1. Who we are
TousePass (tousepass.com) is a marketplace where Columbia and Barnard students resell tickets to campus events. It's run by Gapless Labs. In this policy, “we” means Gapless Labs. You can reach us at info@gaplesslabs.com.
2. What we collect
- Your Google account basics. When you sign in with Google, we receive your name, your school email address, your profile picture and your school's domain (columbia.edu or barnard.edu). We don't receive your Google password.
- Listings. The events you list for, your prices, and the ticket file you upload (a Posh PDF or screenshot) with its QR code.
- Purchases and payouts. What you bought or sold, when, for how much, and the payout and refund history. Card and bank details go directly to Stripe. We only see things like the card brand and last four digits.
- Claims and reports. What you write in a claim, response or report, and any photo, video or screenshot you attach.
- Saved events and settings. Events you save and your account settings.
- Technical data. Basic logs our hosting provider keeps when you use the site, such as IP address, browser type and the pages requested, used for security and fixing problems.
3. How we use it
- To confirm you have a Columbia or Barnard account and to sign you in.
- To run the marketplace: show listings, hold a ticket while you pay, deliver your ticket, and pay sellers.
- To protect buyers and sellers: block duplicate QR codes, review claims and reports, and recover losses from sellers found at fault, as described in the Terms.
- To email you about your account: receipts with a calendar invite, sales, claims, payouts and changes to events you hold tickets for. We don't send marketing email.
- To keep records we need for accounting, taxes and disputes.
We don't sell your information, and we don't use it for advertising.
4. What other people see
- Sellers: your full name and your sales record (number of sales and bad tickets) appear on your listings to anyone browsing.
- Buyers: sellers don't see who bought their ticket. If you file a claim, the seller sees the claim details and the evidence you upload.
- QR codes: a seller's QR code is shown only to the person who buys that ticket.
5. Who we share it with
We share information only with the services that run TousePass, and only what they need:
- Stripe processes payments, holds payout accounts and saved cards, and verifies sellers' identities. Stripe handles that data under its own privacy policy.
- Google provides sign-in.
- Vercel hosts the site, and our database provider stores account and marketplace data.
- Resend sends our emails.
We may also share information if the law requires it, to respond to a payment dispute, or to protect people from fraud or harm. If Gapless Labs is ever sold or merged, this information may transfer to the new owner under the same protections.
6. Google account data
We ask Google only for your basic profile and email address (the openid, email and profile permissions). We use it only to sign you in, check that your account is on columbia.edu or barnard.edu, and show your name on your listings. We don't access your Gmail, Google Calendar, Drive or contacts. Calendar invites arrive as ordinary email attachments, and you choose whether to add them. TousePass's use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
7. How long we keep it
- Ticket images and QR codes: stored encrypted, then deleted once the claim window and any open claim on that ticket are closed. We keep a one-way fingerprint of each code to stop it being listed again, plus a record of the sale.
- Claim and report evidence: kept while the claim or report is open, then for as long as needed to handle any related payment dispute.
- Account, sales and payout records: kept while your account is open and afterwards for as long as needed for accounting, tax, fraud prevention and dispute purposes.
8. Cookies
We use cookies only to keep you signed in and to make the site work, such as holding a ticket while you pay. We don't use advertising or cross-site tracking cookies. Stripe may set its own cookies on its checkout and onboarding pages to prevent fraud.
9. Your choices
- You can ask for a copy of your information, ask us to correct it, or ask us to delete your account by emailing info@gaplesslabs.com from your school address.
- We may need to keep some records after deletion, such as sales, payouts, claims and QR fingerprints, for the reasons in section 7.
- You can remove TousePass's access to your Google account at any time in your Google Account settings.
10. Security
Uploaded tickets are encrypted and hidden until purchase, payment details stay with Stripe, and access to account data is limited to what's needed to run TousePass. No system is perfectly secure, so please keep your Google account protected and keep your ticket private.
11. Changes and contact
If we change this policy, we'll update the date at the top, and we'll email you about significant changes. Questions go to info@gaplesslabs.com.
TousePass is meant for college students and isn't directed to children under 13.