Privacy Policy

• We only collect what we need to make your band work, ship it, and show you who you met.
• We never sell your data and we don’t run ads.
• Our site analytics are cookieless and count visits in aggregate. They don’t identify you or follow you to other sites.
• We only email you about marketing things (like a waitlist) if you ask us to, and you can unsubscribe any time.
• When someone taps your band, you see when it happened and an approximate city. We don’t record their name, number or exact location unless they choose to send them to you.
• You can change what you share, disable a band, or delete your account at any time.
• Larp2Alt is based in Ontario, Canada, and handles personal information in line with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).

Your account. Your email address, used to sign you in (via a one-time link or code) and to contact you about your account or orders.

Your profile. The name, headline, bio, accent color and optional photo you add to your Larp and Alt sides, and the links you choose to share (for example phone number, email, Instagram, LinkedIn, Discord). This information is public to anyone who taps or scans your band, and only for the side they tap. You decide what goes on each side.

Your bands. Each band’s serial number, chip codes, colorway, size, status (active or disabled) and which account it belongs to.

Taps. When someone opens your page by tapping or scanning your band, we log the time, which side was tapped, the event name if you have event mode on, an approximate location (city, region and country, derived from their IP address by our hosting provider), and a coarse device type (such as “iPhone” or “Android”). We do not store the tapper’s IP address. We don’t log taps on your own band while you’re signed in.

Band activation (delivery confirmation). When a band we shipped is first used (its setup page opened by tapping the chip, it’s claimed with the PIN card, or it’s first tapped), we record the time, an approximate location (city, region and country, derived from the IP address by our hosting provider; the IP address itself isn’t stored) and a coarse device type, linked to the band’s serial number and the order it shipped in. We use it only to confirm delivery, to handle “my order never arrived” claims and to prevent fraud, including answering a payment dispute (then it’s shared with Stripe and your card issuer).

Fraud prevention. With every order and pre-order we store a one-way hash (a scrambled fingerprint that can’t be turned back into the original) of your email address, your shipping address and your household, and for campaign pre-orders Stripe’s card fingerprint (a code that identifies the card without revealing its number). We use them only to prevent fraud and check deliveries: to recognise repeat “never arrived” claims and duplicate pre-orders. A match is checked by a person; a possible duplicate pre-order isn’t counted toward the goal until then. If you tell us an order never arrived, we also record the claim and its outcome.

Exchanges (“Send yours back”). If a tapper chooses to send you their details, we store what they submit: their name and any phone number, email, social handle and short message they enter. Only you, the band owner, can see it.

Notes. If you have Larp2Alt Plus, any private notes you write about a connection. Only you can see them.

Orders. Your name, email, shipping address and what you bought, so we can ship your band and handle returns.

Pre-orders. For a pre-order we also store the date it must ship by, whether it has shipped, and any cancellation, delay notice (when we sent it and the new date) or refund, so we can keep the promises in our Terms.

Campaign pre-orders (launch campaign). When you pre-order a band during the launch campaign, Stripe saves your card so we can charge it later only if the campaign reaches its goal. Your card details are handled by Stripe and never stored by us: we only keep Stripe’s reference IDs for your customer record and saved payment method, Stripe’s card fingerprint (see Fraud prevention above), plus your name, email, shipping address, what you pre-ordered, the amount we’d charge, the market and currency, the ship-by date, the pre-order’s status (pending, charged, charge failed, cancelled or released) and the version of our Terms you agreed to and when you ticked the box. We use these only to run the campaign: to count pre-orders (as a number, never showing who), charge funded pre-orders, ship, handle cancellations and refunds, and email you about your pre-order.

Your shipping address in the bag. For a campaign pre-order you type your shipping address in the bag (Stripe only saves the card at that step). It’s sent to us with the order and, so you don’t have to retype it, kept in your own browser’s storage on that device until the order goes through or you press “Forget this address”. It never leaves your device except with your order.

Waitlist. If you join a waitlist (to hear when we ship to your country, when we ship to the US through “Interested in the US?”, or when pre-orders open), we store your email address, the country you signed up for, what you asked to hear about, and when. You give us express consent by submitting the form, which says what we’ll send. We use it only for that one message.

Colour suggestions. If you use “Recommend a colour”, we store the colour you typed, your country (from your connection, when available) and when. If you add your email (optional), you consent to one email from us when that colour launches, and we use it for nothing else. Suggestions are only seen by us.

Site analytics. We use Vercel Web Analytics, which is cookieless: it counts page views, the page you came from, your country and device type in aggregate, and doesn’t store your IP address or identify you across sites or visits. We also keep daily totals of how many checkouts are started in each market (a number per day, with no personal information attached) to see whether pre-order demand is enough to make a production run.

Payments. Card payments, saved cards and subscriptions are handled by Stripe. We never see or store your full card number, expiry date or security code. We keep your Stripe customer ID, billing currency and subscription status so we know whether you have Plus.

Page setup is included with a band. Right after you pre-order, the confirmation page lets you give us a display name and the contacts you want on your page (for example an Instagram handle or a phone number), and which side each goes on. It’s optional.

• What we store: that name, those contacts and their sides, linked to your order. Only the browser you ordered from can change them, for an hour after you order.
• Why: only to build your page when you claim your band, so you don’t have to type it again.
• Who sees it: nobody, until you claim the band signed in with the same email as the order. Then they become your page, and people who tap your band see only what you put on that side. If someone else claims the band with a different email, nothing is applied and they see none of it. If your account already has links when you claim, we don’t change your page.
• When we delete it: as soon as it’s applied to your page, if the order is cancelled or refunded or the campaign doesn’t reach its goal, 60 days after your band ships if it’s never claimed, and in any case after 180 days (2 days if the checkout was never completed). After it’s applied, it’s part of your profile: change or delete it anytime from your dashboard.

We use a small number of cookies, all needed for the site to work. No advertising, analytics or cross-site tracking cookies.

• Sign-in cookies keep you logged in to your dashboard.
• A tap cookie stops the same browser from being counted as a new tap more than once every 30 minutes.
• A checkout cookie lets only the browser that started a checkout see that order’s confirmation page.
• A shipping-country cookie remembers which country’s prices you picked (when we sell in more than one), so prices show in the right currency.
• Browser storage for your bag keeps what’s in your bag and, for a campaign pre-order, the shipping address you typed, on your device only, until you check out or clear it.
• Rate-limit cookies stop the “Send yours back”, waitlist and colour suggestion forms from being spammed.

• To show your profile to people who tap your band.
• To show you your taps and the people who sent their details back (your “People I Met” log).
• To process orders, ship bands, and manage Plus subscriptions.
• To keep the service secure and prevent abuse, including confirming that shipped bands were delivered.
• To answer you when you contact us.
• To understand, in aggregate, how many people visit and start a checkout.

About your order or account. Order and pre-order confirmations, Plus subscription confirmations, the campaign result (the heads-up before we charge, or not funded and never charged), pay-now links when a charge fails, shipping updates, delay notices, cancellations, refunds, sign-in links and important account notices. These are part of the service, so they go out whether or not you’ve subscribed to anything.

Everything else, only with your consent. We send waitlist (including “Interested in the US?”) and colour-launch emails only to people who asked for them, in line with Canada’s anti-spam law (CASL). Every one says it’s from Larp2Alt, gives our contact details and has an unsubscribe link or lets you reply “unsubscribe”. We act on unsubscribes within 10 business days (usually much sooner). Buying a band or making an account doesn’t sign you up for marketing.

We share data only with the providers that run the service for us, and only what they need. This is the full list:

• Supabase (Canada): database, file storage and sign-in.
• Stripe (US and other countries): payments, saved cards for campaign pre-orders, card fingerprints for fraud checks, subscriptions and the billing portal.
• Resend (US): sends our emails: sign-in links and codes, and order and pre-order emails such as your copy of the agreement (your email address and, for order emails, your name, shipping address and what you ordered).
• Vercel, our hosting provider (US): serving the website, cookieless site analytics, and approximate location for taps.
• Cloudflare Turnstile (US): a bot check on the sign-in page.
• Shipping carriers (Canada Post, or a courier for tracked parcels): your name and address, to deliver your order.

We may also disclose information if the law requires it. We never sell your personal information.

Our database and file storage are in Canada (Supabase, Montréal, ca-central-1). Some of your data is stored or processed outside Canada: Stripe, Resend, Vercel and Cloudflare may process it in other countries, including the United States, where it can be subject to local law (for example, access by courts or government agencies there). We choose providers that protect it with safeguards comparable to Canadian standards.

We keep your profile, links, taps and exchanges for as long as your account exists. Taps are kept even on the free plan so that upgrading to Plus can show your full history. You can delete your account yourself from your account page (Account → Delete account) or by emailing us. When you do, your profile, photo, links, taps, exchanges and notes are deleted, your photo stops being viewable, and any Plus subscription is cancelled so you’re not charged again.

We keep order and payment records (including pre-order ship-by dates, cancellations and refunds), the serial numbers of the bands in each order, their activation records and any lost-order claims for 6 years after the end of the tax year they relate to, as Canadian tax law requires, and to handle payment disputes. Deleting your account removes the link between an activation record and your account.

Campaign pre-orders. If the campaign isn’t funded, or you cancel, or we cancel, we detach (delete) your saved card from our Stripe account when the pre-order is released, so it can never be charged. A funded pre-order becomes a normal order and is kept like other order records (above); the saved card is used only for that one charge (or a retry you agree to). The pre-order record itself (no card details) is kept for 2 years after release so we can answer questions or disputes about it, then deleted, unless tax law requires the order record to be kept longer.

Waitlist emails are deleted once we’ve emailed you that we ship to your country, when you unsubscribe, or after 24 months, whichever comes first. Colour suggestion emails are deleted after the launch email, when you ask, or after 24 months. The colour suggestion itself (without the email) may be kept as an anonymous count. Aggregate analytics and daily checkout counts contain no personal information.

• Change or remove anything on your Larp or Alt side at any time from your dashboard. Changes are instant.
• Disable a lost band from your dashboard so it stops showing your profile.
• Plus members can export their connections to CSV. Anyone can ask us for a copy of their data.
• Cancel Plus anytime from the billing portal in your account settings.
• Ask us to correct or delete your data, including if you sent your details to someone through “Send yours back” and want them removed. Email support@larp2alt.com.
• Unsubscribe from a waitlist or colour-launch email at any time with the link in the email, by replying “unsubscribe”, or by writing to support@larp2alt.com.
• Under PIPEDA you can access your personal information, ask us to correct it, and withdraw consent (for example by deleting your account). We answer requests within 30 days. If you’re not happy with our answer, you can complain to the Office of the Privacy Commissioner of Canada.

Your chips hold only a short web link, never your personal information. Data is encrypted in transit, access to other people’s data is blocked at the database level, and band activation PINs are stored hashed. No system is perfectly secure, so please only share what you’re comfortable making public on your profile.

Larp2Alt isn’t intended for children under 13, and we don’t knowingly collect their data.

If we change this policy in a meaningful way, we’ll update the date above and let account holders know. Our privacy contact is the Larp2Alt founder, reachable at support@larp2alt.com. See also our Terms (seller details are in Who you’re buying from).