The fine print

Privacy policy

Person in charge of protecting personal information

Jas Heera, Tomatic Show · hello@tomaticshow.com · Montreal, Quebec. Under Quebec's Law 25 this person answers for how your information is handled and is who you write to about it. The address is live and read by a person.

What we collect, and for exactly what

When you buy a ticket: your name, email address and what you bought, so we can send the confirmation, let you in and refund you. Card details never reach us — Stripe handles payment.

When you ask for a city: your email and the city, to tell you if we book it. Nothing else.

When you join the returns list for a sold-out event: your email, to tell you if a seat comes back for that event. Nothing else.

When you subscribe to the newsletter: your email, for the newsletter.

When you submit a tape or a sponsorship inquiry: what you typed, so we can reply.

When you play the game: the ticks at which you tapped and a salted hash of your IP address, to verify the score and stop abuse. Not linked to your name.

Consent

Each of the above is a separate consent. We store the exact wording you agreed to and when. We never move you from one list to another. Every email we send for a purpose you opted into can be stopped by replying "stop" or writing to the address above.

How long we keep it

Order records: six years, as tax law requires. List consents: until you withdraw them. Game traces: 90 days. Sticker addresses: until the sticker is mailed. Analytics: 2 months, at Google. Everything can be corrected or deleted on request, except what the tax record requires us to keep.

Cookies

Essential cookies only, by default: one remembers your language, one keeps an admin signed in (staff only), one remembers your cookie choice. Google Analytics 4 is loaded only if you allow it in the banner — nothing from Google runs before that — and only then does it set its cookies (_ga, _ga_*) to count visits, page views, scrolls and outbound clicks. We switched off its tracking of file downloads, form interactions and site search, and Google Signals, so it never sees a ticket code or a form. Google keeps this data for 2 months, then deletes it; it is not shared with Google's other products. You can withdraw at any time from “Cookie choices” at the bottom of the page — the analytics cookies are then removed. The Meta Pixel is loaded under the same choice and no earlier: it sets _fbp so Meta can tell which ad led to a visit or a ticket, and it receives the moments a checkout was opened, a ticket was bought (amount only) and a list was joined — never a name, an email or a seat code. Withdrawing your choice removes its cookie too. Stripe sets its own cookies inside the payment form, for fraud prevention, when you open checkout.

Who else sees it

Stripe (payment), Resend (sending email), Vercel (hosting) and Neon (database). Each processes data on our instructions and only for the purpose named above. None of them stores it in Quebec: the database and the servers that run this site are in Northern Virginia, USA, and email is sent from the eastern United States. So your name, email address and order are communicated outside Quebec. Law 25 requires us to assess that before doing it, and we have: each provider is contractually bound to process on our instructions, encrypts data in transit and at rest, and offers protection we consider adequate for information of this kind. Google Analytics and the Meta Pixel, if you allow them, are the other transfers, described under Cookies.

If something goes wrong

If we learn of an incident involving your information that presents a risk of serious injury, we will notify the Commission d'accès à l'information and the people affected, and keep a register of it, as Law 25 requires.

Your rights

You can ask what we hold about you, have it corrected, have it deleted, or withdraw a consent, by writing to the address above. We answer within 30 days. Every email sent to a list also carries a one-click link that withdraws that one consent on the spot, no login. If you're not satisfied, you can complain to the Commission d'accès à l'information du Québec.

Last updated: 8 September 2026.