and performance data so we can fix problems. We scrub identifiers such as session cookies, IP addresses, email addresses and ticket links out of that data before it is sent.
• Anthropic — the AI model behind the “Build with AI” assistant that club officers can use to find their way around, answer questions about their club and draft events. It receives what the officer types; the officer's role and the part of their email address before the @; the names of the clubs the officer belongs to and their role in each; event details (such as title, dates, venue, description, capacity, ticket types and prices); event totals (how many places were sold, refunded and checked in, by tier and by day); and the club's members' display names, roles and the dates they joined. For a treasurer or above it also receives the club's money totals: its balance, budget spending, unpaid dues and reimbursement totals, and each event's revenue (the money kept and the money refunded). It never receives buyers' names, emails, orders, or checkout answers, anyone's email address, ticket links or codes, or card details.

• Account details: while your account exists, or until you ask us to delete them.
• Orders, payments, refunds, the club's ledger and the log of officer actions: these are financial and accountability records. They are kept rather than edited or deleted, so a club's books stay correct. If you ask us to erase your data, we remove or anonymize the personal details attached to them where we can, instead of deleting the records.
• Checkout answers: until the club deletes them, the question, or the event.
• Rate-limit counters expire within minutes. A club scanner device's access ends after at most 30 days.
• Copies held by our service providers (for example logs and error reports) are kept under their own retention settings.

We take reasonable measures to protect your information. For example: access rules in the database limit each person to the data their role allows; ticket codes are signed and stored only in hashed form; card details never touch our servers; sign-in and abuse limits are enforced; traffic is encrypted in transit; and identifiers are scrubbed from error reports.

No system is perfectly secure, and we cannot guarantee that your information will never be accessed without permission. You can help: use a strong password you do not reuse, do not share your ticket links except with the person who will use the ticket, and tell us straight away if something looks wrong.

If we learn that your personal information has been accessed without authorization, we will investigate, take steps to contain it, and notify you and any authorities as required by law, without unreasonable delay.

You can ask us for a copy of your personal information, ask us to correct it, or ask us to delete it. We handle these requests by hand: contact us from the email address on your account so we can confirm it is you. We will do what we can within the limits described under “How long we keep it”, and tell you if we cannot do something and why. For data a club holds about you, such as your checkout answers, you can also ask the club directly.

Club Space is not meant for children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has given us personal information, contact us and we will delete it.

We may update this policy as Club Space changes. The date at the top shows when it last changed. If a change materially affects how we use information we already hold, we will tell account holders before it takes effect.

Questions or requests about your data: support@clubspaceapp.com. To report a problem with an event, a charge, or a safety or security concern, use Report a problem. See also our Terms.