Ticket Wallet

Privacy Policy

Last updated: 8 May 2026

This Privacy Policy explains what personal data we collect, how we use it, and your rights over it. It applies to the Ticket Wallet mobile app and any associated services.

We comply with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023 (DPDP Act).

1. Data We Collect

1.1 Account data

When you register, we collect:

Name and email address
State / region (used to show localised event listings — no GPS required)
Account role (attendee, organiser, or scanner)

1.2 Ticket and order data

When you buy or list a ticket:

Ticket details (event, tier, seat number, purchase price, status)
Razorpay order and payment IDs (not card data — see §4)

1.3 Location (optional)

The app requests location permission only when you tap "Near me" in Search. We use your city/region in that session to filter nearby events. We do not store your location or track it in the background.

1.4 Push notification token

If you grant notification permission, we store your Expo push token to send you purchase confirmations, resale updates, and event reminders. You can revoke this in your device settings at any time.

1.5 Usage data

We may collect anonymised crash reports and performance metrics to improve the app. This data is not linked to your identity.

2. Data We Do NOT Collect

Card numbers, CVV, or banking credentials — handled entirely by Razorpay (PCI DSS Level 1 compliant)
Government ID or Aadhaar
Precise GPS location in the background
Your contacts or photos beyond what you explicitly upload (event images for organisers)

3. How We Use Your Data

Purpose	Data used
Account creation and authentication	Email, name, password hash
Showing relevant events	State / region
Processing ticket purchases	Order IDs, ticket details
Sending notifications	Push token
Preventing fraud and abuse	Account data, order patterns
Responding to support requests	Email, order data

We do not use your data for advertising and we do not sell it to third parties.

4. Payment Data and Razorpay

All payment processing is handled by Razorpay Software Private Limited. When you complete a purchase, your card or UPI details go directly to Razorpay — they never touch our servers. We only receive a payment confirmation and order ID from Razorpay. Razorpay's privacy policy applies to payment data: https://razorpay.com/privacy/

5. Data Storage and Security

Database: PostgreSQL hosted on Render (servers in the US; data transfer to the US is necessary for service operation)
Session cache: Redis on Upstash (used for short-lived checkout locks and seat holds; no PII stored)
Passwords: Hashed using bcrypt (cost factor 12) — plaintext passwords are never stored
OTPs: Hashed using bcrypt before storage and deleted after use
Tokens: JWT access tokens expire in 15 minutes; refresh tokens are rotated and stored as hashes
Transport: All communication between the app and our servers is encrypted via HTTPS

6. Data Retention

Data	Retention
Active account data	Until you delete your account
Ticket and order records	3 years (for dispute resolution)
Expired OTPs	Deleted immediately after use
Refresh tokens	7 days, rotated on each use
Push tokens	Until you revoke notification permission or delete your account

7. Your Rights (DPDP Act 2023)

You have the right to:

Access the personal data we hold about you
Correct inaccurate data (edit your name and state in Account settings)
Delete your account and associated personal data
Withdraw consent for push notifications (via device settings)
Nominate a person to exercise these rights on your behalf in the event of your death or incapacity

To exercise any of these rights, email us at support@ticketwallet.in. We will respond within 72 hours and action requests within 30 days.

8. Children's Privacy

Ticket Wallet is not directed at children under 18. We do not knowingly collect data from minors. If you believe a minor has registered, contact us and we will delete the account promptly.

9. Changes to This Policy

We may update this policy as the app evolves. Significant changes will be notified via the app. Continued use after changes are posted constitutes acceptance.

10. Contact and Grievance Officer

For privacy concerns or to exercise your rights under the DPDP Act:

Email: support@ticketwallet.in
Grievance Officer: Uday Chaudhary
Response time: Within 72 hours

11. Governing Law

This policy is governed by the laws of India, including the IT Act 2000 and the DPDP Act 2023.