Privacy Policy

Last updated: June 2026

1. Who We Are

SteamTicket is an independent digital study tool operated as a Canadian sole proprietorship by Nicolas Hesson. Our support email is support@steamticket.ca. Our business address is 8053 Sorensen Road, Kimberley, BC.

The person accountable for SteamTicket's privacy compliance is Nicolas Hesson, reachable at support@steamticket.ca.

This Privacy Policy explains how SteamTicket collects, uses, discloses, stores, and protects personal information when you visit our website, create an account, buy access, use the web app, sync study progress, or contact support.

2. Paddle's Separate Role

Payments are handled by Paddle, which acts as merchant of record and authorised reseller. Paddle collects and processes payment information under its own buyer terms and privacy policy. SteamTicket does not receive full card numbers. Paddle sends us limited order information, such as your name, email, country, purchased product, order or transaction ID, tax or currency information, and refund status, so we can provide access, support, and refund assistance.

3. Information We Collect

Account information. We collect your email address, account identifiers, hashed password information, login/session information, entitlement records, and related account settings.

Purchase information. We receive limited purchase and refund information from Paddle, including your name, email, country, purchased product, order or transaction identifiers, and purchase or refund status. We do not receive your full payment card number.

Study progress. We may collect or store quiz answers, scores, mock-exam results, progress, bookmarks, course completion status, timestamps, and related study activity. Some progress is stored in your browser's local storage. If you log in or sync, progress may also be stored on our servers.

Local storage and authentication. SteamTicket uses browser local storage for study progress and for authentication/session tokens that keep you logged in. We do not use tracking cookies. Clearing browser data may log you out and may remove locally stored progress that has not been synced.

Analytics. We use Plausible Analytics, a privacy-friendly, cookieless analytics service, to understand aggregate site usage — for example page views, referring sources, and which free study samples are started. Plausible does not set cookies, does not collect or store personal information, does not build advertising or cross-site profiles, and does not track you across other websites. Only aggregate, de-identified usage data is processed on our behalf.

Support and communications. If you contact us, we collect the information you provide, such as your name, email, message, attachments, and support history. Transactional email may be handled through Supabase.

Security and technical logs. We may collect IP address, device and browser information, event logs, error logs, and access logs for security, troubleshooting, fraud prevention, abuse prevention, and service reliability.

4. Why We Use Personal Information

We use personal information to create and manage accounts; authenticate users; provide purchased course access; verify entitlements; sync study progress; process support requests; help with refunds; send transactional messages; maintain security; prevent account sharing, abuse, fraud, scraping, and unauthorised access; improve the service; comply with legal, accounting, tax, consumer-protection, and record-keeping obligations; and enforce our Terms of Service.

We do not sell personal information. We do not send marketing email unless you give express consent where required.

5. Consent and Your Choices

We collect, use, and disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances and where we have consent or another legal basis. Your consent may be express, implied by your actions, or otherwise permitted by law, depending on the information and purpose.

You may withdraw consent, request deletion, or close your account by contacting support@steamticket.ca. In some cases, withdrawing consent or deleting information means we can no longer provide account access, synced progress, support, or proof of purchase. We may also need to keep some information where required or permitted by law, such as transaction, security, fraud-prevention, tax, accounting, or dispute records.

6. When We Disclose Personal Information

We disclose personal information only as reasonably needed for the purposes described in this Policy. This may include disclosure to Paddle for purchase and refund support; Supabase for database, authentication, hosting, and transactional email delivery; technical service providers that help operate or secure the service; professional advisers such as lawyers, accountants, or insurers; authorities, regulators, or courts where required or permitted by law; and a successor if SteamTicket is sold, transferred, reorganised, or merged, subject to appropriate protections.

Service providers must process personal information only for the services they provide to us and must use reasonable safeguards. Some providers may also act as independent controllers for their own services, terms, legal compliance, fraud prevention, payment processing, or security obligations.

7. Where Personal Information Is Stored and Processed

SteamTicket aims to host account and progress data in Canada where practical, including a Canadian Supabase region where available. However, Supabase region availability, fallback operations, Paddle, email providers, and other service providers may process or store personal information outside Canada, including in the United States, the United Kingdom, the European Union, or other jurisdictions. Information processed outside Canada may be subject to the laws, courts, law enforcement, regulators, or national-security authorities of those jurisdictions.

Where we use service providers outside Canada, we take reasonable contractual, technical, and organisational steps to protect personal information.

8. Safeguards

We use reasonable administrative, technical, and physical safeguards appropriate to the sensitivity of the information. Safeguards may include HTTPS/TLS, hashed passwords, access controls, limited administrative access, provider security controls, backups, logging, monitoring, and encryption at rest where supported by our service providers. SteamTicket question banks are designed to be encrypted at rest using AES-256-GCM, with entitlement-gated access to decryption keys through an edge function.

No website, app, database, network, browser storage, or service provider is perfectly secure. You are responsible for using a strong password, protecting your device, and keeping your login information private.

9. Retention

We keep personal information only as long as reasonably needed for the purposes described in this Policy or as required or permitted by law. Account and synced progress information is generally kept while your account is active. Purchase and refund records may be kept as needed for accounting, tax, consumer-protection, dispute, fraud-prevention, and audit purposes. Support messages may be kept for a reasonable period so we can respond and maintain a support history. Local storage remains in your browser until you clear it, overwrite it, or the app removes it.

When information is no longer needed, we will delete, anonymise, or securely restrict it, subject to technical backup cycles and legal retention needs.

10. Your Privacy Rights

Depending on where you live and which law applies, you may have the right to ask for access to your personal information, ask for corrections, withdraw consent, request deletion, ask questions about our privacy practices, and complain to a privacy regulator. To make a request, email support@steamticket.ca from the email address associated with your account. We may need to verify your identity before responding.

You may complain to the Office of the Privacy Commissioner of Canada. Depending on the circumstances, you may also have rights through the privacy commissioner in Alberta or British Columbia, or another applicable regulator.

11. Breach Notification

If we become aware of a breach of security safeguards involving personal information under our control, we will assess the risk and take steps required by applicable law. Where required, we will notify affected individuals and report to the appropriate privacy regulator if the breach creates a real risk of significant harm or serious injury. We will also keep breach records as required by law.

12. Children

SteamTicket is intended for working adults and adult learners. It is not directed to children under 13, and we do not knowingly collect personal information from children. If you believe a child has provided personal information to SteamTicket, contact support@steamticket.ca.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The updated date will be shown above. If we make material changes to how we handle personal information, we will provide notice and, where required, seek consent.

14. Contact

Questions, requests, or complaints about privacy can be sent to support@steamticket.ca.