Privacy Policy

When you create an account, we collect your name, email address, and password (stored as a one-way hash). If you verify your phone, we store the verified phone number. If you add a bank account for payouts, we store the last four digits only. We never store full account or routing numbers.

When you list or purchase tickets, we collect the listing details you provide (event, section, row, seat, price) and the payment information processed by Stripe, our payment provider. We store Stripe's transaction reference; we never see or store your full card number.

If you verify your identity, Stripe Identity collects a photo of your government ID and a selfie and compares them, which involves processing biometric data. Stripe performs the check and holds those images under its own privacy policy; FreelySeat receives only the result and the name on your ID, which we compare with your account name. You choose whether to verify, and you can sell without it.

We automatically collect IP addresses, browser type, and pages visited for rate limiting, fraud detection, and analytics. We do not sell this data.

To show events near you, we use your approximate location from your IP address or, if you allow it, your device's location. If you use the app and allow notifications, we store a push token for your device so we can send them.

We use cookies to keep you signed in and remember your preferences, and Google Analytics uses cookies to measure how the site is used.

To operate the marketplace: matching buyers with sellers, processing payments through Stripe, facilitating ticket transfers, and releasing payouts.

To send transactional emails via Resend: OTP verification, purchase confirmations, transfer updates, and payout notifications. You cannot opt out of transactional emails while you have an active account.

To detect and prevent fraud: unusual account activity, misuse of the platform, or attempted circumvention of our trust system.

To calculate your trust score: the number of verified credentials, completed transfers, and dispute history contribute to your public trust score visible to other users.

If you verify a mobile number, we use it to send one-time sign-in and verification codes, and alerts about your own account: when your ticket sells, when a delivery deadline is close, and when a payout fails. We only text a number after its owner has confirmed it by entering a code we sent to that number.

Message frequency varies and depends on your activity on FreelySeat. A user with no sales and no sign-ins may receive none. Message and data rates may apply.

We do not sell or share mobile phone numbers or SMS consent with third parties. No mobile information is shared with third parties or affiliates for marketing or promotional purposes. Your number is disclosed only to Twilio, the provider that delivers our messages on our behalf, and only for that purpose.

You can stop receiving texts at any time by replying STOP to any message, or by removing your phone number in Settings. Reply HELP to any message for support.

We share your name and trust score with other FreelySeat users as part of the marketplace experience. Your phone number is never shared with other users.

When you buy tickets, the seller sees your name and the email address on your order, because that is where they transfer the tickets. For tickets from our partner inventory, your name and email are shared with TicketNetwork, the partner that issues them.

We share data with Stripe (payment processing and identity verification), Resend (transactional email), Twilio (text messages), Neon (database hosting), Vercel (website hosting), and Google Analytics (site usage measurement). All sub-processors are contractually bound to protect your data.

We may also share information when the law requires it, or when needed to prevent fraud or protect our users.

We do not sell, rent, or share your personal data with advertisers or data brokers.

Account data is retained for as long as your account is active. When you delete your account, we remove your name, email address, phone number, password and saved preferences right away. Order and payout records are kept in anonymized form for at least 7 years for tax and accounting, and Stripe keeps its own payment records as the law requires.

Verification tokens (OTPs) expire within 10 minutes and are deleted after use.

When you opt in to text messages, we keep a record of your number, the time, and the exact consent wording you agreed to, because carriers can ask us to prove consent.

ID verification images are kept by Stripe under Stripe's retention rules; we keep only the verification result and the name on your ID for as long as your account is active.

You may request a copy of your personal data, correction of inaccurate data, or deletion of your account by emailing us at support@freelyseat.com. We will respond within 30 days.

If you are in the European Economic Area, you have additional rights under GDPR including the right to data portability and the right to lodge a complaint with your local supervisory authority.

Residents of California and other US states with privacy laws have similar rights to access, correct, and delete their data. We honor these requests for every user, and we do not sell or share personal data for targeted advertising.

FreelySeat is for adults. We don't knowingly collect personal data from anyone under 18. If you believe a minor has given us their data, contact us and we'll delete it.

Passwords are hashed using bcrypt with a cost factor of 12. All connections are encrypted in transit (TLS 1.2+). Payment data is handled entirely by Stripe under PCI DSS Level 1 compliance. We are not in scope for PCI.

We use rate limiting and HMAC-verified webhooks to prevent unauthorized access to our APIs.

We will notify registered users by email at least 14 days before any material changes to this Privacy Policy take effect. Continued use of FreelySeat after the effective date constitutes acceptance of the updated policy.