Privacy

QueueKat is operated by Ascent Software Design, LLC. It holds places in line for people so they do not have to stand in one. That requires knowing who is waiting and how to reach them when their turn comes, and nothing beyond that.

This notice says what we hold, who else sees it, and how long it lasts. It describes what the software does today rather than what we intend it to do later.

Who sees what

A queue has three sides and they see different things.

• You, if you are an attendee, see your own place, your own arrival window, and your own pass.
• The organizer — the event's own staff — runs the door. They see the people in their queue, including your email address.
• Us, the operator of the software. We run the servers the queue lives on.

The middle one has the consequence most people do not expect, so it goes first.

What the organizer sees

When you take a place in an organizer's queue, that organizer can see your email address, along with your position, your arrival window, when you were summoned, whether you answered, and whether you came through the door.

That is not a leak. Staff at the door need to know who is in front of them. But it means joining a queue discloses your email address to the people running that event, and you should decide to join knowing that rather than discover it afterwards.

What the organizer does not see:

• Your password, which we cannot see either — it is stored as a bcrypt hash.
• Your sign-in links or session tokens.
• Your activity in any other organizer's events. One organizer's staff see one organizer's queues.
• Your notification addresses. If you have given us a phone number, a Telegram chat id or a Discord user id, those are yours and the organizer is not shown them. The organizer can tell that you were reached and when; they are not told where.

Organizers are independent of us. What they do with an address we showed them is their conduct, not ours, and the terms of use says what we require of them.

What we collect

• An email address. It identifies the account, it is where sign-in links go, and it is the destination we can always fall back to when something must reach you. It is never sold and never shared for marketing.
• A password, if you set one. Stored as a bcrypt hash. Sign-in by emailed link works without one.
• Notification addresses you add yourself — a phone number, a Telegram chat id, a Discord user id. Each is optional, each is added by you, and each can be removed.
• Your places in queues: which event, which window, when you booked or joined, when you were summoned, whether you entered.
• The history of those places — see below, because it is kept longer than people expect.
• Your organization memberships, if you are staff somewhere.
• Ordinary server logs, kept briefly for operating the site and diagnosing failures.

We do not ask for your legal name, your address, your date of birth, or a payment method.

Where your messages go

A summons is useless if it does not arrive, so QueueKat can reach you on more than one channel. Each channel other than email means handing your address to the company that operates it. The current list, accurate as of this notice's effective date:

Email is the only one you cannot avoid, because the account itself is an email address. Every other row is a channel you switch on yourself, and switching it off stops us sending to it.

We use no advertising network, no analytics vendor, and no third-party identity provider. There is no "log in with" button here, and that is deliberate: it would put a fourth company between you and your place in line.

The door scanner and your camera

Staff admit people by scanning the pass on an attendee's phone. That uses the staff member's camera, so here is exactly how far the pictures travel:

They do not travel. The camera frames are decoded in the browser and never leave the device. No image is uploaded, stored, or sent to us. What reaches the server is the decoded text of the pass and nothing else — the same string you would get by typing it in.

The camera runs only while the scanner page is open and the camera is started, and stopping it releases the device.

Your pass is not stored

A pass is proof that it is your turn. We do not keep the token itself. It is derived on demand from the pass's id and a random nonce, signed with a secret the database does not contain, so reading the passes table yields nothing that opens a door.

The practical effect for you: your pass is re-derived every time you load the page, and a copy of our database would not open any door.

The history we keep, and why

Two records are append-only and outlive the visit they describe:

• Scans — every admission through a door: which visit, which event, which staff member scanned it, whether it was after the deadline.
• Visit transitions — every change of state in a queue place, with the reason and, where a person caused it, who.

This is deliberate, and it is not analytics. A queue decides things about people — who was summoned, who was removed, who was let in late — and those decisions need a record behind them, so that a question about one can be answered with more than somebody's recollection.

It also means a record that you were in a particular queue persists after that queue is over. Leaving an event removes your place; the record that you held one remains.

How long things are kept

• Your account lasts until you ask us to close it.
• Queue history — visits, transitions, scans — persists with the event it belongs to, for the reasons above.
• Sign-in tokens expire on their own: a sign-in link within minutes, a session within days, and all of them the moment you log out.
• Notification intents and attempts keep what was owed to you and what was tried, including failures. They are the history of our own delivery, and they contain the address an attempt was made to.
• Logs are short-lived.

Getting your data out, and getting rid of it

There is no self-service button for either yet. Rather than describe one that does not exist, here is what does.

Write to [email protected] and ask for a copy of your data, or ask for your account to be closed, and you will get a written answer and the thing you asked for. Closing an account deletes the account, its notification addresses and its sign-in tokens. Queue history that names you is anonymized rather than deleted, for the reason given above: the record of what a door did has to outlast the account of the person it admitted or turned away.

When the self-service versions exist, this section will change to describe them, and that change comes with a version bump you are told about.

Cookies

A session cookie to keep you signed in, and an optional "remember me" cookie if you ask for one. That is all. No advertising trackers, no third-party analytics.

Your colour theme is stored in your own browser and never sent to us.

Security

• Passwords are hashed with bcrypt; we never hold the plaintext.
• Sign-in tokens are stored hashed, so a database read does not yield a working one.
• Pass tokens are not stored at all.
• Organization invitations are stored as a hash of the token, and they expire.
• The site is served over HTTPS and sets a Content-Security-Policy that forbids third-party script entirely.

No security measure is a guarantee. This is what we do.

Children

The minimum age is stated once, in the terms of use, and it depends on where you are rather than being a single number.

What belongs here is what happens to the data: if we learn an account belongs to someone younger than the rule allows, it is closed and its data removed.

Governing law

This notice is governed by the law of the Commonwealth of Virginia and the applicable federal law of the United States.

Changes

This notice carries a version written as major.minor. A material change bumps the major and comes with a summary of what changed; a reword or a correction bumps the minor. Changes that affect what happens to data you have already given us are notified rather than posted quietly.

Because this is a notice of what we do rather than terms you agree to, a change here never asks you to accept anything again.

Contact

Privacy questions, copies of your data, and deletion requests go to [email protected], and get a written answer.