Privacy Policy
Last updated 2026-07-03
Privacy Policy
This policy explains what personal information this site collects, why, and what happens to it. It's written to match what the site actually does; nothing here is boilerplate.
Who's responsible: this site belongs to PREPARE THE OTHERS, who decides what data is collected and why (the "data controller"). candycode builds and operates the platform the site runs on and processes data only on PREPARE THE OTHERS's behalf (the "data processor"). The vendors candycode relies on are listed at /subprocessors.
What we collect
Account. When you create an account you give us your email address, the only thing sign-in asks for. There is no password; sign-in works by emailing you a six-digit one-time code. We store your email, an identifier from our sign-in provider (WorkOS), and your membership tier. The sign-in provider's temporary tokens are discarded once your code is verified; staying signed in uses our own signed browser cookie (up to 90 days of activity).
Memberships and tickets. If you subscribe or buy a ticket, checkout happens on Stripe's own hosted pages. Your card number never touches this site. We store references to your Stripe customer and subscription, your tier, and which shows your account can access. PREPARE THE OTHERS is the merchant of record, and your payment details live in PREPARE THE OTHERS's own Stripe account under Stripe's privacy policy.
Live shows. For ticketed or member-gated shows, the first time your account unlocks a show we record one attendance fact: which show, which account, and when it first unlocked. Free public shows record no per-person data at all, only anonymous viewer counts. Long-term, per-show statistics are aggregates (peak concurrent viewers, total minutes viewed), not per-person records.
Live chat. Sending chat messages requires your account, so messages carry your member identity in the room. Live chat messages are not stored: they exist only in the memory of the live room while it runs (including a short recent-messages buffer for late joiners) and are gone when the room closes. Moderation actions taken against an account (timeouts, bans, message deletions) are logged. If chat replay alongside show recordings is ever introduced, this policy will be revised first.
Contact form. If you send an inquiry, what you submit (your name, email, and message) is routed to PREPARE THE OTHERS's configured inbox so they can respond. Inquiries may also be kept as records in PREPARE THE OTHERS's audience tools.
Technical. Like every website, the servers that host this site see your IP address, browser user agent, and requested pages in standard request logs (held by our hosting providers under their retention policies). The site sets a small number of strictly necessary first-party cookies, described in the Cookie Policy. There are no third-party trackers, no analytics scripts, and no advertising cookies on this site.
What we deliberately don't do
- No cross-artist profile. Your email is one sign-in identity across candycode-hosted sites, but your activity on each artist's site is a separate record. No platform layer joins your activity across artists for marketing, modeling, or anything else. This is enforced in how the data is structured, not just promised.
- No sale of personal information, no sharing for advertising, no ad networks, no data brokers.
- No card numbers. Payment happens on Stripe's hosted pages.
- No stored chat transcripts, as described above.
How your information is used
To run the site: sign you in, remember your session, deliver the content and shows your tier or ticket unlocks, process payments and refunds through Stripe, run and moderate the live chat, respond to your inquiries, and keep the platform secure (rate limiting, abuse prevention, audit records of privileged actions).
Who it's shared with
- PREPARE THE OTHERS. It's their audience: they see their own members' emails, tiers, purchases, attendance, and inquiries. They don't see other artists' data, and other artists don't see theirs.
- Service providers (subprocessors). The hosting, identity, payment, email, and delivery vendors listed at /subprocessors, each processing only what its role requires.
- Legal. If required by law, or to protect the rights, safety, and security of the site, its members, or the platform.
Retention
Your account record is kept while your account exists. Internal provenance logs record that privileged actions happened but never contain your message contents, and sign-up records never log the submission body. Aggregate show statistics are kept as the permanent record of a show; upstream per-viewer streaming analytics expire after 90 days at our video provider. Chat messages are not retained at all.
Your rights and choices
You can ask to access, correct, export, or delete the personal information this site holds about you. Write to legal+pto@candycode.com. PREPARE THE OTHERS is the controller of this site's data and candycode assists in fulfilling requests. You'll get a response within one month. Depending on where you live (for example the EU/UK under GDPR, or California under the CCPA), these rights are backed by law; we honor them for everyone regardless. Deleting your account removes your sign-in and membership record; payment records may be retained by Stripe and PREPARE THE OTHERS as required for accounting and legal obligations.
Children
This site is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has created an account, contact legal+pto@candycode.com and it will be removed.
Security
Sessions use signed, httpOnly cookies; all traffic is encrypted in transit; each artist's data is isolated per tenant at the database layer; privileged staff access is allowlisted and every privileged action is recorded in an append-only audit log.
International transfers
The site is operated from the United States and data is processed by the US-based providers listed at /subprocessors. If you use the site from outside the US, your information is transferred to and processed in the US.
Changes
The "last updated" date at the top reflects the current version. Material changes, including any change to the chat-retention or cookie statements above, will be posted here before they take effect.
Contact
Privacy questions or requests: legal+pto@candycode.com.