Privacy notice

What we collect

Account data. When you create an account, we collect your email address, name, and any organization details you provide. Authentication is handled by Clerk; their privacy notice covers credential storage.

Lottery registration data. When someone enters an organization's public lottery, we collect the information shown on that org's registration form — typically name, email, and contact details. This data belongs to the organization that collected it.

Operational data. Standard request logs (IP, user agent, timestamps) are retained for security and debugging. We use hashed IP addresses and hashed email/organization combinations to count public registration attempts for one-hour windows. Public registration also sends a security challenge token and your IP address to Cloudflare for Turnstile verification.

How we use email

We send transactional emails only: account verification, lottery result notifications, and ticket delivery. We do not send marketing email from Ticket Farm. Organizations may contact their own registrants through their own channels; that's not handled by us.

Who can see your data

Lottery results are communicated directly by email. Winner information is not publicly displayed, and there is no public winners list. Each organization is isolated. Authenticated staff and admins can see their own org's registrants and tickets — nothing from other orgs. Ticket Farm staff can access data when necessary for support or to investigate abuse.

Subprocessors

We rely on third parties for hosting (Vercel), database (MongoDB Atlas), authentication (Clerk), email delivery (Resend), background jobs (Inngest), billing (Stripe — currently in test mode during beta), and registration security checks (Cloudflare). Each handles data under their own terms.

Contact

Questions, data requests, or deletion requests — email hello@ticketfarm.ca.