Privacy Policy

1. The short version

FaceValue collects what it needs to run a ticket marketplace and nothing else. We don't run ads, we don't sell your data, and we don't use analytics trackers. Most of what we hold exists so that money and tickets can change hands safely between strangers.

2. What we collect

• Account: email address, username, optional name and avatar image, and a hashed password. We never store the password itself.
• Transactions: what you bought or sold, for how much, and the state of the escrow. Payments are processed by Stripe — card numbers never touch our servers. We store Stripe's identifiers, including a card fingerprint we use to enforce purchase limits against bots.
• Seller verification: ticket receipts you upload so we can verify face value. Receipts can contain names, order numbers, and purchase details; they are stored encrypted and used only for verification and dispute resolution. Sellers who receive payouts also complete Stripe Connect onboarding, where Stripe — not us — collects identity and banking details.
• Messages and reviews: what you write to other users and about them stays on the platform as the record of the transaction.
• Location, only if you allow it: the home page can ask your browser for your location to sort nearby shows first. It's used for that sort and never stored — decline the prompt and everything works, unsorted.
• Technical: IP addresses, used for rate limiting and abuse prevention (held briefly in memory and in your signed session), and standard server logs.

3. Cookies

Two, both essential: a session cookie set on every visit — it keeps you logged in and carries the IP address we rate-limit on — and, if you check "keep me logged in," a signed remember-me cookie that lasts 60 days. No advertising cookies and no ad or analytics trackers. Our bot-challenge script loads from Cloudflare on every page, so Cloudflare sees the same request your browser makes.

4. Who else sees data

Service providers we use to run the site, each receiving only what its job requires: Stripe (payments and seller identity), Cloudflare (bot challenges and email routing), our email provider (currently Resend), object storage for receipts and avatars, and our hosting provider (Fly.io). Page fonts load from Google Fonts, which means Google sees the same request your browser makes to any site using it. We disclose data beyond this only if the law requires it, and we don't sell personal information to anyone.

5. How long we keep it

Account data lives as long as the account does. Transaction records, receipts, messages, and reviews are kept while they may matter to a dispute, a chargeback, or a legal obligation — card chargeback windows run for months, so transaction records outlive the escrow window on purpose. Rate-limiting data is transient.

6. Your choices

You can edit your account details in settings, decline the location prompt, and skip the remember-me cookie. To ask what we hold about you, or to delete your account and its data, email support@onlyfacevalue.com — we will act on it, keeping only what an open transaction, a chargeback window, or the law requires us to keep.

7. Children

FaceValue is for adults. We don't knowingly collect information from anyone under 18; if that happens, tell us and we'll delete it.

8. Changes

If this policy changes materially, we'll post the new version here with a new effective date. Questions: support@onlyfacevalue.com .