Privacy

What we collect

• Your email address, used to sign you in and to tell you about events you join.
• Profile details you choose to add: name, photo, username, short bio, website and social handles.
• Events you host, events you register for, and whether you were checked in at the door.
• Photos you add to an event's gallery, and ratings or comments you leave after an event.
• Communities you join or run. The public only sees the number of members and the names of each community's admins. A community's admins see its members' names and profiles, never their email addresses.
• Where you came from when you open an event page: the tracking link name (such as “newsletter”) or the website that linked to it (only its domain). We keep it in a first-party cookie for 7 days, so if you register we can tell the host which link worked.
• If you sell tickets, the payout account our payment provider creates for you (we store its ID and whether it is ready, never your bank details).
• Basic technical logs used to keep the service secure and working.

What is public

Your profile page shows your name, photo, username, bio, links and the published events you host. Your email address is never shown on your profile.

Whether your name appears in an event's public guest list is your choice. It is off by default, and you can change it any time in Settings. When it is off, other guests only see the attendee count.

What hosts see

When you register for an event, its host sees your name, email address, registration time, status (going, pending or waitlist), check-in status and your answers to any registration questions they ask, so they can run the event and contact you about it. Hosts write their own questions and are responsible for them; we tell hosts not to ask for sensitive information. Hosts can export their guest list as a spreadsheet. Hosts are responsible for how they use that information and may only use it for their event. Co-hosts the host adds see the same guest information. Hosts also see how many visits and registrations came from each link or website, never which guest came from where, and registration counts per link are only shown from three up. A host can hide the public guest list for their event. Ratings and comments you leave after an event are shown to its hosts without your name. Comments are only shown once at least three guests have answered, with the day but not the time. Photos in an event's gallery are public and show your username, so posting one shows that you went; you can remove your own photos at any time.

Public events can also appear in calendar feeds for a host or community and in event cards that hosts embed on their own websites. These only include public event details, never guest information.

Emails we send

We email you about events you join: confirmations, approvals, waitlist updates, reminders, cancellations, messages from the host and, after the event, one request for feedback. A host can also invite people by email after confirming they know them; we keep that confirmation with the invite. Emails about new events from hosts you follow are off unless you turn them on in Settings, and emails about new events in a community are off unless you turn them on on that community's page. Invitations, host messages, feedback requests, follow updates and community updates include a one-click unsubscribe link, and we keep only a scrambled (hashed) copy of unsubscribed addresses so we can honour the request.

Safety and moderation

A small number of EventX administrators can view accounts and events to fight spam and abuse. They can feature, hide from Discover, cancel or remove events, remove gallery photos, mark hosts as verified, and suspend or remove accounts that break our terms. When they act on your account, event or photo, we email you what happened and the reason, and how to ask us to look again.

Signed-in people can report an event, profile, community or photo. A report holds the reason chosen, any details written and who sent it. The person reported is never told who reported them. You can see the status of your own reports in Settings.

Administrators see your email address masked unless they need it to contact you; revealing it, opening your account page and looking up your registrations are each logged. They may keep short factual notes on an account to handle support and safety. You can ask to see reports about you (without the reporter's identity) and notes about your account. Every administrator action is recorded in an internal audit log that can't be edited.

Where it lives

Our database and uploaded images are hosted in a Canadian region (Montréal). Some service providers process data outside Québec and Canada under contractual safeguards that give comparable protection: Vercel (web hosting), Supabase (database), Resend (email delivery) and Stripe (payments, refunds and host payouts). Hosts who set up payouts give their identity and bank details directly to Stripe, under Stripe's privacy policy.

How long we keep it

We keep your account until you delete it. Event and registration records are kept while the event's host keeps the event. Answers to registration questions and event ratings and comments are deleted 12 months after the event. Gallery photos are kept until you, the host or an administrator removes them, or the event is deleted. Email delivery records are deleted after 30 days, and invitations to people who never signed up after 90 days. Security logs are kept for up to 12 months, and daily page-view counts and counts per link or referring website (which contain no personal information) for about 13 months. The link a guest registered through is cleared 12 months after the event. Reports are deleted 12 months after they are closed, administrator notes after 24 months, and the administrator audit log after 24 months. When an account is deleted, its notes are deleted and reports about it lose their details. Payment records are kept for the period tax law requires, without the account's name.

Your rights

Under PIPEDA and Québec's Law 25 you can access, correct or delete your information, and withdraw consent. You can edit your profile or permanently delete your account yourself in Settings; deleting removes your profile, photos, the events you host and your registrations.

The person in charge of protecting personal information at EventX can be reached at privacy@eventx.ca. If you are not satisfied with our answer, you may contact the Office of the Privacy Commissioner of Canada or the Commission d'accès à l'information du Québec.