Version 1.5 · effective 2026-09-23

Privacy

PLUR Pass is run by MWF Group (Ontario, Canada). This page says what we collect, why, and what we never do. We follow Canada's PIPEDA and Quebec's Law 25 — the same rules apply everywhere in North America.

Who is responsible

MWF Group is responsible for your personal information. The person in charge of protecting it can be reached at privacy@plurpass.com.

What we collect

• Your e-mail address — to sign you in with a one-time code and to write to you when you ask us to.
• Your raver name, display name and home city — what your passport shows. Your home city is the one you type; we never read your device's location.
• Whether you confirmed you are 18 or older. We store only that yes/no — never your birth year.
• The sets, events, ratings, notes, tags, stamps and patches you log. Each log is yours to keep private, share with your crew, or make public — per log.
• The photos and videos you add to a set (up to 6 photos and 6 videos per set). They start private. You can share them with your crew. They become public only if you ask and an administrator approves. We strip location data from photos on your device before upload and refuse any file that still carries it. We keep a small thumbnail beside each photo. A public photo may be served from a cacheable address for up to a day after it becomes public.
• Your profile photo, if you add one. It is resized on your device and is public wherever your profile shows (your passport page, your crew, your logs). You can remove it at any time.
• Your crews: who you invite, who joined, and what you mark as "going".
• Your crew's night thread: the messages and pings you post to your crew around a night, your vote for the set of the night, and when each was sent. We keep them for 30 days, then delete them.
• Notifications, if you switch them on: your browser's push subscription — the address your browser gives us, two keys that lock our messages to that browser, and the browser's name and version — one per device. Switch notifications off in Settings and the subscription is deleted at once; a device that stops answering is deleted the next time we try it.
• Your reminder history: one line per night and reminder — the night, the kind (before doors or the morning after) and whether it was delivered. We keep it for 90 days, so the same reminder is never sent twice.
• Two small cookies: pp_in remembers that this browser is signed in, so public pages can show "Your passport" without reading your account — it goes when you sign out. pp_city remembers the city you last chose (or your home city) so What's on and the Feed open there — a city name only, nothing about you, kept one year. No advertising or analytics cookies.
• Pictures of nights, DJs and festivals come from the listing's own image servers (Ticketmaster, JamBase). Your browser loads them directly, without telling them which page you were on; like any picture on the web, their servers see the request. We never upload or copy those pictures.
• Your plans: the nights you mark as going, the sets you plan to catch, whether you have your ticket and its type — never the ticket itself: no order number, barcode or price — and a note if you add one. A plan is private unless you set it to your crew or to everyone. A plan you never stamp is deleted 30 days after the night.

Crews, sharing and public pages

• A crew sees the logs, photos and videos you set to crew or public, your "going" marks and the patches you earn. Anyone can see what you set to public, on your public passport page.
• A night thread opens for your crew 24 hours before a night one of you is going to and closes after it. Only members of that crew can read it. Messages and pings are not end-to-end encrypted: an administrator can read a message that was reported and hide it. Nothing automated ever posts in a thread — every message comes from a crew mate.
• Notifications are optional and off until you switch them on in Settings — one switch each for crew pings, crew messages and night reminders. A night reminder comes 3 hours before doors and at 10:00 the morning after a night you marked "going"; it names the night and the venue, nothing about other people. Every notification goes to your own devices only.
• The public feed (plurpass.com/feed) shows how many ravers are going to a night — a number, never names — and the logs, photos and videos ravers chose to make public. Your raver name appears next to a night only if you switch on Show my going on the public feed in Settings and set that plan to everyone. It is off until you do.
• You can follow other ravers, give Respect, block anyone (they disappear from your view and you from theirs) and report a log, photo, video, profile or crew message.
• Venues and DJs you add become public catalogue entries — their names, not yours. Events you add are shown to signed-in ravers as nights they can log too.
• Share cards (the Night Card, Rave Wrapped, patch cards, the "I'm going" card) are drawn on your own device. Nothing is uploaded unless you share the picture yourself.
• On the sign-in screen we can remember your e-mail address so you type less. That memory lives only on your device; clear it from the sign-in screen or your browser.

Moderation and administrators

A small number of administrators keep PLUR Pass safe. They sign in with two-factor authentication. They can see reports, hide a log or a crew message, remove a photo or video, clear a profile photo, and suspend or delete an account that breaks the Terms. When handling a report they can see the e-mail address of the account involved. They can also see which pings and reminders were sent to an account — the identifiers and whether each was delivered, never the content. Every administrator action is written to an audit log that cannot be edited, and we keep that log as the record of our decisions.

Promoters. Organisers can apply for a free promoter account to list their own nights. A promoter's organisation name and website are public — they appear on the nights they list. Promoters never see who is going, only how many, and they cannot message anyone.

What we never do

• Sell your data, or show ads.
• Track your live location.
• Store your IP address in our own logs — we keep a one-way hash for rate limiting only. Cloudflare, our host, keeps its own short-lived network logs.
• Send anything about you to the event listings we import from.
• Read your crew's messages for any reason other than a report or a moderation check.

Where it lives

Your account, logs, crew messages and photos are stored in Canada (Supabase, ca-central-1, and Cloudflare R2) and served from Cloudflare's network. Videos are processed and stored by Cloudflare Stream, whose servers are outside Canada; every playback link is signed and expires within an hour, and clips are limited to 60 seconds. Our e-mail is sent through Resend (United States). Notifications travel through your browser's push service — Apple, Google or Mozilla, depending on your browser — which receives an encrypted message it cannot read and your device's push address, nothing else about you. Event listings come from Ticketmaster's and JamBase's public data — we take their events and line-ups, we send them nothing about you. Our visitor counts come from Cloudflare Web Analytics, which uses no cookies and collects no personal data.

Your rights

You can see, fix or download everything you gave us, and you can ask us to delete your account from Settings. We delete within 30 days — your logs, photos, videos (including the copies at Cloudflare Stream), profile photo, plans, crew messages, push subscriptions and reminder history go with the account. For anything else write to privacy@plurpass.com. Quebec residents may also contact the Commission d'accès à l'information.

If you live in the United States

We give everyone the same rights, wherever you live: to see, correct, delete or take a copy of your data, and to opt out of anything we would never do to begin with — we do not sell or share your personal data for advertising, and we never will. Do Not Sell or Share: there is nothing to opt out of, because we do not sell or share it. Your data is stored on the same servers as everyone else's (see Where it lives). PLUR Pass is 18+ only — we do not knowingly collect any data from children. Questions go to privacy@plurpass.com.

Age

PLUR Pass is for people 18 and older. If you are younger, we cannot open an account for you yet.

Changes

When this page changes, we bump the version and the date at the top and list what changed in Changes below.

What changed in 1.5: this page used to say members would be told in the app before a change applied. That in-app notice has been removed; this Changes section is now how a change is announced. Version 1.4 was effective 2026-09-22.

What changed in 1.4: JamBase joins Ticketmaster as a source of event listings and line-ups; the two small cookies (pp_in, pp_city) and where night, DJ and festival pictures come from are now described. Version 1.3 was effective 2026-09-22.

What changed in 1.3: the free Promoter role — an organiser's organisation name and website are public once approved, on the nights they list; they never see who is going, only how many, and cannot message anyone. Version 1.2 was effective 2026-09-21.

What changed in 1.2: the crew night thread (messages, pings and the set-of-the-night vote — kept 30 days), push notifications and the two night reminders, the reminder history (kept 90 days), the "I'm going" share card, the browser push services, your plans (the sets you plan to catch, your ticket yes/no and type — never the ticket itself), the one-tap "I'm here" stamp, and the public feed's going count are now described. Version 1.1 was effective 2026-09-21.