Your trust matters. This policy explains what we collect, why we need it, and how to contact us about your information.
1. Scope and who we are
This Privacy Policy describes how CrimsonTickets collects, uses, discloses, and retains information in connection with our independent student ticket marketplace for Indiana home football and men’s basketball games. It applies to visitors, account holders, buyers, and sellers.
CrimsonTickets is not affiliated with Indiana University or Indiana Athletics. Questions or privacy requests can be directed to crimsontickets@outlook.com.
2. Information we collect
Account details: your IU email address, account identifier, email-verification status, and information you choose to share with us. Password authentication is handled through our authentication provider rather than displayed to other users.
Marketplace information: ticket listings, ticket descriptions, listed prices, purchase history, order status, buyer email used for ticket transfer, support communications, and information needed to investigate fulfillment or disputes.
Payment and payout information: Stripe processes buyer checkout payments. We receive payment identifiers, transaction amounts, and payment status. For seller payouts, we collect the Venmo username you provide and retain payout amounts, receipt-review records, payment references, and payout status. Your Venmo username and payment references are accessible to you and authorized CrimsonTickets administrators, not publicly displayed or shared with other buyers and sellers. We do not collect Venmo passwords or full card and bank details in our payout form.
Technical information: hosting and security services may process IP addresses, browser or device information, cookies, and operational logs necessary to run, maintain, and secure the website.
3. How we use information
We use information to create and secure accounts; verify IU email eligibility; enable listings and purchases; facilitate official ticket transfers; display orders and payout status; communicate about sales, transfers, disputes, or support requests; detect misuse; and meet legal obligations.
We use PostHog for page-view and checkout-flow analytics and privacy-masked session replays to understand site usage and diagnose failures. Replay text and input values are masked; hidden fields, file inputs, embedded frames, and canvases are excluded. Console logs and network request headers and bodies are not recorded. We remove URL query parameters and fragments and do not intentionally send passwords, payment details, or IU email addresses to PostHog. The integration respects browser Do Not Track settings.
4. How information is shared
To fulfill an order, sellers are instructed to transfer the ticket through the official Indiana Athletics transfer portal to CrimsonTickets. CrimsonTickets uses the buyer email associated with the order to forward the ticket to the buyer. Sellers do not need to see the buyer email for fulfillment. Buyers see information about ticket listings and order progress, not sellers’ private phone, bank details, or Venmo usernames.
We use service providers to operate the Platform, including Supabase for authentication and data storage, Stripe for buyer payment processing, Venmo for seller payments, Vercel for hosting, PostHog for usage analytics, and configured email or SMS providers for transaction notices. These providers process information subject to their own terms and privacy notices.
We may disclose information when reasonably necessary to investigate fraud, protect users, comply with lawful requests, enforce our terms, or in connection with a business transaction. We do not publicly display account phone numbers in ticket listings.
5. Cookies, security and retention
Authentication cookies and similar technologies may be necessary for signing in and keeping sessions secure. Hosting or payment providers may also use technologies described in their own policies.
We apply access controls and reasonable safeguards, but no online system is completely secure. Do not share passwords or official ticket-portal authentication codes.
We keep information for as long as reasonably necessary to operate accounts and orders, resolve disputes, meet legal and accounting requirements, and prevent fraud. When no longer needed, information may be removed or anonymized subject to backup cycles and legal retention obligations.
6. Your choices and privacy rights
You may ask to access, correct, or delete personal information associated with your CrimsonTickets account by contacting crimsontickets@outlook.com. We may need to verify your identity and may retain records necessary to comply with law, prevent fraud, or resolve payment disputes.
Depending on your location, privacy laws may give you additional rights, including rights to limit certain uses, object to processing, or appeal our response. We will assess requests under applicable law.
7. Minors, external links and updates
CrimsonTickets is intended for eligible IU students who have legal capacity to use a ticket marketplace. We do not knowingly seek to collect information from children under 13.
Links to official ticketing, Stripe, or other third-party sites are governed by those services' separate privacy policies. We may update this policy and will display the current revision date above. Where the law requires additional notice or consent, we will provide it.