Tick RSVP
Login

Privacy Policy

Last updated: August 8, 2026

1. Overview

At Tick RSVP, we prioritize the privacy and security of your personal data. This Privacy Policy details how we collect, protect, and handle authentication data and user session cookies.

2. Information We Collect & Sub-Processors

We operate under a data-minimization philosophy. The categories of information we collect include:

  • Email Address: Used solely to send passwordless verification OTP codes. This is shared with our email delivery sub-processor (ZeptoMail by Zoho) strictly for dispatching the codes. Zoho is fully GDPR compliant and does not use your email address for any other purposes.
  • Authentication Logs: Timestamps of verification events and session activity to prevent abuse.
  • Cookies: An `auth_session` cookie is issued to store encrypted session states, protecting your login state.
  • Product Analytics & Session Recordings: We use PostHog (EU-hosted) to understand how visitors use the site — page views, button clicks, and session replays of on-screen interactions. This helps us find bugs and improve the product. See Section 4 for details on what is and isn't captured.

3. How We Use Information

Your information is used strictly to provide services, including:

  • Verifying your identity via one-time passwords (OTP).
  • Maintaining your logged-in session securely using `HttpOnly`, `Secure`, and `SameSite` cookie flags.
  • Monitoring system security and detecting authentication abuse.
  • Understanding how the product is used, and diagnosing bugs, through privacy-conscious product analytics and session replay (see Section 4).

We do not sell, rent, or trade your data to third parties. Any analytics we collect is used solely to operate and improve Tick RSVP and is never used for advertising or third-party marketing purposes.

4. Cookies, Analytics & Session Recordings

We use essential session cookies for authentication. These cookies are stored on your device:

  • auth_session: An encrypted cookie containing session tokens. It is protected against cross-site scripting (XSS) via `HttpOnly` flags.

Separately, we use PostHog for product analytics and session recording (screen replays showing clicks, scrolling, and navigation — not raw video). This is configured with privacy in mind:

  • No analytics cookie:Anonymous visitor tracking uses a temporary, in-memory identifier only. Nothing is written to a cookie or to your browser's local storage, and the identifier resets when you close or reload the page.
  • Never linked to your identity: Analytics and session replay data is not linked to your email address, account, or name.
  • Form input is masked: Session recordings automatically redact the contents of form fields (e.g. the email address you type into the waitlist form is never visible in a replay).
  • IP addresses are anonymized before being stored by our analytics provider.

5. Data Hosting & Location

All user data, authentication logs, and backup files are hosted securely on a Contabo server in their Australian data center. Data is encrypted in transit via TLS, and access is restricted per the security measures described below.

Product analytics and session recording data (Section 4) is processed and stored separately by our sub-processor PostHog within the European Union.

6. Data Retention & Automatic Log Clearing

We do not hold onto logs or system traces indefinitely. To prioritize user privacy, we enforce automated log clearing and retention policies directly at the server level:

  • Access Logs: Web server access logs are rotated daily and permanently deleted after 14 days.
  • System Logs: System level logs are strictly capped to a maximum retention window of 1 month.
  • Docker Logs: Application container logs are size-capped and trimmed automatically to prevent disk accumulation.
  • Backups: Secure encrypted database snapshots are kept using a thinned rotation policy (retaining only the last 7 daily, 4 weekly, and 6 monthly snapshots).
  • Analytics & Session Recordings: Product analytics events and session replays are retained by PostHog for 30 days, after which they are automatically deleted.

7. Infrastructure Security

We take active, multi-layered steps to ensure the application server is hardened and secure:

  • Intrusion Detection: Automated monitoring (Fail2Ban) immediately blocks and bans IP addresses attempting exploit scans or authentication abuse.
  • Firewall Protection: A strict host firewall (UFW) blocks all unrecognized incoming network traffic.
  • Encrypted Transport: All data, sessions, and verification emails are fully encrypted in transit using industry-standard TLS.

8. GDPR & Your Data Rights

Under the GDPR, you have the following rights regarding your personal data:

  • Right of Access: You can request a summary and copy of the personal data we hold about you.
  • Right to Erasure (Right to be Forgotten): You can request the permanent deletion of your email records and session history.
  • Right to Rectification: You can correct any inaccurate information.
  • Right to Portability: You can request an export of your data in a structured, machine-readable format.
  • Right to Object: You can object to product analytics or session recording (Section 4) at any time; most ad blockers and tracking-protection browser extensions will prevent the PostHog script from loading entirely.

To exercise any of these rights, please contact our Data Controller at our support email address. Requests will be fulfilled free of charge within 30 days.

9. Contact Us

If you have any questions or concerns about this Privacy Policy, please contact us at [email protected].