Privacy Policy

Red Thread Events is operated by Garrett Makes It LLC, based in Daytona Beach, Florida (the company’s registered mailing address is in St. Petersburg, Florida). This Privacy Policy explains how we collect, use, and protect your personal information when you use our services at redthreadhub.net.

We collect the following categories of personal information:

• Account information: your name, email address, and password when you create an account.

• Profile information: display name, phone number, and avatar or profile photo you choose to upload.

• Event activity: event attendance records, gameplay data (trivia answers, scores, team memberships), queue and performance signups, and leaderboard standings.

• Communications: messages you send through our platform or to our support email.

• Payment information: billing details when you purchase services (processed securely by Stripe — see Section 4).

• Usage data: pages visited, features used, and general site-usage patterns collected via Google Analytics.

• Newsletter subscribers: your name and email address if you subscribe to a tenant’s newsletter.

• Inquiries and event requests: your name, email, phone number, and message when you submit a portfolio inquiry or a public event-request/planning form.

• Contract e-signatures: your typed legal name, a handwritten signature image, your IP address, and the signed contract terms when you sign a proposal or agreement.

• Push notification subscriptions: if you turn on browser notifications, the notification endpoint your browser mints and the encryption keys that go with it, so we can deliver a reminder to that browser. If you turn on notifications in the Red Thread iOS or Android app, the device token your phone issues for the app, so we can deliver a reminder to that phone.

• Acceptance records: which version of these Terms and this Policy you accepted, when you accepted it, and a one-way hash of the IP address and browser you accepted it from.

We use your personal information to:

• Create and manage your account.

• Enable event participation, scorekeeping, and leaderboards across trivia, karaoke, open mic, and game-night events.

• Display your name and stats on in-event displays and public leaderboards, where you have opted in to a public profile. Recap and promotional posts we draft for social media name teams, acts and bands, and name an individual attendee only if that person has a public profile; the draft text sent to our AI provider follows the same rule.

• Send transactional emails such as account confirmations and event notifications.

• Process payments and manage billing through Stripe.

• Analyze how our platform is used so we can improve it.

• Respond to support requests and communications.

We do not sell your personal information to third parties and do not use it for third-party advertising.

We use Google Analytics (Measurement ID: G-PQC9FRLBPL) to understand how visitors use this site. Google Analytics uses cookies — small text files stored in your browser — to collect anonymous usage data such as pages visited, session duration, and general geographic region.

We have implemented Google Analytics Consent Mode v2. Analytics cookies are not set until you explicitly accept them via our cookie consent banner. You may decline analytics at any time and the site will continue to function normally.

Accepting analytics cookies allows Google Analytics measurement only. We keep Google’s advertising signals (ad storage, ad user data and ad personalization) switched off whatever you choose, and we do not use Google Analytics data to build advertising audiences.

The web app also runs Vercel Web Analytics, which counts page views without setting a cookie or building a profile that follows you across other sites. It sits behind the same consent gate: until you accept analytics, it sends nothing at all.

If you accept analytics, we also record where your first visit came from — the campaign tags on the link you followed (utm_source, utm_medium, utm_campaign, utm_content, utm_term, gclid), the site that linked to you, and the page you landed on — and attach it to the signup, inquiry, event request, studio session request or operator application you later submit, so we can tell which marketing actually reaches people. Only that first visit is recorded, we never build a history of the pages you browse, and it is never changed afterwards. Query strings are stripped from the referring address and the landing page before either is stored. Until you answer the cookie banner, the campaign tags from your first visit are held only in that page’s memory, so they survive moving between our pages; nothing is written to your device and nothing is sent to us or to Google. If you accept, they are kept for the signup or request described above. If you decline, or your browser sends Global Privacy Control, they are discarded (or never captured) and none of it is stored at all.

Our two sites, redthreadhub.net and redthreadhq.net, are separate web addresses. If you accept analytics, links from one to the other carry the same campaign tags and a Google Analytics linker identifier, so a visit that crosses between them is counted as one visit from its original source rather than as a referral from the other site.

Some storage is strictly necessary for the site to work and is set without asking, because it is exempt from consent: the sign-in session cookie for signed-in staff (__Secure-rt_staff_session), the record of your cookie choice (rte_consent, in your browser’s local storage), queued actions saved on your device while you are offline so they can be sent when you reconnect (rte_queue_*), and the service worker caches that let the app load offline. None of these is used for analytics or advertising.

While you are signed in, we also report your account identifier to Google Analytics so that activity from the same account on different devices is counted once rather than as several people. It is an opaque identifier — never your name or email address — it is only sent if you accepted analytics, and it is cleared when you sign out.

For more information on how Google handles this data, see Google’s Privacy Policy at https://policies.google.com/privacy.

We honor the Global Privacy Control (GPC) browser signal (https://globalprivacycontrol.org). If your browser or a browser extension sends GPC, we treat it as a request to opt out of analytics cookies and do not show the cookie consent banner — the choice is applied automatically, the same as if you had rejected analytics cookies yourself.

Payments are processed by Stripe, Inc. (https://stripe.com). All payment card data is handled directly by Stripe. Red Thread Events does not store, process, or transmit your full payment card number. Stripe’s handling of payment data is governed by their Privacy Policy at https://stripe.com/privacy.

We share your data with the following service providers only to the extent necessary to operate our platform:

• Supabase — database hosting and authentication infrastructure.

• Resend — transactional email delivery.

• Railway — backend server hosting.

• Vercel — web application hosting and content delivery.

• Stripe — payment processing (see Section 4).

• Google Analytics — site usage analytics (see Section 3).

• Sentry — error monitoring and performance tracing for our web app and server, including error details, IP address, and the page or request URL where an error occurred.

• Anthropic — the underlying model provider for our AI features (AI-generated question suggestions, social caption drafting, ambience/playlist suggestions). Prompts built from your event and content data are sent to Anthropic to generate a response. Anthropic does not train its models on this data.

• Google (Gemini API) — AI image generation for social posts. When a host generates an image, the description they type and the event’s format and venue name are sent to Google’s Gemini API to draw it. No attendee or contact data is included.

• Spotify — music search and playback integration for event ambience and stage music features. If you connect a Spotify account, OAuth tokens are exchanged with Spotify to authorize search and playback on your behalf.

• upload-post.com / Ayrshare — outbound social-media publishing. When a host publishes event photos, video, or captions to connected social accounts, that content is sent to whichever of these providers is configured for the tenant to post it on the host’s behalf.

• GitHub — in-app bug/feature feedback you submit is filed as a GitHub issue in our issue tracker, including your description, the page URL, your browser user agent, recent console logs, and your display name or email.

• Twilio — SMS/OTP delivery for phone-based sign-in and account recovery. Your phone number and message content are sent to Twilio to deliver SMS messages.

• Cloudflare Turnstile — bot protection for public signup forms. Your IP address and a challenge token are sent to Cloudflare to verify you are not a bot during public onboarding.

• NetWorthy — monthly business revenue reporting to the operator’s own NetWorthy account, and only if an owner connects one. What is sent is a period total: how much the business collected in a calendar month, the number of transactions behind it, and which revenue stream it came from. No client names, invoice details, event details, or individual payments are sent.

• Apps you connect (MuscleBuddy, AdventureOS, NetWorthy) — only when you connect one yourself, from that app, and approve it on RedThread’s consent screen. An app you connect receives what you approved and nothing else: with “Your profile”, your display name and avatar (never your email or phone number); with “Post to your feed”, it can add cards to your RedThread feed, and RedThread stores those cards for you. You can disconnect an app at any time from Settings → Connected apps, which stops it at once; cards it already posted stay yours.

• Vercel Web Analytics — privacy-focused page-view analytics for the web app. The analytics script runs only after you accept analytics cookies; when it runs, your IP address, user agent, the page you are on and the page you came from are sent to Vercel, which aggregates them without setting a cookie or building a cross-site profile.

• Google, Apple and Mozilla push services — delivery of browser push notifications you have opted in to (event reminders and host alerts). Your browser mints a push endpoint at whichever service its vendor operates — Google for Chrome, Apple for Safari, Mozilla for Firefox — and we send the notification title, body and link to that endpoint. The message is encrypted to keys held by your browser, so the push service relays it without being able to read it.

• Apple Push Notification service and Google Firebase Cloud Messaging — delivery of notifications to the Red Thread iOS and Android apps, once you turn notifications on in the app. We store the device token your phone issues and send the notification title, body and in-app link to Apple (iPhone and iPad) or Google (Android) for delivery. Unlike browser push, the platform can read the notification text it delivers; it receives no other account data.

• Google (Sign in with Google) — identity verification when you choose to sign in with Google. Your browser is redirected to Google, which learns that you are signing in to this service and returns your name, email address and profile picture to us. We never receive your Google password.

• Apple (Sign in with Apple) — identity verification when you choose to sign in with Apple. Your browser is redirected to Apple, which learns that you are signing in to this service and returns your name and email address — or Apple’s private relay address, if you choose to hide your real one. We never receive your Apple password.

• Facebook (Sign in with Facebook) — identity verification when you choose to sign in with Facebook. Your browser is redirected to Facebook, which learns that you are signing in to this service and returns your name, email address and profile picture to us. We never receive your Facebook password.

AI features: features that generate or suggest content (question suggestions, social captions, ambience/playlist suggestions) are powered by Anthropic. We send the minimum data needed to build the prompt for that feature; Anthropic does not train its models on data sent through our account.

How long we keep your personal information depends on what it is and why we hold it. The periods below are the ones our automated retention sweeps enforce:

• Attendee & host accounts — Active for the life of the account. On a deletion request, PII is anonymized immediately (name/email/phone/avatar nulled or replaced with "Deleted user", account deactivated). An annual sweep re-asserts anonymization on accounts deleted more than the retention window prior, catching any field that slipped through initial anonymization. Non-PII event/score history is retained indefinitely in anonymized form for leaderboard and analytics integrity.

• Staff & contractor HR data — Retained for four years from each record’s own date — the longest federal recordkeeping floor that applies (26 CFR 31.6001-1, employment tax records), against FLSA’s three years for payroll and one year for applicant records, with no longer Florida requirement. A weekly sweep then nulls the free-text and document fields (time-off reasons, certification documents and notes, pay notes); pay amounts are preserved as financial records under their own seven-year window. An unhired applicant’s name, email, phone, resume, and notes are scrubbed by the same sweep after one year; a hired applicant’s record is scrubbed instead when the resulting account is deleted.

• Financial & billing records — Financial records are retained for 7 years (the IRS-recommended recordkeeping period for business income/expense records), enforced by a weekly purge job.

• Newsletter subscribers — A confirmed subscriber is retained until they unsubscribe or the tenant removes them. An unsubscribed address is kept as a suppression record so a re-submitted signup cannot silently re-add someone who opted out (Art. 21(3)) — the name is nulled but the email address is not. A signup that never confirmed is deleted after 30 days.

• Portfolio inquiries, event requests & studio bookings — Retained for as long as needed to respond to and, where booked, service the event or studio session. A weekly sweep scrubs PII on unconverted inquiries/requests, and on cancelled/completed studio sessions and karaoke song requests, past a 2-year window. Erasable on request at any time via DELETE /api/event-requests/:id/requester, DELETE /api/studio-sessions/:id/requester and DELETE /api/karaoke/song-requests/:id.

• AI-assisted content features — Not retained by this app. Anthropic deletes prompt and response content within 30 days of the request under its published default retention policy, and longer only where it is required to keep it to investigate a policy violation.

• AI image generation for social posts — The generated image is kept as a social asset for as long as the host keeps it in the asset library, and removed when they delete it. The prompt is not retained by this app; Google handles Gemini API prompts under its published API terms.

• Site usage analytics — Governed by each analytics provider's own retention settings. The only visit data this app stores in its own database is the first-touch record described under Marketing attribution.

• Marketing attribution — Only the first visit is recorded, never a browsing history, and it is never updated afterwards. It lives on the signup or lead record it was captured with and is removed with it: the referring site and landing path are cleared by the same 2-year sweep that scrubs an unconverted inquiry or event request, leaving only the campaign name behind as an anonymous channel count.

• Outbound social media publishing — Retained for as long as the connected social account remains linked; the host can disconnect at any time.

• Event photography & likeness at live events — Retained indefinitely as promotional/marketing material unless an attendee requests removal.

• Proposal & contract e-signature — Retained indefinitely as a permanent business/legal record, the same norm applied to any signed contract — unlike raw PII, a signed agreement is a record you want to keep, not purge. The database enforces it: an agreement's versions, signatures and audit events cannot be deleted while the agreement exists (`onDelete: Restrict`), and voiding an agreement keeps them.

• Guest event reminders — Retained until the guest unsubscribes, or the reminder for the event they signed up for has been sent and the event has passed. A weekly sweep enforces both: it scrubs a guest profile once every reminder rule on it is disabled (unsubscribed, or never confirmed) past a 30-day grace window, or once every rule is bound to an event that has already happened.

• In-app and public product feedback — Retained for the life of the issue as part of the engineering record. Console output attached to a report is scrubbed on request.

• Cookie-consent and legal-acceptance records — Retained for as long as the account exists plus the limitation period for a dispute about what was agreed. On account deletion the identifying hashes are replaced, and the record of what was accepted is kept — erasing it would destroy the very evidence it exists to provide.

• Website and API delivery — Held in each provider’s own request logs under its retention policy; no request log is stored in this app’s database.

• Revenue reporting to a connected NetWorthy account — Held by the connected NetWorthy account under that account holder’s own retention settings; nothing extra is stored here.

• Notification delivery log — 180 days from send, after which the log row is purged.

• Business contacts & CRM — Retained for as long as the tenant keeps the vendor, contact, or partnership record. Erasable on request: Vendor via DELETE /api/portal/businesses/:businessId/vendors/:vendorId, CrmContact via DELETE /api/crm/contacts/:id.

• Apps a member connects — For the life of the link: disconnecting the app or deleting the account revokes it at once, and a refresh token left unused stops working 90 days after it was issued. Posted cards are kept for the life of the account; account deletion revokes every link and scrubs the cards.

You have the right to access, correct, or request deletion of your personal information at any time. To exercise these rights, email us at garrett@garrettmakesit.com with your request, and we will respond within 30 days — or use the self-service controls below, which act immediately.

You may also update your profile information and privacy settings directly within your account settings. From Account settings, "Download my data" exports a copy of your personal information immediately, and "Delete account" deletes or anonymizes it immediately, without waiting on a request to us. Account deletion removes your name and contact details and breaks the link to you; some content you authored (messages, comments and feedback you submitted) is kept without your name, and a post already published to a social network is outside our reach.

This service is not directed to or intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at garrett@garrettmakesit.com and we will promptly delete it.

Live events hosted by Red Thread Events may be photographed or recorded for promotional purposes. We rely on our legitimate interests (GDPR Art. 6(1)(f)) — promoting the events we host — as the legal basis for this processing, not your consent; attendance is not a consent mechanism. You have the right to object to this processing at any time under Art. 21.

If you do not wish to appear in such media, please notify the event host before or at the start of the event, or contact us afterward at garrett@garrettmakesit.com to request removal from future use. We will make reasonable efforts to accommodate such requests.

We use industry-standard technical and organizational measures, including encryption in transit, access controls, and hashed credentials, to protect your information. No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.

If you believe you have found a security vulnerability in the service, report it to garrett@garrettmakesit.com. Please include enough detail for us to reproduce the issue, and give us a reasonable opportunity to address it before disclosing it publicly. We will acknowledge your report and will not pursue legal action against good-faith research conducted in accordance with this policy. The same channel is published in machine-readable form at /.well-known/security.txt.

We publish a public demo of the service. Starting it signs you in to a pre-built account so you can look around without registering; the button you tap to start it is your acceptance of our Terms of Service and this Policy.

The demo account is SHARED. Every visitor is signed in to the same one, and there is no separate identity for you inside it. Anything you enter there is visible to the next visitor, and to us. Do not enter anything real about yourself or your business on the demo.

Because the demo account belongs to no one, we cannot tell one visitor’s entries from another’s. The self-service export and deletion controls described elsewhere in this Policy are switched off on the demo, and we cannot honour an individual access or deletion request for something typed there, because we have no way to identify which entries were yours.

What we do instead is reset the demo account wholesale by re-seeding it, which deletes every entry made on it since the last reset. If you have entered something on the demo that you want removed sooner, contact us at garrett@garrettmakesit.com and we will reset it.

The demo is not a place to keep anything. Creating your own account is the only way to have data that is yours, private to you, exportable, and deletable on request.

We may update this Privacy Policy from time to time. Material changes will be noted with an updated “Last updated” date at the top of this page. Continued use of the service after a policy change constitutes acceptance of the updated terms.

Red Thread Events (operated by Garrett Makes It LLC), Daytona Beach, FL — garrett@garrettmakesit.com.