Privacy across Tickgetr and the scan app

This notice covers the Tickgetr website, organiser dashboard and the Tickgetr mobile scanner for Android and iOS.

An event organiser decides which attendee details are needed for its event. For an event-specific question, the organiser may therefore be the best first contact. Tickgetr handles the platform, account, ticket and scanning data needed to provide the service.

The app signs in through Firebase Authentication with an anonymous app user identifier. The scanner API verifies that identity and derives a separate, opaque device binding for the scanner roster. Firebase may also process technical authentication, integrity and security information such as IP address, user agent and app identifier.

The event code is used only to request access. Only after organiser approval does the device receive a short-lived scanner session and a device- and event-bound offline package.

• For tickets assigned to this entrance lane: name, ticket type, ticket number, ticket count in the order, validity state and any first scan time.
• The online attendee view can temporarily show the same limited fields for the whole event; email, phone, price and raw QR remain absent there as well.
• Event, enrollment, session, epoch and manifest identifiers and their expiry boundaries to restrict access to the correct event and device.
• For a scan attempt: an opaque ticket reference, keyed QR hash, unique attempt ID, scan time and outcome.
• A Firebase App Check integrity token and technical connectivity and synchronisation state needed to admit only genuine app builds, fail closed and safely process pending offline scans.
• The scanner-v2 payload and offline cache contain no email address, phone number, price, order or payment identifier, or raw ticket QR.

• Authenticate a scanner and restrict it to its enrolled event.
• Show enough ticket information to verify the attendee at the entrance.
• Validate a ticket, record admission and warn about invalid or duplicate scans.
• Keep scanning available during a temporary connection loss and synchronise pending changes afterwards.
• Investigate support, reliability and security incidents.

An approved scanner keeps an AES-GCM-encrypted offline package in app storage. Its encryption key is held separately in the device's secure storage. The routing index contains no personal data; only tickets assigned to this device contain the display fields listed above.

A raw QR is used only briefly in memory to calculate a keyed hash locally. The app does not store or transmit the complete QR. Before showing a green offline result, it stores an encrypted pending attempt containing an opaque ticket reference and QR hash.

The manifest remains usable for at most twelve hours and never beyond the active scanner roster; temporary attendee data has a separate short TTL. After expiry, the app refuses offline green and removes expired manifest and attendee data. Pending scan attempts remain until server acknowledgement so an admission action is not silently lost.

Choosing End Session removes the session, enrollment binding and encrypted event cache from that device. Organisers should use managed, locked devices and end the session after entry closes.

Tickgetr uses Firebase Authentication and the infrastructure needed to host the website, API and event records. Firebase App Check uses Google Play Integrity on Android and Apple App Attest with DeviceCheck as a fallback on iOS to verify that a request comes from the genuine app. Google, Apple and Firebase may process technical app, device and integrity information for that purpose.

Other providers are used only when their feature is used, for example email support or payment handling on the website.

Event data is available to the organiser. An approved scanner device's offline package contains only operational ticket details for its assigned entrance lane; the event-wide attendee view is online-only and has a short retention period in the app. Do not share an enrolment code, scanner session or exported attendee list.

There is currently no single automatically enforced retention period for every server-side record. Retention follows the event and account lifecycle and the operational need to support tickets, scans, security and accounting. Records that must be kept for a documented obligation may not be removable immediately.

To request access, correction or deletion, email info@tickgetr.be with the subject Privacy request. Include only the email address, event name and order identifier needed to locate the record. Do not send passwords, active scanner codes or full QR codes. We may ask for proportionate verification before changing data.

This page is updated when the website, scanner app or its data flows materially change. Questions about this notice or an event data request can be sent to info@tickgetr.be.