Privacy Policy

Film Exchange (“we,” “us”) is operated by Film Parlour LLC, 418 Broadway, STE N, Albany, NY 12207. It runs a marketplace where people resell tickets to specialty film screenings. This policy covers the Film Exchange web app and any companion apps we release.

Film Exchange is a United States–only service for film screenings and festivals across the US. It isn't directed at residents of other countries. If we expand beyond the US, we'll update this policy first.

• Account basics: your email address, display name, and password (stored only as a secure hash by our auth provider).
• Optional profile details: a Letterboxd URL if you add one, an avatar, and the contact methods (for example a phone number or messaging handle) you choose to share with matched buyers or sellers.
• Ticket files: when you upload a ticket to sell, the uploaded file (and any barcode we read from it) is stored in a private storage bucket. It isn't publicly accessible. Access is limited to the seller, the matched buyer, and authorized Film Exchange staff, through links that expire after 60 seconds.
• Transaction and payment metadata: listings, requests, prices, dispute records, and payment status from Trustap. We never receive your card number. Card details go directly to Trustap.
• Messages: the chat messages, reactions, and attachments you send other members, kept with the exchange record.
• Device and log data: IP address, browser type, server request logs, error reports, and a device push token if you allow notifications in the app.
• Cookies: only what's needed to keep you logged in (auth session cookies) and remember your theme. No advertising or cross-site tracking cookies.

We use your information to:

• run the marketplace: match listings and requests, coordinate protected payments through Trustap, deliver tickets, and resolve disputes,
• send the email the service needs, such as request updates, reminders, and account verification,
• read ticket details when you upload a ticket: our own software reads the barcode so we can store the ticket for delivery, and we may send other ticket text to an AI service to help check listing details. Sellers remain responsible for their listing's accuracy,
• enforce the price cap and prevent fraud and bot activity,
• fix bugs and monitor how the service is performing, and
• meet legal obligations that apply to ticket resale marketplaces.

We don't sell your personal information, we don't share it with advertisers, and we don't use it to train AI models.

These types of companies process data on our behalf. Each receives only the data it needs for the service it provides:

We also disclose information when the law requires it (for example, a valid subpoena or court order) or to protect members from fraud or harm.

Buyers and sellers need some of each other's details to complete a purchase. We show the details you choose to share to the other member only after a request is accepted, and we don't show them to anyone else.

For a direct payment, once a request is accepted, we show the buyer the seller's payment handles (Venmo, PayPal, or Zelle) as links and a QR code, along with any other contact methods either member chose to share. You pick which payment handles and contact methods to share in Settings. Buyers and sellers agree to use each other's details only to complete the purchase.

The optional film festival ticket organizer isn't available yet, and cloud transfer is turned off. When it's available, you will choose individual Seat Atlas tickets, wanted screenings and seat ratings, and whether to include personal statuses and contact notes. Ticket numbers accompany selected tickets for private matching. The extension shows your destination account and selected data before you approve an upload to Film Exchange. A signed request binds that approval to your account, extension and website tab. Film Exchange then shows a second review before saving records to your organizer.

Approved data passes through our hosting provider and database. We encrypt staged payloads, ticket numbers and private notes using server-managed keys. Our servers manage the encryption keys and can decrypt these fields for authorized requests. Account access controls also protect ticket and showtime details, statuses, wants and ratings. The extension receives your account identifier and display name for the handoff; it does not store a Film Exchange login token.

The organizer doesn't extract Wallet links. Use the festival's official digital-ticket page for Wallet access. Our servers do not log in to festival ticketing sites, collect their credentials or cookies, scrape ticket QR codes, or generate replacement passes. Wallet links are excluded from all organizer downloads, including private backups.

Connecting does not upload automatically, scan festival ticketing sites, publish marketplace listings, delete local records, or synchronize cloud edits back to the extension. Organizer edits require a connection. Ordinary exports omit ticket numbers and private notes; the extension's separately labeled private backup includes them and local matching identity material. Downloaded files are unencrypted, and even ordinary exports can reveal attendance and seat locations. Manage those files separately from your local and cloud records.

Disconnecting stops the extension connection and clears its transient transfer buffers; it does not delete data already staged or saved in Film Exchange. Archiving keeps a record and its private details. Deleting an organizer record removes its private details and displayed content from active organizer storage and cancels pending imports that could restore deleted data. Minimal identifiers, keyed matching references, deletion markers and receipts remain to prevent duplicate recovery or silent reimport. A receipt can confirm a completed import without restoring its deleted content.

An upload has a 24-hour staging deadline. Reconnecting before that deadline does not extend it. A review lasts at most 30 minutes and never beyond the upload deadline; expired data cannot be consumed or newly committed. Restarting an expired import clears its old staged payload and requires a fresh upload and review. Successful imports clear staged payloads and preview content while retaining minimal recovery receipts. Scheduled cleanup removes expired payloads, so removal can happen some time after they expire.

Account deletion blocks organizer access immediately. Organizer records and receipts are scheduled for deletion 30 days after account deletion. A deleted account can't be recovered during that period. Infrastructure backups may retain earlier copies under provider policies; we do not promise a specific provider backup deletion deadline. A backup restore must reapply deletion records before organizer access resumes.

Deleting your account in Settings disables account access, pauses active listings, closes wanted posts and removes registered device push tokens. You must first resolve outstanding purchases, sales, payments and disputes. Logging back in does not reactivate a deleted account.

This action does not automatically erase or anonymize your account details, authentication records, transaction and dispute history, payment audit records or uploaded ticket files. Automated account and ticket-data deletion is not currently available. Contact us about a data deletion request; records needed for unresolved transactions, disputes, fraud prevention or legal obligations may need to be retained. We do not promise a fixed deletion deadline for these records or provider backups.

Ticket files and their admission credentials, including barcodes and pass identifiers, remain stored after a transaction. We retain custody and payment records to prevent duplicate sales and support disputes. Once a buyer downloads a ticket, saves it to Apple Wallet, or receives it by email, we can't recall or erase their copy.

We maintain reasonable administrative, technical, and physical safeguards suited to the size of the service, as state data-security laws (such as New York's SHIELD Act) require. Ticket files are stored privately and open only through links that expire after 60 seconds, data is encrypted in transit and at rest, card numbers go directly to Trustap and don't pass through our servers, access to production systems is limited, and payment-status changes are recorded in an audit log. No online service is completely secure, so we also limit what we collect.

If a security breach affects your private information, we will notify you in the most expedient time possible and without unreasonable delay, consistent with the needs of law enforcement, and we'll notify state authorities where the law requires it. We'll tell you what happened, what was involved, and what we're doing about it.

• Access and correction: your profile, listings, and requests are visible and editable in the app; for anything you can't reach, email us.
• Deletion: delete your account in Settings (section 6 explains what happens), or email us to ask.
• Email choices: transactional email (request updates, reminders) is part of the service. We don't send marketing email during the beta.
• Questions: support@filmexchange.app.

You must be 18 or older to use Film Exchange, and the service is not directed to anyone under 18. We don't knowingly collect information from minors. If we learn that we have, we'll delete it.

We may update this policy. We'll notify you of material changes before they take effect, and the “last updated” date at the top will change. For questions about this policy or your data, email support@filmexchange.app. Our Terms of Service cover the rest of your use of Film Exchange. Postal mail: Film Parlour LLC, 418 Broadway, STE N, Albany, NY 12207.