Privacy policy.
Last updated October 13, 2026. Applies to blossomfest.org and the Blossom web app.
We keep as little as we can, we never sell it, and the public ledger never carries your name.
What we collect
- Account: your email address, the name you choose to show, and an encrypted backup of your account's signing key. The backup is locked with your password; we cannot open it, and we cannot reset the password.
- Tickets, votes, listings and trades: written to the Blossom ledger against your account identifier (a long code), never your name or email. Other fans see ticket numbers and the display name you chose, if any.
- Payments: card, Apple Pay and Google Pay payments are handled by Stripe. We receive a confirmation and the last four digits at most; we never see or store full card numbers. Crypto payments are made to a deposit address created for your order; the network records that transfer publicly, as every blockchain does.
- Payouts: if you sell a ticket and ask to be paid by PayPal, Venmo or Zelle, we keep the handle you give us until the payout is done.
- Messages: what you send through the contact or artist forms, with your email, so we can reply.
- Site analytics: which pages are viewed, when, the referring site, screen size and device type. We use a random identifier stored in your browser, not a cookie, and no third-party analytics unless the page says so. Known bots are filtered out.
- Server logs: IP addresses and request details, kept briefly for security and abuse prevention.
Why
To issue and hold your tickets, count your votes, run the market and pay sellers, scan you in at the gate, answer your messages, keep the site working and honest, and send you the emails below. The legal basis, where one is required, is performing our agreement with you and our legitimate interest in running the event safely.
We send emails about your account and tickets (receipts, open ballots, results, sales, gate information). We also send occasional updates about the festival; every one of those carries an unsubscribe link, and unsubscribing never affects ticket or ballot emails.
Cookies
Two small cookies keep you signed in; they are essential and expire after ninety days or when you lock the app. There are no advertising cookies and no tracking pixels.
Who else sees it
- Stripe for card payments, under its own privacy policy.
- Our email provider to deliver the emails above.
- The blockchain we anchor to receives only a fingerprint (hash) of the ledger, never personal data.
- Authorities if the law requires it, and we will say so unless we are forbidden to.
We do not sell personal data and we do not share it with advertisers.
How long
Account and ticket records stay while the event is upcoming and for the period needed for tax and accounting afterwards. Ledger entries are permanent by design but contain no name or email. Analytics are kept for fourteen months. Messages are kept until answered and for a reasonable time afterwards.
Your choices
- See, correct or delete your account data: write to the contact address below from the email on your account. Deleting an account that still holds a ticket requires transferring or refunding the ticket first.
- Unsubscribe from updates: the link in any update email.
- Export: ask and we will send what we hold about you in a readable file.
Residents of California, the EU, the UK and other places with privacy laws have additional rights to access, correct, delete and port their data and to object to processing; write to us and we will honour them.
Age
You must be 18 or older to create an account or buy a ticket. Age rules for attending will be published with the venue.
Security
Connections are encrypted, passwords never leave your device in the clear, backups are encrypted with your password, and every fan action on the ledger is signed. No system is perfect; if something goes wrong we will tell affected people promptly.
Changes and contact
If this policy changes in a way that matters we will email account holders. Questions: the contact page. The data controller is RecursivMusik.