Draft for review, not in force. Placeholders in [brackets] are still to be decided.
Privacy statement
SeatPlan HK encrypts your plans in your browser with keys only you hold. We store what we cannot read, and as little else as the service needs. Usage statistics are collected only if you allow them.
Version 2026-10-15. This statement is also our Personal Information Collection Statement under the Personal Data (Privacy) Ordinance (Cap. 486).
Who we are
SeatPlan HK at vsp.veni.hk, the hosted service of the open HK Venue Seats project, is run by [operator to be added] ("we"), the data user under the Personal Data (Privacy) Ordinance (Cap. 486). Contact, including our privacy officer: [contact to be added]. Its introduction page is at seatplan.veni.hk, covered by its own notice.
What we cannot see
Your plans, including their titles, venues, price categories, prices, targets and the names of people on seats, are encrypted in your browser before they are sent. So are the keys that open them. We never receive your passphrase, your secret key, your recovery key, or the unlocking key your passkey makes. Nobody at the service, and nobody who obtains our servers or backups, can read your plans.
What we store
| Data | Why | Kept |
|---|---|---|
| Account handle (a random code such as vsp-7QX4-M2PD) | To find your account | While the account exists |
| Encrypted plans, with their size, version and when they changed | The service itself | Until you delete them or the account |
| Encrypted copies of your account key, and values derived from your passphrase and recovery key that can check but not reveal them | To let you sign in and unlock | While the account exists |
| Your passkeys' public keys, and the day each was added and last used | To check passkey sign-ins | Until you remove the passkey or the account |
| The day the account was created and last used | To delete unused accounts (below) | While the account exists |
| Sign-in sessions (a scrambled copy of the session cookie) | To keep you signed in | 30 days at most |
| Your statistics choice: a random choice ID made in your browser, what you allowed, the version of this statement, and when. Never linked to your account. | To respect your choice, and to show that you made it | 25 months from the choice |
We do not ask for your name, email address, phone number or any social login.
Your browser
- One cookie, to keep you signed in; it is needed for the service to work.
- On a device you mark as your own, your account handle and secret key, so you only type your passphrase there. Passkeys are kept by your device or your Apple or Google account, not by us.
- The version number of each plan you have opened, so your browser can tell if the server ever serves an older copy.
- Your statistics choice, and, only if you allowed usage statistics, a random statistics ID. See cookies and browser storage.
Logs and abuse limits
- Our web server logs record requests without your IP address, and record requests to the service's API by type and result only. They are kept for 14 days.
- To limit repeated sign-in attempts, the server keeps a scrambled form of your IP address in memory for up to an hour. It is never written down.
Usage statistics and product research (only with your consent)
When you first visit, we ask. Until you choose, nothing is collected. "Reject" is as easy as "Accept", and the service works the same either way.
| If you allow | We collect | Purpose |
|---|---|---|
| Usage statistics | Which screens you open and which features you use (event names from a fixed list), error types, your device class (phone, tablet or desktop), light or dark mode, the campaign that brought you (if the link carried one), approximate time spent, and a random statistics ID made in your browser | To understand how the service is used and improve it |
| Product research (also) | When you save, export or share a plan: which venue, the number of price categories, a band for the number of seats priced (e.g. "200-499"), whether the plan has names, a customised seat list or an orchestra pit, and the link's lifetime | To decide which venues and features to build next |
Never collected, whatever you choose: plan titles, people's names, prices, targets, seat choices, your account handle, plan or share IDs, any key, anything you type, your IP address or precise location.
How. This page sends events to our own server, which checks every event and field against a fixed list, drops anything else, and passes the rest to Google Analytics 4 (Google LLC / Google Ireland Limited) through its Measurement Protocol. No Google script runs on the planner's pages, and Google does not receive your IP address, cookies or browser details from us. Google may process the data in the United States and elsewhere, under its own terms as our processor; Google signals, advertising features and data sharing for Google's own purposes are switched off. Google keeps the event data for 14 months; reports contain only totals.
Who receives it. Our staff who run the service, and Google as our service provider. We do not sell or share it for advertising, and do not use it for direct marketing.
Change your mind at any time: Statistics settings in the footer of every page. Withdrawing stops collection at once; data already sent stays in aggregated reports until Google deletes it. We ask again after 12 months, or when this statement changes.
Where
On a server we rent from DigitalOcean in Singapore. Nightly backups, encrypted again with a key kept off that server, are stored with DigitalOcean in [backup region to be confirmed] and kept for 14 days. Personal data is therefore transferred outside Hong Kong; it is encrypted, and we cannot read your plans. Usage statistics, if you allow them, are processed by Google, in the United States and elsewhere.
Deletion
- Deleting a plan or your account removes it from the server at once, and from backups within 14 days.
- Accounts not used for 12 months are deleted, with their plans. We have no way to warn you first, since we hold no contact details: export anything you want to keep.
Your rights
You can see and download everything we store about your account (Account → Download account data), export any plan in a readable form (Export on the plan list), change or delete it, and delete your account. You may also make a data access or correction request under the Ordinance to [contact to be added]. Because we cannot read your plans, we can only ever provide them in their encrypted form. Statistics are held under a random ID that we cannot link to you unless you give it to us: your statistics settings show the first characters of your choice ID, and we will delete the statistics for an ID you send us. If you are in the European Economic Area or the United Kingdom, you also have the rights the GDPR gives, including to object and to complain to your supervisory authority; our legal basis for statistics is your consent (Article 6(1)(a)), for the service itself the performance of our terms. In Hong Kong you may complain to the Privacy Commissioner for Personal Data.
Requests from authorities
See legal requests: we can only ever hand over what is listed above.
Changes
We date every version of this statement and announce changes on the site; a change to what statistics collect asks you again. Draft of 15 October 2026 (version 2026-10-15).
← Back to the planner · Cookies · Terms of use · Legal requests