Privacy Policy

Mint Up! is a community-first platform for discovering, creating, and operating local events. This policy explains the personal data we collect across those features.

Contact us about this policy or to request access, correction, export, or deletion at the address below. The service is not directed to children under 13, and we do not knowingly collect their personal data.

You can sign in with Google, which provides the basic profile Google shares through OAuth: your name, verified email address, and optional profile image. We do not request Gmail, Calendar, Drive, contacts, or other private Google data when you sign in. You may also sign in with a one-time code sent to your email address; codes are stored hashed and expire shortly after they are issued.

Some live activities can be used without signing in, through a temporary anonymous session. If you later create an account, activity recorded under that guest session may be linked to it. Authentication sessions record the IP address, browser user agent, and timestamps for security, fraud prevention, and signed-in behavior.

If you organize events using a meeting provider such as Zoom or Google Meet, we store the connection and the access credentials needed to create, update, and refresh the meetings you request. For Google Meet we also read the conference and participant data needed to confirm attendance (see Section 11). Signing in with Google alone never grants Meet access; you connect it explicitly from an event, and authentication alone never records marketing consent.

Your public profile includes the name and optional image from your sign-in provider, plus anything you add: a handle (which becomes your canonical public address), bio, and declared social links. It is public by design.

Your Mint Up Passport is public by default and presents your participation, XP, levels, and badges. You may hide certain recognition, but some community leaderboards show participating users by identity when you have a positive seasonal score.

If you link an on-chain identity by proving control of a wallet, we store the address and verification time as a private account relationship. It is not shown publicly and is never used to sign in.

For events you create on Mint Up!, we store the content you author: title, schedule and timezone, attendance mode, venue or virtual location (addresses are geocoded to place them on a map), description, images, gallery photos, co-organizers, hosts, administrators, roles, and series.

When you build a registration form, we store its questions and configuration. Responses belong to your event and are visible to you as its organizer. Ask only for information you need; do not request passwords, financial details, or other highly sensitive data.

For events imported from external sources, we display content and organizer or host information taken from public source pages and structured metadata. We do not access private content on those platforms.

To register for or attend an event, we associate your account with that event, the selected ticket type, any approval request or waitlist entry, your issued ticket, and check-in. If an organizer invites you by email, we store the recipient address and any personal message.

Registration forms may ask for details such as your name, email, phone number, social handles, or free-text answers. What you submit is shared with the event organizer.

For paid events, checkout and settlement run on the Stellar network in the denomination shown. We store the order, the payment attempt and its status, the settlement asset, and the associated on-chain addresses and transaction references. We do not collect card numbers or bank details; payment happens on-chain under your control. Organizers configure a payout account by proving control of a Stellar address.

We also store event cancellation and announcement records, including the confirming administrator and aggregate delivery results. Organizers do not see recipient email addresses.

For communities you own or manage, we store the public profile you author, such as name, slug, description, purpose, links, images, geographic scope, and topics, together with your team membership and role. Public titles and Core Team presentation are shown publicly.

Following a community links your account to it and records your marketing preference for its new-event notices. A community team may see your public identity as a follower, while your delivery preferences and consent evidence remain private.

We also store community collaboration invitations, contributor-prepared quests and campaigns, and community blasts sent to eligible followers.

We record your participation in Mint Up! events: check-ins and attendance evidence, contributions and responsibilities that an organizer confirms, and the resulting XP, levels, badges, and passport and community recognition. Some of this is public by default, as described above.

Community quests and campaigns store the submissions and evidence you provide (images, links, or text), quiz attempts and scores, completions, and any Minti Ticket credits. Minti Ticket balances are private. Physical rewards are collected in person against a claim code; we do not collect shipping addresses.

Live activities store quiz answers, scores, and participant names. Guests may play under an anonymous session. To count the audience currently connected, we use a per-browser token kept in your browser's local storage; it records a heartbeat and is independent of attendance, registration, and results. Event raffles store the eligible pool snapshot and winners.

If you activate the Weekly Market Agenda, we record your verified recipient address, confirmed Market Area, purpose, disclosure and privacy versions, interface locale, activation origin, and timestamp. Authentication alone never records Agenda Email Consent. The agenda is a complete, non-personalized weekly snapshot for the Market Area you explicitly confirm; choosing or activating it does not use your IP address, cookies, browsing history, or a default market.

Public event information comes from organizer-provided pages and structured metadata intended for discovery. You can unsubscribe from one Market Area or every agenda from Account, and the unsubscribe control in each message stops that message's Market Area.

We send transactional email needed to provide the service you requested, such as registration confirmations, attendee invitations, event announcements from organizers, and event cancellation notices. These are authorized by your registration or invitation and are sent to your verified account address. A hard bounce or complaint suppresses all email to that address, transactional and promotional.

We send promotional email only with your explicit consent: the Weekly Market Agenda, notices when a followed community publishes a new event, and community blasts. Consent is purpose-specific, recorded with its disclosure and privacy versions, and can be withdrawn per scope or entirely.

Our emails contain no open pixel. We may record a single binary Agenda Return when a delivered agenda leads back to an Event Page, without storing which event caused it. Organizers and communities see only aggregate delivery, omission, and failure counts.

We rely on service providers that process data only to operate Mint Up!: Google for sign-in and map or place lookups, Resend for email delivery, Zoom and Google Meet for meetings you request, YouTube and Vimeo for embedded broadcast content, Stellar for payments and on-chain identities, and our hosting and database providers. We also disclose data when the law requires it.

We do not sell or rent personal data, or share it with third parties for their own commercial use.

Mint Up! uses Google for account sign-in, map and place lookups, and the virtual meetings you choose to connect. This section describes the Google user data we access and how we handle it.

Sign-in. When you sign in with Google, we access the basic profile Google shares through OAuth: your name, verified email address, and optional profile image. We do not request Gmail, Calendar, Drive, contacts, or other private Google data, and we never receive your Google password.

Maps and places. We send the addresses and place queries you enter, such as an event venue, to Google Maps and Places to resolve the location and coordinates shown on the event.

Google Meet. When an organizer explicitly connects Google Meet, we access the Google Meet REST API with the meetings.space.created permission to create the meeting space for that event and read its details, limited to meeting spaces Mint Up creates for the organizer's events. For events that use Google Meet, we also read conference records, participants, and participant sessions, including each signed-in participant's Google account identifier, display name, and join and leave times, to reconcile attendance for that event; the participant's Google account identifier is compared with the registered attendee's linked Google account to confirm who attended. We store the Meet space identifier and connection reference on the event; OAuth access and refresh tokens stay in a private, server-side account store and are never exposed to attendees or copied into public event data.

How we use it. We use Google user data only to provide the features you request: signing you in, showing the location you entered, creating and refreshing the meetings you ask for, and confirming which registrants joined. We do not use it for advertising, profiling, credit, lending, or any purpose unrelated to these features, and we do not use Google Workspace APIs to develop, improve, or train generalized, non-personalized artificial intelligence or machine learning models.

Sharing. We do not sell, rent, or share Google user data with third parties for their own purposes, and we do not transfer it to data brokers or information resellers. It is processed by Google as the API provider and by our hosting and database providers acting only on our instructions, and we disclose it only when the law requires it.

Protection. Google user data is transmitted over encrypted HTTPS connections and stored in our managed database, which encrypts data at rest. OAuth tokens are kept server-side, excluded from public event projections and application logs, and reachable only by the backend operations that need them. Access to production data is limited to authorized personnel on a least-privilege basis.

Retention and deletion. Meet space bindings and attendance observations are kept only as long as needed to operate the event and its attendance report, then deleted or de-identified under our retention schedule. Disconnecting Google Meet clears the stored tokens and Meet authorization while keeping your sign-in identity, and you can revoke access at any time from your Google Account. You may also request deletion of your Google user data using the contact below; we process deletion requests within 30 days.

Limited Use. Mint Up!'s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not allow humans to read Google user data unless you have agreed to it, it is necessary for security or abuse investigation, it is required by law, or it is part of the feature you requested.

We keep current consent evidence only for operational, safety, and legal needs. Operational records are minimized and removed or de-identified under the applicable retention schedule. We protect data with technical and organizational safeguards: traffic is encrypted in transit with HTTPS, our managed database encrypts data at rest, OAuth credentials and other secrets are stored server-side and never exposed to the browser, one-time email codes are stored hashed, and access to production systems and data is limited to authorized personnel on a least-privilege basis. We use Google OAuth and one-time email codes rather than storing your Google password.

You may ask to access, correct, export, or delete your personal data. We process deletion requests within 30 days. Some records, such as consent evidence or data we must retain by law, may be kept when needed to demonstrate and honor your choices.

We may update this policy as the service changes. The version and date shown above identify the disclosure currently in effect.