Privacy Policy

This Policy applies to the Spill Club website, live events, and related services (the “Platform”). It covers attendees, creators, people who apply to host, and visitors who browse without an account. It describes our own practices; the companies we rely on to operate are listed in Section 7.

When you buy a ticket. Payment happens on a page hosted by Stripe. Stripe collects your card details and passes us your name and email address, plus a US shipping address when your ticket includes a supply kit. We store those along with a reference to the transaction.

When you sign in. We use a one-time link sent to your email. There is no password, so we never store one. Your email address is the only credential.

When you take part in an event.We store the chat messages and questions you write, the display name shown beside them, which questions you voted for, and any photo of your work you upload. If you accept an invitation to come on camera during Q&A, we record that you did.

When you apply to host. We collect your name, email, Instagram handle, optional TikTok handle, a photo, your professional title, and the answers you write about yourself and your event idea. We also keep internal notes about the application, and a record of the creator agreements you accepted and when. If your application is approved, your name, handle, bio, title, and photos become a public creator profile.

When you ask to be notified. If you ask us to tell you when booking opens for a date, we store your email address, that date, and your time-zone preference.

It is as useful to say what we do not do. Spill Club does not collect or store:

• Your card number, expiry, or security code — those are entered on Stripe's own page and never reach our servers.
• Your phone number or date of birth.
• Your location. We never ask your browser or device for GPS coordinates.
• Your IP address or browser user agent.
• Any advertising or cross-site tracking identifier.

We do not record events, and the Platform has no recording capability. We do not use analytics, advertising pixels, or session-recording tools of any kind. We do not sell personal information, do not share it for advertising, and do not use it to train artificial intelligence models.

The optional “where are you joining from?” prompt during an event is a free-text box you can skip. Whatever you type appears to the room for a few seconds and is never stored.

We use personal information to:

• Sell you a ticket and confirm your purchase.
• Admit you to the event you paid for, and only that event.
• Ship supply kits.
• Run the live session — chat, questions, votes, reactions, and Q&A.
• Review and respond to creator applications.
• Answer your support messages.
• Prevent fraud, abuse, and breaches of our Terms.
• Meet our legal, tax, and accounting obligations.

Inside a live event, other participants see your display name — your first name from your ticket, or a generated name like “Painter 204” — next to your chat messages and questions. Your email address is not shown to other participants, and is not used as your identifier in the video room. Vote totals are shown without names.

Your camera and microphone reach other attendees only if you raise your hand, the host invites you, and you accept.

Photos of your work are stored privately and shared only with you and the host of that event, through links that expire after two hours. They are not shown to other attendees unless the host features one on screen during the session. We remove embedded camera metadata — including any GPS coordinates — from images before storing them.

An approved creator's profile — name, handle, bio, title, and photos — is public.

Every email we currently send is transactional, meaning it exists because you did something that needs a reply: your ticket receipt with a calendar invitation and a link to your event, confirmation that we received your creator application, the outcome of that application, and your one-time sign-in link.

Keep your ticket email to yourself. The link in your receipt opens your event for up to 45 days, and anyone holding it can use it.

We do not currently send marketing email. If we start, every such message will include a way to unsubscribe.

A small number of companies process data on our behalf, each under its own agreement with us and only to provide its service:

• Stripe — payment processing. Receives your name, email, card details, and shipping address, entered on its own page.
• Supabase — our database, sign-in system, and file storage. Also sends your sign-in emails.
• LiveKit — live audio and video during an event.
• Resend — delivery of the emails listed in Section 6.

We may also disclose information where the law requires it, to enforce our Terms, to protect someone's safety, or in connection with a merger or acquisition — in which case we will tell you before your information becomes subject to a different policy.

We keep information for as long as we need it to run the Platform and meet our legal obligations. Transaction records are kept for tax and accounting purposes. Event content such as chat and questions is kept with the event record. Application records are kept so we can handle re-applications consistently.

You can ask us to delete your information at any time — see Section 9.

Depending on where you live, you may have the right to access a copy of your personal information, correct it, delete it, or object to certain uses. California residents have these rights under the CCPA, as amended by the CPRA. We honor these requests wherever you live.

How to make a request. Email us at the address in Section 14. We handle requests manually, so please allow us a reasonable period to respond, and expect us to ask a question or two to confirm the request really comes from you.

What we cannot undo. Deleting your account does not retract chat messages or questions other people already saw during a live event, and we may keep transaction records where the law requires. We will tell you what was kept and why.

We will not retaliate. Exercising a privacy right will never cost you a different price or a worse experience. We do not sell or share personal information as those terms are defined under California law, so there is nothing to opt out of.

We use no analytics, advertising, or tracking cookies. We set two cookies, both strictly necessary: one that remembers you hold a ticket so you do not have to click your emailed link every time, and one that keeps Spill Club staff signed in to admin tools.

We also store a few things in your browser to make the experience work: your display name, which dates you hold tickets for, your supply checklist, your sign-in session, and a random identifier for your browser. That identifier is saved alongside your chat messages so the room can tell messages apart. You can clear all of this through your browser's settings for this site.

Card data never reaches our servers. Access to event content requires a valid ticket for that specific event, checked on our servers rather than in your browser. Administrative tools are restricted to Spill Club staff, and data is transmitted over encrypted connections.

No system is perfectly secure. If you find a security or privacy problem, please tell us at the address below — we will take it seriously and will not pursue anyone who reports an issue in good faith.

Spill Club is for adults aged 18 and over, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has given us personal information, contact us and we will delete it.

We may update this Policy. When we make a material change we will post the revised version here, update the Effective Date and version number, and — where the change affects information you already gave us — tell you by email.