Privacy Policy

XCLUB LIMITED, a company incorporated in Hong Kong, decides how and why your personal data is used on this platform. In data-protection language, we are the controller. You can reach us about anything on this page at hello@xclub.events.

When you join a line: the night you joined, and an identifier for your device or your account. We use it to hold your place and to stop one person filling a line ten times. Without it a line cannot exist. We also look up which country your request came from, using its network address (IP); we keep the country and not the address.

When you leave a contact for a night: your name, one way to reach you (email, LINE, Instagram, WhatsApp or push) and the language you asked to be written to in. We use it to tell you when a date is confirmed. The organizer of that night sees your name and that contact so they can message you about the night. Nobody else does, unless you also choose to appear on the public list of who is coming. You give this to us on purpose and you can take it back at any time.

When you buy a ticket: your name and contact details, and the ticket itself. Payment is handled by Stripe on Stripe's own pages; we never see your card number. We use this to give you the ticket and to let the organizer check you in at the door.

When you organize a night or run a venue: your business details, the nights and dates you publish, and payout details held by Stripe. We use them to run the tools you are using.

When you sign the beta agreement: your name, email address, the time you signed, and the version of the agreement you signed. We keep it as proof that the agreement exists.

Measurement, only if you say yes: our own analytics, PostHog on its European cloud, counts which pages and steps work. Advertising, only if you say yes to that separately: X-Club's own Meta (Facebook / Instagram) pixel is told that a page was viewed, that someone joined a line, or that a ticket was bought and for how much, so our ads reach people like the ones who came; and on a night whose organizer connected their own ad account, that organizer's Meta, TikTok or Google tag is told that the page was viewed, that someone joined, or that a ticket was bought and for how much. We send those tags no name or email, but the ad company sees your device and network address. Say no and none of it loads. We do not sell data.

When you scan an X-Club sticker and choose to share where you are: a rough area of about 150 metres, which sticker it was, and when. We use it to check that the sticker is still where we put it. We do not store who you are with it, and saying no changes nothing else.

When you ask for access from outside Japan: your name, your email, the reason you wrote and the country your connection came from. We use them only to decide on your request and to answer you, and we keep the request so that we can.

Organizers see the people in their own line who left a contact: the name and the contact handle each person gave (see section 2). After you buy a ticket, the organizer of that night also sees your name on their door list, because that is what a door list is.

Venues see counts, and the dates they themselves offered. Artists see nothing about you at all.

The companies that run parts of the service on our behalf: Google (Firebase — hosting, database, file storage, sign-in and server functions; reCAPTCHA Enterprise, which checks that requests come from our real app; the Google Maps frame on event pages; Gmail for some account emails), Stripe (card payments), KOMOJU (konbini payments), Resend (sending email), DocuSign (signed agreements), IPinfo (turning a network address into a country), the OpenStreetMap Foundation (the map tiles on the venue map; your browser fetches them directly, so it sees your network address), PostHog on its European cloud (analytics, only if you say yes), and, for the Operator chat and organizer translation, Google (Gemini), through our own server. What you type into the Operator chat, or what an organizer asks us to translate, goes from your browser to our own server, which sends the text to Google's model and passes the answer back; your browser never contacts Google's model directly. We keep Operator chat conversations in our database so the conversation can continue and be handed to a person; text sent for translation is not stored by us, apart from what the organizer then saves on the event. Our event database (NocoDB) runs on our own server. Meta, TikTok and Google receive what the Advertising part of section 2 describes, only if you say yes to Advertising.

Otherwise: nobody. We do not sell, rent or trade personal data, and we have never done so.

You can ask for a copy of what we hold, ask us to correct it, ask us to delete it, take back a consent you gave, or ask for your data in a form you can take elsewhere. Write to hello@xclub.events and we will answer.

Taking back a consent stops future use; it does not undo what was already done while the consent stood. Deleting your account does not delete a ticket record we are legally required to keep.

If you think we have got this wrong, tell us first — but you are entitled to complain to a regulator instead.

Line entries: until the night is over, and then for a short period so an organizer can see what happened. Contact details: until you take them back. Ticket and payment records: the minimum period the law requires. Signed agreements: for as long as they could still matter.

This service is for adults. Individual nights set their own age rule at the door, and that rule is the organizer's and the venue's to enforce.

Staff accounts open with a fingerprint or face check rather than a password. Links we send to one person are cryptographically signed and expire. Every change to data is checked on our servers, never only in your browser.

If a breach affects you, we will tell you, and we will tell the regulator, as the law requires.

The full list, including what needs your permission and what does not, is on the Cookie Policy page. The short version: this site sets two cookies of its own, both necessary, and everything else it remembers lives on your device and never leaves it unless you are signed in.

We publish changes on this page with a new version and date. If a change means we would use your data for something new, we ask you first.

What we ask: whether you are joining as a guy or a girl, with "prefer not to say" as an equal answer. Why: some nights are balanced — tickets are sold in two categories so the room stays mixed, and the category is checked at the door. That is the only use.

It is optional. Choosing "prefer not to say", or not answering, means you cannot join a balanced night; every other night is open to you. The answer is kept on your device and, if you are signed in, in your profile, until you change it in Me or ask us to delete it.