Exotic Expo Hub ("we", "us") is an online directory of animal and plant expos. This policy explains what information we collect when you use localhost:8000 (the "site"), why, and what you can do about it.
The short version
- You can browse every show without an account. We count page views in total, without cookies and without storing who you are.
- No advertising, no third-party analytics or tracking cookies, and we don't sell or rent your information to anyone.
- If you sign up, we keep your name, email address and the preferences you choose so we can run your account and send the emails you asked for.
- Payments are handled by Stripe. We never see or store your card number.
- You can ask us to show you, correct or delete what we hold about you at any time.
What we collect
When you just browse
Our server records standard request logs: your IP address, the page you asked for, the time and your browser's user-agent string. We use them to keep the site running and to stop abuse. The site is for visitors in the United States and Canada, so we look up the country of your IP address in a geolocation database stored on our own server. That lookup doesn't send your address anywhere.
We also keep simple daily totals so we know which pages are useful: how many times each page was viewed, which other websites linked visitors here (the site's name only, like facebook.com), how often our calendar and RSS feeds are fetched, and roughly how many different people visited that day. To count visitors without cookies, your IP address and browser name are mixed with a random value that changes every day and turned into a code that can't be reversed. That code is kept only in memory and thrown away at the end of the day. Only the totals are saved, so they can't be traced back to you.
Choosing a state or show type on the Shows page is kept in the page's web address, not on our server.
When you create an account
- Show-goers: your name, email address, password, home state, any other states and show types you pick, and how often you want show emails.
- Organizers: your name, email address and password, plus anything you add about your expo: its profile, logo, banner images, show dates and links, and any message you send when claiming an expo.
We store passwords only as a one-way hash, so nobody, including us, can read them.
When you sponsor an expo
Checkout happens on Stripe's own pages. Stripe collects your payment details. We receive and keep only what we need to run the sponsorship: a Stripe customer and subscription reference, the plan, its status and renewal date.
When you contact us
We keep what you write in the contact form (your name, email address, the reason, the expo it's about and your message), along with the page you sent it from and your IP address, which helps us block spam.
Information about expos
Show listings come from organizers' own public websites, calendars and announcements, and from organizers who manage their pages here. This is information about events, not about visitors. If a listing includes contact details for an organizer that you'd like removed, tell us.
How we use it
- To run the site and your account: signing you in, showing shows that match your preferences, and letting organizers manage their pages.
- To send emails you asked for or need: confirming your address, password resets, the show digests you choose, and notices about your expo or sponsorship.
- To answer your messages.
- To protect the site: blocking spam, limiting repeated sign-in attempts, and investigating misuse.
- To meet legal obligations, such as keeping payment records.
We don't use your information for advertising or build profiles about you.
Who we share it with
We share information only with the services that help us run the site, and only what each one needs:
- Amazon Web Services hosts our server, database and backups.
- SendGrid (Twilio) delivers our emails, so it receives your email address and the message.
- Stripe processes sponsorship payments under its own privacy policy.
- OpenFreeMap serves the map tiles. When you open a map, your browser loads tiles directly from it, so it sees your IP address, as any website you load content from does.
- Organizer websites: some expo logos and pictures load from the organizer's own website, which sees your IP address when they load.
We may also disclose information if the law requires it, to protect the rights or safety of our users or others, or as part of a sale or transfer of the site, in which case this policy continues to apply to it.
What's public: an organizer's expo profile, logo and show dates are published on the site. Show-goer accounts, email addresses and preferences are never shown to anyone else.
Cookies
We use two cookies, both needed for the site to work, and no tracking or advertising cookies:
- A sign-in cookie, set only when you sign in, which keeps you signed in for up to 30 days or until you sign out.
- A message cookie that carries a one-line notice (like "Show added.") to the next page and expires after a minute.
Emails
Show digests go only to addresses that have been confirmed, and only as often as you choose. Every digest has a one-click unsubscribe link, and you can change or stop them on your My shows page. Account emails, like password resets and sponsorship receipts, are sent when needed even if you've turned digests off.
How long we keep it
- Account information: for as long as you have an account. When you ask us to delete it, we remove it from the live site straight away.
- Sign-in sessions: until they expire after 30 days or you sign out.
- Contact messages: as long as we need them to deal with your request and keep a record of it, or until you ask us to delete them.
- Server logs: rotated automatically and usually overwritten within days.
- Backups: nightly copies of the database are kept for 14 days, so deleted information is gone from backups within about two weeks.
- Payment records: kept as long as tax and accounting rules require.
Your choices and rights
You can update your name, preferences and email settings yourself while signed in. You can also ask us to:
- tell you what information we hold about you and give you a copy,
- correct anything that's wrong,
- delete your account and the information connected to it.
Send these requests through the contact form using the account's email address. We'll reply within 30 days, and may ask you to confirm the request from that address first. We won't treat you differently for making one. Depending on where you live (for example California, or a Canadian province), you may have additional rights under local law, and we'll honor them.
Security
The site runs over HTTPS, passwords are hashed, sign-in attempts are rate-limited, and access to the server and database is restricted. No system is perfectly secure, but if we learn of a breach that affects your information, we'll tell you as the law requires.
Children
The site is meant for adults planning a trip to a show. It isn't directed at children under 13, and we don't knowingly collect information from them. If you think a child has signed up, let us know and we'll delete the account.
Changes to this policy
If we change this policy, we'll update the date at the top. If a change materially affects how we use information you've already given us, we'll email account holders before it takes effect.
Contact
Questions about this policy or your information: use the contact form and choose "Privacy or data request."