Privacy Policy

This Privacy Policy explains what data Shownook collects, how we use it, who we share it with, and the choices you have.

1. Data We Collect

1.1 Information You Provide

• Account data: Name, email address, phone number, and password (stored hashed with bcrypt).
• Profile data: Profile picture and organiser details (for DIY portal users).
• Transaction data: Tickets purchased and booking IDs. Payment details are handled exclusively by Razorpay and never stored on our servers.
• Notification settings: Whether you allow push notifications on a device, and whether you want our evening event suggestions.
• Passkeys: If you add a passkey, we store only its public key and an identifier. Your fingerprint, face or screen lock never leaves your device.

1.2 Information Collected Automatically

• Usage data: Pages visited, search queries, events viewed, and session duration.
• Device data: IP address, browser type, operating system, and device identifiers.
• Cookies & local storage: Used for session management and authentication. See Section 6.
• Push notification tokens: A code that identifies your phone or browser so that we can send you notifications, such as booking confirmations and event reminders. It is created by Google's Firebase Cloud Messaging service and is only collected if you allow notifications.

1.3 The Shownook Android App

When you use our Android app, we also handle:

• A device identifier used while you watch a stream, to keep each ticket to one device at a time and to show a personalised watermark on the video.
• Saved tickets: Tickets you open are stored encrypted on your phone so you can show them without a connection. Saving a ticket as an image keeps it on your phone only.
• Your profile picture, if you choose one, which is uploaded from your photo library.

The app does not ask for your location, contacts, microphone or camera, and does not read your messages or other apps.

2. How We Use Your Data

• To create and manage your account and authenticate your sessions.
• To process ticket purchases and send booking confirmations.
• To provide access to purchased live streams and on-demand content.
• To send transactional emails (booking confirmations, password resets, event reminders).
• To send text messages (login codes, booking and cancellation notices) and push notifications (booking confirmations, event reminders).
• To send you event suggestions, at most once a day, if you have not turned them off in Account. We choose them from event details such as date and popularity, and we skip events you have already booked. They are not based on your location or browsing.
• To personalise event recommendations and search results.
• To detect fraud, abuse, and security threats.
• To comply with legal obligations.

We do not sell your personal data to third parties or use it for advertising purposes.

3. Data Sharing

We share your data only with:

• Razorpay: Our payment processor, under their own privacy policy (razorpay.com/privacy).
• Event Organisers: When you purchase a ticket, the Organiser receives your name and email to manage attendance. Organisers are bound by our data processing terms.
• Google: Delivers push notifications through Firebase Cloud Messaging, using the notification token described above. If you watch an event that streams through YouTube, YouTube (Google) also receives technical data such as your IP address when the video loads, under Google's privacy policy.
• SMS provider: Receives your phone number and the message text so that we can deliver login codes and booking notices.
• Infrastructure providers: Cloud hosting and CDN providers who process data on our behalf under strict data processing agreements.
• Legal authorities: When required by applicable law or court order.

Some of these providers, such as Google, may process data in countries outside India. They do so under their own privacy and data protection terms.

4. Data Retention

We retain your account data for as long as your account is active. Booking records are retained for 7 years to comply with financial regulations. You may request deletion at any time subject to legal retention obligations.

Push notification tokens are removed when you sign out, turn notifications off, or when the device stops accepting them.

5. Data Security

• All data in transit is encrypted via TLS (HTTPS).
• Passwords are stored using bcrypt hashing with a strong salt factor.
• Session tokens are stored in HTTP-only, Secure cookies.
• Video streams are protected via DRM and JWT-based access control.
• Access to production systems is restricted to authorised personnel only.

6. Cookies

We use the following cookies:

• Authentication cookies (user_token): HTTP-only, Secure. Required for session management. Expires in 7 days.
• Preference cookies: Store your UI preferences such as category filters. These are non-identifying.

We do not use advertising or third-party tracking cookies. You can disable cookies in your browser settings, but this will prevent you from logging in.

The Android app does not use cookies. It keeps your sign-in tokens in your phone's encrypted storage and removes them when you sign out.

7. Your Rights

You have the right to:

• Access: Request a copy of the personal data we hold about you.
• Correction: Update inaccurate data via Account Settings or by contacting us.
• Deletion: Request deletion of your account and personal data. See how to delete your account.
• Portability: Receive your data in a machine-readable format.
• Objection: Object to processing of your data in certain circumstances.

To exercise any of these rights, email privacy@shownook.com. We will respond within 30 days.

8. Children's Privacy

Our Platform is intended for people aged 18 and over, or younger users with parental consent as set out in our Terms. It is not directed at children under 13, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately.

9. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by email or via a prominent notice on the Platform.

10. Contact

For privacy-related questions, email privacy@shownook.com.