Privacy notice

Who is responsible

Pine Time is operated by Online Community Credit Cooperative, Rm 404 Jose Miguel Bldg, Yandoc St., Baguio City (www.occc.ph). We are the personal information controller for the data described here. Contact us at [email protected].

What we collect

• Your account — email address and name. Your password is stored only as a one-way hash; we cannot read it.
• If you organize events — your club name, description, and a contact string you choose to publish.
• Your bookings — which events, how many seats, your ticket code, and whether you were checked in at the door.
• Payments — once paying through this website is switched on, amounts and a reference from our payment provider. We never receive or store your card details; they are entered on the provider’s own checkout page.
• Payment proofs (DIRECT events) — for events paid for outside the website, the organizer may ask you to upload a screenshot of your transfer. It may carry your name, mobile number, reference number and account details. The event’s organizer can see it. We delete the image 30 days after the event begins; the decision (approved or rejected) is kept as part of the booking record.
• Sign-in security — your IP address, so we can rate limit sign-in and signup attempts, password-reset requests and submissions, and verification-email resends.
• Email records — a record of each transactional email we send you, including the details it was built from.

Notes from organizers

An organizer of an event you hold a seat at can send a short note to everyone booked for that event. The note carries the organizer’s account email as the reply address, so attendees who reply reach them directly.

Follow notifications

If you follow a club, we email you when that club publishes an event. The email carries your address and the event’s details, and every one of these emails includes an unsubscribe link that works without signing in.

Who else receives it

We use the following service providers. Each receives only what it needs to do its job.

• Anthropic — when an organizer uses our writing assistant, the note they paste — whatever they have typed about their event — is sent to Anthropic’s API, which drafts the listing from it.
• OpenAI — published event titles, descriptions, categories and venue names, and what you type into the search box, are sent to OpenAI to compute the numeric representations that power search. Your account details are never sent.
• Postmark — sends our email, and therefore receives your email address, the message contents, and in some messages your name.
• Cloudflare — stores and serves uploaded event images. We strip location and camera metadata from every image before it is uploaded. A small number of images uploaded before 5 August 2026, when this feature was new, may still carry theirs; ask us and we will replace them.
• Xendit — paying through this website is not switched on yet. Once it is, Xendit will process online payments and will then receive your name, email address, and the amount.
• Sentry — receives technical error reports. We remove cookies, query strings, and request bodies before sending them.
• Railway — hosts the website and its database.

We do not sell your personal data, and we do not use it for advertising.

Cookies

One cookie, holding your sign-in session, which expires after seven days. It is not readable by scripts and is not sent to other sites. We run no analytics, advertising, or tracking scripts, so there is nothing optional to consent to.

How long we keep it

Your account and booking history are kept for as long as your account exists, because your tickets and receipts depend on them.

We should be straightforward about two things we currently keep longer than we need to: records of the emails we have sent you are kept indefinitely, and the IP and email addresses recorded for the rate limiting described above are not yet deleted on a schedule. We are working on both. In the meantime you can ask us to delete either, and we will.

Your rights

Under the Data Privacy Act of 2012 you may ask us to give you a copy of your data, correct it, delete or block it, object to how we use it, or transfer it elsewhere. Email [email protected] and we will act on it.

There is no self-service delete button yet — deletion requests are carried out by a person. That is a limitation we intend to fix, and until we do, the address above is the way to reach us.

If you are not satisfied with how we have handled your data, you can complain to the National Privacy Commission.

Changes

If we change this notice we will update the date at the top. We do not yet have a way to notify every registered user directly, so please check back from time to time.