← Taquillita

Privacy Notice

Last updated: June 26, 2026

1. Who is responsible?

The party responsible for processing information associated with the mobile app Taquillita (the "App") is Oscar Reyes, an individual developer based in Querétaro, Mexico. Contact details appear at the end of this document.

2. What personal data does the App collect?

None by default. The App is designed to operate without collecting, storing, or transmitting personal data to the developer or any third party. Specifically:

• It does not require registration, an account, an email address, a phone number, or any other personal identifier.
• It does not collect location data.
• It does not collect advertising identifiers.
• It does not use analytics tools (Google Analytics, Firebase Analytics, etc.).
• It does not use ad networks or third-party trackers.
• By default it sends no information to any developer server. The single exception is Team mode (section 6), an optional feature that is off by default; if you turn it on, it syncs pseudonymous data identified only by anonymous identifiers.

3. Information you generate inside the App

For Taquillita to work, you generate certain information locally — for example:

• Names and configuration of the events you organize.
• Generated tickets (folio, QR code, and validation status).
• Records of when each ticket was sold or validated.

This information:

• Is stored exclusively in your device's internal storage, in a local database (SQLite).
• Does not leave your phone unless you turn on Team mode (section 6). If you do, the synced copy contains each ticket's folio, consecutive number, type/color, creation and validation dates, and status (used / unused) — no names of people or events.
• Is only accessible from your own device.
• Is wiped completely when you uninstall the App or clear its data from Android settings.

You decide what information you enter. If you capture data about third parties (e.g., customer names), you — as the event organizer — are responsible for that data under applicable law.

4. Device permissions and what they're used for

• Camera: used exclusively to scan ticket QR codes during validation at the event entrance. Camera frames are processed in real time on the device, are not stored, are not sent to any server, and are not shared with third parties. You can revoke this permission at any time from Android settings; if you do, validation will no longer be available.

5. Sharing tickets via WhatsApp or other apps

When you choose to send a ticket via WhatsApp or another app, Taquillita uses Android's standard "share" function. At that moment the ticket image is handed to the app you select, which applies its own terms and privacy policy. Taquillita does not control what those apps do with the shared information.

6. Team mode (optional feature)

Taquillita offers an optional feature called Team mode, meant for several phones to validate and sell the same event while staying up to date with each other. If you enable it, the App syncs a copy of your tickets through a server operated by the developer, with these properties:

• Opt-in, off by default: while you don't turn it on, nothing leaves your phone. You can turn it off whenever you want.
• The server is a messenger, not a judge: validation at the door is always local against the phone's own database. The server never decides who gets in; it only propagates redemptions between the phones of the same event as soon as possible. Without internet, each phone keeps validating on its own and they catch up when they reconnect.
• Anonymous identifiers: each phone uses a short device identifier (generated by the App, not a hardware identifier) and the event uses a random key (UUID). They are not linked to your name, email, or phone number.
• Synced contents: only each ticket's folio, consecutive number, type/color, creation and validation dates, and status (used / unused). It does not include names of people, events, or customer data.
• Server location: Helsinki, Finland, on Hetzner Online GmbH infrastructure. This is an international transfer to a country in the European Economic Area, subject to the General Data Protection Regulation (GDPR), an adequate level of protection.
• Encrypted connection: the transfer between the App and the server is over HTTPS (TLS).
• Retention: events with no activity for 90 days are deleted automatically from the server (the data on each phone is unaffected). You can turn Team mode off or leave the event at any time.
• Web report (optional): in Team mode, the App can open a web report of the event with sales and validation counts and times. That report never shows the folio (the ticket's secret code), only the visible number, so it cannot be used to forge tickets. The link is built from a derived value (a hash) of the event key —not the key in clear text—. It is served over HTTPS and not indexed.

7. Internet connection

The App is designed to work offline during normal operation (generating and validating tickets, viewing local reports). It only makes network requests: (a) when you share a ticket via WhatsApp or another app, where the network is used by the operating system; (b) when Team mode in section 6 is on, to sync with the server; and (c) when you open the web report described in section 6.

8. Transfers to third parties

The developer does not transfer, sell, rent, or share personal data with third parties for commercial purposes. Team mode (section 6) involves a technical transfer of pseudonymous data to the infrastructure provider (Hetzner Online GmbH, Germany/Finland), exclusively for storing the sync, and is not used for any other purpose.

9. Children and minors

The App is not specifically directed to minors and does not knowingly collect data from minors. Since no personal information is collected, there is no processing of minors' data tied to use of the App.

10. Security

The information you generate lives in your device's private storage, protected by Android's security model. Protecting your device (screen lock, password) is the user's responsibility. If you lose the device or factory-reset it, the local information is gone with it — unless you had Team mode on, in which case another phone in the same event keeps its copy and the network rebuilds itself on reconnect.

11. Your rights

Under Mexico's Federal Law for the Protection of Personal Data Held by Private Parties (LFPDPPP) and its regulations, you have the right to access, rectify, cancel, and oppose the processing of your personal data (ARCO rights), and to revoke consent. If you reside in the European Economic Area or another jurisdiction with data-protection laws (GDPR, UK GDPR, CCPA, etc.), you may have additional or equivalent rights.

For Taquillita, since ordinary information lives on your device, those rights are exercised directly from it:

• Access and rectification: from inside the App.
• Local cancellation / deletion: by clearing the App's data from Android settings, or uninstalling.
• Team mode: turn it off or leave the event from the App; synced data is deleted automatically after 90 days of inactivity, or you can write to the developer to delete it sooner. See also the data deletion page.
• Revoking the camera permission: from Android settings, at any time.

If you believe any processing infringes your rights, you can contact us, and Mexican users can also file a complaint with the National Institute of Transparency, Access to Information and Personal Data Protection (INAI).

12. Changes to this notice

If the App's privacy behavior changes in the future, this notice will be updated and the "Last updated" date will reflect it. The current version will always be at this same URL.

13. Contact

← Back to Taquillita