Who's responsible: this site belongs to PREPARE THE OTHERS, who decides what data is collected and why (the "data controller"). candycode builds and operates the platform the site runs on and processes data only on PREPARE THE OTHERS's behalf (the "data processor"). The vendors candycode relies on are listed under Subprocessors. What the site stores in your browser, and why, is under Cookies.

What we collect

Account. When you create an account you give us your email address, the only thing sign-in asks for. There is no password; sign-in works by emailing you a six-digit one-time code. We store your email, an identifier from our sign-in provider (WorkOS), and your membership tier. The sign-in provider's temporary tokens are discarded once your code is verified; staying signed in uses our own signed browser cookie (up to 90 days of activity).

Memberships and tickets. If you subscribe or buy a ticket, checkout happens on Stripe's own hosted pages. Your card number never touches this site. We store references to your Stripe customer and subscription, your tier, and which shows your account can access. PREPARE THE OTHERS is the merchant of record, and your payment details live in PREPARE THE OTHERS's own Stripe account under Stripe's privacy policy.

Store orders. If you buy from the store, checkout happens on Stripe's hosted pages, and the purchase is from PREPARE THE OTHERS, not candycode. We store your order: what you bought, your name, email address, and shipping address, and a reference to the payment. PREPARE THE OTHERS receives your name, email, and shipping address to fulfill the order, and any refund is theirs to give. A download link is made for you, and is for you alone.

Live shows. For ticketed or member-gated shows, the first time your account unlocks a show we record one attendance fact: which show, which account, and when it first unlocked. Free public shows record no per-person data at all, only anonymous viewer counts. Long-term, per-show statistics are aggregates (peak concurrent viewers, total minutes viewed), not per-person records.

Live chat. Sending chat messages requires your account, so messages carry your member identity in the room. Live chat messages are not stored: they exist only in the memory of the live room while it runs (including a short recent-messages buffer for late joiners) and are gone when the room closes. Moderation actions taken against an account (timeouts, bans, message deletions) are logged. If chat replay alongside show recordings is ever introduced, this policy will be revised first.

Contact form. If you send an inquiry, what you submit (your name, email, and message) is routed to PREPARE THE OTHERS's configured inbox so they can respond. Inquiries may also be kept as records in PREPARE THE OTHERS's audience tools.

Technical. Like every website, the servers that host this site see your IP address, browser user agent, and requested pages in standard request logs (held by our hosting providers under their retention policies). The site sets a small number of strictly necessary first-party cookies, described under Cookies. PREPARE THE OTHERS may also add measurement tools from Google or Meta and, if they sell through Shopify, may turn on Shopify's analytics. These load only with your consent, as described under Consent.

Cookies

This site sets a small number of first-party cookies, all of them strictly necessary or functional. The measurement tools PREPARE THE OTHERS chooses set their own cookies, and none of them loads until you've consented where consent is asked first. This section lists the entire cookie surface, and it changes only when the site's code does.

Cookies this site sets

__Host-candycode-member-session, for up to 90 days of activity. Keeps you signed in. A signed, httpOnly session cookie scoped to this site only, so a session from one artist's site is meaningless on another's. Set only when you sign in.

Signed-in members who unlock a ticketed or member-gated show may also receive a short-lived, signed entitlement cookie that proves your access to that show's stream. Like the session cookie, it's strictly necessary: it exists only to let you watch what you've unlocked.

If PREPARE THE OTHERS sells through Shopify, adding something to your cart sets Shopify's own cart cookies on this site, such as cart and _shopify_essential. They're strictly necessary: they hold your cart and carry it to Shopify's checkout.

Measurement tools

PREPARE THE OTHERS may add Google Analytics, Google Ads, Google Tag Manager, or Meta Pixel to this site and, if they sell through Shopify, may turn on Shopify's analytics. These measure visits and sales, set their own cookies, and send what they measure to Google, Meta, or Shopify under Google's, Meta's, or Shopify's privacy policy. The cookie banner names the ones this site uses.

What happens on other domains

When you buy a membership or ticket, checkout happens on Stripe's hosted pages on Stripe's own domain. Cookies set there are Stripe's, governed by Stripe's cookie policy. None of them are set on this site.

In the European Economic Area, the United Kingdom, and Switzerland, and wherever the site can't tell where you are, the measurement tools load only after you choose Accept on the cookie banner. Elsewhere they load unless you decline or your browser sends Global Privacy Control. Cookie choices, in the footer, reopens the banner so you can change your answer at any time.

Your choice is kept in your browser's local storage for 180 days, then asked again. Strictly necessary cookies don't wait for a choice, since the site can't sign you in or hold your cart without them.

Do Not Track and Global Privacy Control

If your browser sends a Global Privacy Control signal, the measurement tools stay off unless you choose Accept under Cookie choices, wherever you are. The site doesn't read Do Not Track, which browsers have retired in favor of Global Privacy Control.

Managing cookies

You can clear or block cookies in your browser settings. Blocking the session cookie means you can't stay signed in.

What we deliberately don't do

No cross-artist profile. Your email is one sign-in identity across candycode-hosted sites, but your activity on each artist's site is a separate record. No platform layer joins your activity across artists for marketing, modeling, or anything else. This is enforced in how the data is structured, not just promised.
No sale of personal information by candycode, and no data brokers. Advertising tags appear only when PREPARE THE OTHERS adds them, and load only as described under Consent.
No card numbers. Payment happens on Stripe's hosted pages.
No stored chat transcripts, as described above.

How your information is used

To run the site: sign you in, remember your session, deliver the content and shows your tier or ticket unlocks, process payments and refunds through Stripe, fulfill your orders, run and moderate the live chat, respond to your inquiries, and keep the platform secure (rate limiting, abuse prevention, audit records of privileged actions).

Who it's shared with

PREPARE THE OTHERS. It's their audience: they see their own members' emails, tiers, purchases, attendance, and inquiries, and the name, email, and shipping address on each store order. They don't see other artists' data, and other artists don't see theirs.
Service providers (subprocessors). The hosting, identity, payment, email, and delivery vendors listed under Subprocessors, each processing only what its role requires.
Legal. If required by law, or to protect the rights, safety, and security of the site, its members, or the platform.

Subprocessors

candycode operates this site as a data processor on behalf of PREPARE THE OTHERS (see above). The vendors below process data as part of running the platform. This list is kept current: adding a vendor updates this section before the vendor goes live, and tenants in the EU receive 30 days' advance notice.

Active

Vercel (USA). Web hosting and content delivery for this site and the platform's editing tools. Processes request traffic: IP addresses, browser user agents, request logs.
WorkOS (USA). Sign-in identity: issues and emails the six-digit sign-in codes, holds sign-in identities. Processes email addresses and sign-in events.
Cloudflare (USA/global). Content delivery, live video streaming, live chat infrastructure, object storage. Processes viewer IP addresses at the network edge and aggregate viewing analytics (90-day retention); chat messages pass through memory only and are never stored.
DigitalOcean (USA). Cloud infrastructure hosting candycode-managed servers: the platform database and private media storage. Processes account records (emails, tiers), show and attendance records, and artist content.
Vultr (USA). Cloud infrastructure hosting candycode-managed servers: the platform database and private media storage. Processes account records (emails, tiers), show and attendance records, and artist content.
Printful (USA), when you buy a printed item from the store. Prints and ships it, and processes the order's name, shipping address, email and phone to do so.
Sentry (USA). Error monitoring for the platform's servers. Processes error reports with the page address, browser user agent and a request id. Email addresses are removed before sending, and no IP address or cookie is sent.

Announced but not yet active

These vendors are named now so their activation is never a surprise; each begins processing only when its feature goes live.

Stripe (USA), with memberships and tickets. Will process payment details (held by Stripe on PREPARE THE OTHERS's own Stripe account; card numbers never touch this site) and subscription and purchase records.
Resend (USA), with the contact form and artist email. Will process inquiry contents in transit (name, email, message).
Cloudflare Email Service (USA), with transactional email. Will process email contents and addresses in transit.

Not used

No advertising networks or analytics of candycode's own, and no data brokers. No AI vendors currently process any data on this site.

The artist's tools

These aren't candycode's subprocessors. PREPARE THE OTHERS chooses them, and each receives only what its tag measures, under its own privacy policy, as described under Measurement tools.

Shopify (Canada), when PREPARE THE OTHERS sells through Shopify. Holds the store's cart and checkout, and measures visits and sales when PREPARE THE OTHERS turns on Shopify's analytics.
Google (USA), when PREPARE THE OTHERS adds Google Analytics, Google Ads, or Google Tag Manager. Measures visits and ad results.
Meta (USA), when PREPARE THE OTHERS adds Meta Pixel. Measures visits and ad results.

Retention

Your account record is kept while your account exists. Internal provenance logs record that privileged actions happened but never contain your message contents, and sign-up records never log the submission body. Aggregate show statistics are kept as the permanent record of a show; upstream per-viewer streaming analytics expire after 90 days at our video provider. Chat messages are not retained at all.

Your rights and choices

You can ask to access, correct, export, or delete the personal information this site holds about you. Write to . PREPARE THE OTHERS is the controller of this site's data and candycode assists in fulfilling requests. You'll get a response within one month. Depending on where you live (for example the EU/UK under GDPR, or California under the CCPA), these rights are backed by law; we honor them for everyone regardless. Deleting your account removes your sign-in and membership record; payment records may be retained by Stripe and PREPARE THE OTHERS as required for accounting and legal obligations.

Children

This site is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has created an account, contact and it will be removed.

Security

Sessions use signed, httpOnly cookies; all traffic is encrypted in transit; each artist's data is isolated per tenant at the database layer; privileged staff access is allowlisted and every privileged action is recorded in an append-only audit log.

International transfers

The site is operated from the United States and data is processed by the US-based providers listed under Subprocessors. If you use the site from outside the US, your information is transferred to and processed in the US.

Changes

The "last updated" date at the top reflects the current version. Material changes, including any change to the chat-retention or cookie statements above, will be posted here before they take effect.

Contact

Privacy questions or requests: .

This policy explains what personal information this site collects, why, and what happens to it. It's written to match what the site actually does; nothing here is boilerplate.