Privacy policy
Last updated 29 October 2026
In short
- You never create an account. An event asks for your name and your email, nothing else.
- We use your email to send your token, a reminder and news about the event, and, if the event does it, one thank-you email the day after.
- Names and emails are erased 14 days after the event. We keep only numbers, such as how many people came and how much was collected.
- No cookies, no advertising trackers, and we never sell or share your data for marketing.
Who is responsible for your data
OneWristband runs OneWristband and decides how the data of the events it organises is used. You can reach us at onewristband@gmail.com. Every event page names the organiser. When an event is run by another organiser, that organiser decides why guests' data is used, and we handle it on the organiser's behalf. The organiser's contact is on the event page.
What we keep and why
- Sign-up: your name, your email, the event, the time you signed up and the time you accepted the terms. We use them to give you your token and to write to you about the event. The legal basis is your consent, the box you tick when you sign up. If you came from an ad, we also keep the short name of that ad's link, so the organiser can see which ads work.
- Coming and going: the time your token was scanned in and out, and the time you spent inside. We use it to let you in and, for events that charge by time, to work out the price. The legal basis is providing the service you asked for.
- Payments: cash paid at the desk is recorded as an amount. Card payments are handled by Stripe, and we never see or store your card details. We keep the amount, the status and Stripe's reference for the payment. The legal basis is providing the service and, for accounting records, our legal obligations.
- Tickets: events that issue a numbered ticket (PDF) put your name and token code on it. The ticket record we keep afterwards holds the number and the value, not your name or email, because accounting rules require us to keep it.
- Day-after form: your ratings and optional comments are saved without your name, email or token. Comments are removed with the rest of the data after 14 days.
- Waiting list: if an event is full and you join the list, we keep your name and email to tell you if a spot opens.
- Anonymous counts: we count how many times an event page was opened per ad, and how many times the Donate button was tapped. These counts are not tied to you: no cookie, no IP address, no identifier.
- Technical data: your IP address is used briefly in the server's memory to stop bots and abuse, and is not saved in the database. Our web server may keep ordinary connection logs for security, for a short time. The legal basis is our interest in keeping the service safe.
How long we keep it
Names, emails and notes are erased 14 days after the event ends, automatically. When the erase runs, the backups of the server's database are replaced, so they do not hold the erased data. Copies of emails we sent can sit in our mailbox, and we delete them as part of the same clean-up. What stays are numbers without names (how many registered, came, were inside, and the money collected), and payment and ticket records that accounting law makes us keep, without your name or email.
If you unsubscribe, we stop writing to you at once. Every email has an unsubscribe link.
Who else handles your data
- Google delivers our emails (Gmail). If you tap the map on an event page, Google loads it and sees your visit; the map does not load until you tap it.
- Stripe processes card payments, for events that take them.
- Hetzner hosts the server, in the European Union.
- The organiser of the event you sign up for.
- Donation pages. The Donate button opens a page run by the organiser's chosen service. From that point, its own privacy policy applies.
Some of these providers may process data outside the European Economic Area. They do it under the safeguards the EU recognises, such as standard contractual clauses. We do not sell your data, and we do not use it for advertising or profiling.
Cookies and your device
We use no cookies. Your browser stores a few things for you, only on your own device: the codes of the tokens you got, so your token page opens again, and a small counter so the welcome pop-up on our home page shows only your first three visits. None of it is sent to us. Clearing the site's data in your browser removes it.
Security
The site uses HTTPS. Names and emails can only be opened by the manager with a PIN, door staff see only a code, and the report an organiser receives has no names or emails.
Your rights
You can ask us to show you your data, correct it, erase it, limit how we use it, give it to you in a portable file, or stop using it. You can take back your consent at any time, and it does not affect what was done before. Write to onewristband@gmail.com, say the email you signed up with, and we answer within one month. After the 14 days there is nothing left to show or erase.
If you think we handle your data wrongly, you can complain to the Romanian data protection authority, ANSPDCP (dataprotection.ro), or to the authority of your own country.
Children
OneWristband is not meant for children under 16 to sign up by themselves. If you are under 16, ask a parent or guardian to sign up for you.
Changes
If we change this policy, the new version appears on this page with a new date. The terms you accepted at sign-up are linked from the terms and conditions.