Privacy Policy

Our Privacy Officer is Karan Nathwani, Founder of Toronto Jamming Culture. For any privacy question or request, email contact@torontojammingculture.com, or write to Toronto Jamming Culture Inc., Unit 2508, 361 Front St W, Toronto, ON M5V 3R5.

• Your account: name, email address and a scrambled (hashed) version of your password, so you can log in. We can never see your password. If you sign in with Google, Google shares your name and email with us, never your Google password.
• Your profile: phone number (to reach you about a booking, for example if a jam moves or is cancelled), date of birth (to check a jam’s age rules and to wish you a happy birthday), home address (so we know which areas our community comes from and can plan jams nearby), and an optional profile photo. When you upload a photo we remove its hidden details, such as where it was taken.
• Your tickets: which jams you booked, how many tickets, what you paid (including HST), any refund, and when your ticket was scanned at the door. Card payments are handled by Stripe: we never see or store your card number.
• Forms: what you write in our contact and sponsor forms (name, email or phone, company, and your message), so we can answer you.
• Jam announcements and newsletter: your email address (and first name if you’re logged in), the wording you agreed to, and when and where you signed up, as Canada’s anti-spam law requires. If you sign up on a form on our site, you’re only added once you click the link in our confirmation email. Every email has a one-click unsubscribe link.
• IP addresses: the internet address you used when you signed up, last logged in and bought a ticket. We use them only to protect your account and stop fraud (for example many accounts from one computer, or a stolen card). They are never shown on the site or shared for marketing, and are deleted after 180 days.

To improve the site, we count which pages are visited, how long each page is on screen, where visits come from (for example Instagram or Google), what type of device is used (phone, tablet or computer), clicks on links to other sites, and the steps of booking a ticket. These statistics are anonymous: they use a random number that is forgotten when you close the tab, and they never include your name, email, account or IP address. We never count private pages such as your account. They stay on our own server and are deleted after 13 months.

We also look at totals about our ticket holders (for example how many are 25 to 34, or live in a certain city, and how many came back for a second jam). Groups of fewer than five people are never shown, so nobody can be identified.

Always on (needed for the site to work): a login cookie that keeps you signed in, a security cookie that protects our forms, a cookie that remembers your cookie choice (so we don’t ask again; it lasts 13 months and renews each time you visit), and a few small notes saved in your own browser (whether you’ve seen the site tour or today’s birthday message, and the random number for our anonymous statistics).

Only if you say yes:

• Analytics (Google Analytics 4): helps us understand how people use the site. Google receives the page address (without any private part), your device and browser type and an approximate location. Google doesn’t store your IP address.
• Ads (Meta Pixel and Google’s ad features): lets us show TJC ads on Instagram and Facebook to people who visited our site, and see which ads lead to bookings. Meta receives the page address, the jam you looked at, the value of a booking, and your IP address and browser details. We never send Meta or Google your name, email or phone number.

Both stay off until you click “Accept” in the cookie banner, and they never run on private pages (your account, password reset, team pages). They are never used for logged-in members under 18. If your browser sends a “Global Privacy Control” signal, we treat it as a no. You can change your choice at any time with the “Cookie settings” link at the bottom of every page; turning a tool off also deletes its cookies. We keep an anonymous record of each choice (yes or no, and when) for two years.

We do not sell your personal information. We share it only with the services that run the site, and only what each one needs:

• Hostinger (website hosting, database and email)
• Stripe (card payments and refunds)
• Amazon Web Services (sending some emails)
• Cloudinary (storing profile photos and images)
• Google (sign in with Google, address suggestions, our contact and sponsor forms, and Google Analytics if you say yes)
• Meta (the Meta Pixel, only if you say yes to ads)

Some of these companies store or process information outside Canada, including in the United States, where local laws may let authorities access it. We may also share information if the law requires it.

• Your account, profile and tickets: until you delete your account. Past ticket payments are then kept without your name, for 6 years, as tax law requires.
• IP addresses: 180 days.
• Anonymous visitor statistics: 13 months.
• Newsletter sign-ups: until you unsubscribe (we then keep only a note that you opted out, so we never email you again).
• Sign-ups that were never confirmed (for example, a mistyped email address): accounts after 7 days, newsletter sign-ups after 30 days.
• Cookie choice records: 2 years.

The site only works over a secure (HTTPS) connection, passwords are hashed, payments go through Stripe, and only the people who need it can see your details: our admin, and the door team, who see your name and part of your email to check you in. New accounts confirm their email address with a one-time code. After 5 wrong passwords, logins to an account pause for 15 minutes and we email the owner. Changing or resetting your password logs you out on every other device. When you choose a password, we check that it hasn’t appeared in a known data breach, using the Have I Been Pwned service: only the first 5 characters of a scrambled fingerprint of the password are sent, never the password itself. If a breach ever put your information at real risk, we would tell you and the Privacy Commissioner of Canada as the law requires.

You can ask to see the personal information we hold about you, correct it, or have your account deleted, and you can withdraw your consent at any time (for example by unsubscribing or changing your cookie choice). You can change most profile details yourself in My Account, and delete your account there too (Login & security, then “Delete my account”). For anything else, email contact@torontojammingculture.com; we answer within 30 days.

If you’re not happy with our answer, you can complain to the Office of the Privacy Commissioner of Canada, or, in Quebec, the Commission d’accès à l’information.

If we change how we use your information, we’ll update this page and its date. If we change how we use cookies, we’ll ask for your choice again.