Privacy Policy

Version 3. Effective October 26, 2026.

This policy explains what personal information Thrivedom collects, why, who we share it with, how long we keep it, and the choices and rights you have. We've tried to write it so you can actually read it.

Who we are

Thrivedom PBC, Inc. ("Thrivedom," "we," "us") runs thrivedom.co. We're a Delaware public benefit corporation. For data protection law, we're the company responsible for (the "controller" of) the personal information described here.

• Privacy questions and requests: privacy@thrivedom.co
• Mail: Thrivedom PBC, Inc., 28 Geary St., Suite 650 PMB 5206, San Francisco, CA 94108, United States
• Person responsible for privacy: our Founder and CEO, reachable at privacy@thrivedom.co.

The short version

• You can enter a trip and see its estimated emissions without an account. We hold trips entered without an account for 30 days after you last work on them. To keep them longer or buy carbon credits, create an account. Trips only count toward our totals and statistics once they're saved to an account.
• We use where your trip starts to estimate its emissions. Combined with many other fans' trips, it may also go into event travel statistics that we could share or sell in the future. Your starting location and anything that identifies you are never released. You can leave your trips out of any statistics we prepare after you tell us. Statistics already released can't be recalled, but they're aggregate numbers that don't contain anything linked to you.
• Stripe handles your card details. We never see or store your full card number.
• We don't sell personal information about you, and we don't use it for advertising. The event travel statistics described below are aggregate numbers, not personal information.
• We only send updates about Thrivedom if you ask for them.

What we collect

When you log a trip

• Trip details: the event or show, where your trip started (a postal code, city or airport, and the country it's in), how you traveled (for example plane, train, car or bus), your party size (the number of people traveling together), and details that change the estimate, such as cabin class, number of connections and how many people were in the car.
• People you travel with: we only record how many. We don't collect names or any other details about them.
• Trips you log for someone else: if you log a trip someone else took, for example a friend you're buying carbon credits for, its details are about them. Please check they're happy for you to before you do.
• Calculated results: distance, estimated emissions, and the emission factor version used.

If you enter a trip before creating an account, or open a friend's share link or a promo link, we keep your trips, who invited you, and any promo code you arrived with against a random identifier kept in a cookie in your browser (an "anonymous session"). If you then create an account, they move to your account. If you don't, we delete the anonymous session and its trips 30 days after you last enter or change a trip, open checkout for one, or open a share link or promo link.

When you create an account

• Your email address, and how you sign in: with a password, or with a one-time code we email you. We store passwords and codes only in a scrambled (hashed) form.
• Whether you've confirmed your email address, and when you joined.
• Your referral code, and who referred you, if you joined through a friend's link.
• Whether you asked for updates about Thrivedom, with the time, the wording you agreed to and the version of this policy, and when you unsubscribe.

Before you can log a trip, we ask you to confirm you're 18 or older. We don't store your age or date of birth.

When you buy carbon credits

• Purchase details: what you bought, the amount and currency, the fees, your receipt ID, and the dates your credits were bought and retired.
• Payment details from Stripe: your card brand (for example Visa) and its last four digits, so we can show them on your receipt; your billing city, state or region, postal code and country, which we need for tax and accounting; and Stripe's reference numbers for the payment and any refund. Stripe collects your card details, name and billing address directly in its payment fields, and we pass it your email address for the payment record. Your card details never pass through our servers, and we don't keep your name or street address.
• Link: if you choose to save your details with Link, Stripe's quick-checkout service, Stripe handles that under Link's own terms and privacy policy, not ours.
• Cancellations: if you withdraw from a purchase, the date and time and how you asked.
• If you pay before entering your sign-in code: when the email you enter already has an account, you can pay before the code arrives. We keep that email address with the purchase and send the receipt there, and we keep the purchase's trips with it, until the purchase is added to the account. We remove the address from the purchase once it's added, or if that account is deleted.

When you contact us

The email address you write from and what you tell us, including support requests, withdrawal requests and privacy requests.

Automatically, when you visit

• Your approximate country, from your IP address, so we can show prices as "$" or "US$" and, when you pick a show, start with the part of the tour that visits your country. Our hosting provider works this out as your request arrives. If it can't, we use your browser's language setting instead. We don't store your IP address or your country for this.
• Product analytics, if you say yes: which pages and steps you use (including the amount of any purchase), the site that sent you to us and any campaign label in the link you followed (such as which post or email it came from), your device, browser, language, screen size and timezone, and an identifier Statsig generates in your browser, so we can see where the site works and where people get stuck, and test changes. If you sign in, we may also send Statsig a random identifier we create for your account, so we can see the same fan across devices. Never your name or email. When you're signed in, we also keep a record of which of these browser identifiers belong to your account, so we can connect the analytics to your account on our side, for example to see which steps fans took before signing up, or how fans of different events use the site. Statsig never receives this record. We delete it for a browser when you turn analytics off there, and all of it when you delete your account. We use Statsig for this. See "Cookies and similar technologies."
• Security and server logs: IP address, browser type and the requests your browser makes, kept briefly to keep the site running and to stop abuse. When you ask for a sign-in code, we also keep the email address it went to, when you asked and your IP address for 30 days, so we can limit how many codes are sent and look into abuse. When you sign in and we check whether an email address has an account, we keep your IP address and the time for one day, so we can limit how many checks one connection can make. We don't keep the email address you checked.
• Your cookie choice: a record of what you chose and when, whether your browser sent a Global Privacy Control signal, your approximate country and the version of the banner and policy you saw, linked to your account if you sign up or sign in. It's how we show we asked properly.
• Error reports: if something breaks, our error-monitoring provider, Sentry, records the error, the pages you visited just before it, and your browser, device, language and timezone, so we can fix it. Sentry receives your IP address when a report is sent, but we've set it not to store it.
• Global Privacy Control: whether your browser sends this signal (see "Your choices").

How we use it, and our legal basis

Some privacy laws, including the GDPR in the EU and UK, require us to name a legal basis for each use. Here they are.

Where we rely on legitimate interests, you can object (see "Your rights").

You need to give us your email address to create an account (and a password, if you sign in with one rather than with a code we email you), and your trip details to get an estimate. Without them we can't provide those parts of the service.

We don't make decisions about you by automated means that have legal or similarly significant effects. Stripe screens payments for fraud automatically, under its own privacy policy, and may decline a payment as a result.

Community totals on our site

Your trips and any carbon credits you buy count toward the totals we show on Thrivedom, such as trips logged and kg of carbon credits bought for each event. These totals don't identify you. They're separate from the event travel statistics described in "How trip data could help the live events industry," so leaving your trips out of those statistics doesn't remove you from these totals. If you delete your account, totals already shown keep counting your past trips and purchases, with nothing that identifies you.

Transparency page. For each tonne of carbon credits we retire, we publish its registry serial number and which purchases it went to. Purchases are shown only by the last four characters of their receipt number (for example ••••7Q4K), the date of purchase and the grams assigned to that tonne, never by name, email or amount paid. If a purchase is refunded, the page shows which later purchases took its grams.

How trip data could help the live events industry

What we create. When you log a trip, we use it to estimate your trip's emissions. We may also combine it with other fans' trips to the same event into travel statistics for that event. These show how many trips and people traveled by each mode (for example plane, train, car or bus) within distance ranges (for example 150 to 500 km), and the total distance and estimated emissions for each group.

What we never include. Anything that identifies you, such as your email address, account ID or payment details. We also leave out postal codes, the airport, city, region or country you traveled from, and the details of any single trip. We don't release figures based on only a small number of trips. We may release statistics for an event or tour while fans are still logging trips, but only once enough trips have been logged. If we release updated statistics for the same event or tour, we wait until enough new trips have been added that no one's trip can be worked out by comparing versions.

Who could receive them. We don't share or sell these statistics today. In the future, we may share, license or sell them to event organizers, venues, promoters, artist management companies and record labels, researchers, and sustainability organizations. Any recipient would have to agree in writing to use them only to measure, report or reduce the emissions of travel to events, and not to try to identify anyone or combine them with other data to do so.

Our commitment. We keep these statistics in de-identified form, and we won't try to re-identify anyone from them, except to test that our own process works.

How we check our numbers. Inside Thrivedom, we use the country trips start from to check that our statistics reflect who actually attends. That information stays with us. If an organizer's emissions report is independently reviewed, the reviewer may check a sample of our calculations with us under a confidentiality agreement. They don't receive anything that identifies you.

Your choice. Trips entered without an account are never included. You can leave your trips out of statistics we prepare from then on, at any time: turn off "Include my trips in event travel statistics" in your privacy settings, or email privacy@thrivedom.co. If your browser sends a Global Privacy Control signal, we treat it as this request. If you then choose to include your trips, on the page you see after logging a trip or in your privacy settings, your choice applies instead of the signal. We can't recall statistics we've already released, but they're aggregate numbers that don't contain anything linked to you. If you delete your account, your trips are also left out of future statistics.

Travel companions. If you log a trip for a group, your group's travel is counted as part of your trip. Leaving your trips out leaves out your group's too.

Legal basis (EU and UK). If we prepare these statistics, we'll rely on legitimate interests: ours and the live events industry's interest in measuring and reducing the emissions of travel to events, which is part of our public benefit purpose. We'll document that assessment before we start. You can object at any time, as described above.

Earlier trips. Trips logged before this section was first published are never included.

Who we share information with

We share personal information only with service providers that help us run Thrivedom, and where the law requires it. Our contracts limit what providers can do with it, except where we say otherwise below.

We also share information:

• When the law requires it, for example a valid court order, or to protect someone's safety.
• If Thrivedom is sold or merged, in which case the new owner must keep the promises in this policy, and we'll tell you before anything changes.

We don't give your name or email to carbon credit suppliers or registries. Credits are retired in Thrivedom PBC's name.

Cookies and similar technologies

Here are the cookies and browser storage Thrivedom uses, and why. Only analytics needs your OK, and it stays off until you say yes. You can change your answer any time in Cookie settings at the bottom of any page. If your browser sends a Global Privacy Control signal, we treat that as a no unless you choose otherwise.

Turning analytics off clears it from your browser and deletes our record linking that browser to any account. If you're offline at the time, that happens the next time you visit. It doesn't delete analytics Statsig has already received.

Our error monitoring (Sentry) doesn't use cookies or browser storage.

We work out your country from your IP address as your request reaches our hosting provider, or, if that's not possible, from your browser's language setting. We don't store your IP address or your country for this, and we don't pass them to anyone for this.

We don't use advertising cookies, and we don't let advertisers track you on our site.

How long we keep it

Your choices

• Leave your trips out of event travel statistics: see "Your choice" above.
• Analytics cookies: use the cookie settings link in our footer.
• Global Privacy Control: if your browser or extension sends this signal, we treat it as a request to opt out of analytics cookies and to leave your trips out of event travel statistics. If you later choose to include your trips anyway, that choice wins over the signal.
• Email: we send emails about your account and purchases. We only send other updates about Thrivedom if you asked for them by ticking the box when you created your account. You can unsubscribe with the link in any of those emails. For update emails, we may track whether you opened them and which links you clicked, so we can see what's useful. We don't track this on account and purchase emails.

Your rights

Depending on where you live, you may have the right to:

• see the personal information we hold about you, and get a copy;
• correct it;
• delete it;
• object to, or ask us to limit, how we use it;
• withdraw consent, where we rely on it;
• move it to another service in a common format;
• not be treated differently for using these rights.

We give these rights to everyone, wherever you live. To use them, email privacy@thrivedom.co from the address on your account, or tell us which address it is. If we can't confirm the request comes from you, we may ask for more information. We'll reply within 30 days, or sooner where the law requires it. You can also ask someone to make a request for you, with your written permission.

Deleting your account. Email privacy@thrivedom.co from the address on your account and we'll delete it. Here's what happens:

• What we delete: your account and every trip you've logged. You'll be signed out everywhere and won't be able to sign in again.
• What we keep: records of the carbon credits you bought, which we keep for tax and accounting for the period in "How long we keep it." We remove your account, email address and card details from them. They still include your billing city, state, postal code and country, which we need for tax and accounting. Like every purchase, they still appear on our transparency page as grams, a purchase date and the last four characters of a receipt number.
• What stays in community totals: before we delete your trips, we add what they counted for (the emissions you logged, the carbon credits bought for them, and you as one attendee) to tour and community totals as anonymous numbers. That way the totals other fans see don't suddenly drop. Nothing in those numbers shows which trips were yours.
• Usage analytics: Statsig knows you only by random identifiers, never your name or email. When you delete your account, we delete any identifier we created for it and our record of which browser identifiers were yours, so the usage data Statsig still holds can't be connected to you. Statsig deletes that data within 1 year.
• Stripe: Stripe processes our payments and keeps its own records of them under its own privacy policy.

If you're unhappy with how we've handled your information, please tell us first. You can also complain to your local data protection authority.

Region-specific information

European Economic Area, United Kingdom and Switzerland

You have the rights listed above under the GDPR and UK GDPR. Our legal bases are in "How we use it." You can complain to the data protection authority where you live or work. In the UK, that's the Information Commissioner's Office (ico.org.uk).

California and other US states

If a US state privacy law applies to how we handle your information:

• Categories collected in the past 12 months: identifiers (email address, account and receipt IDs, analytics ID, IP address); commercial information (purchases and refunds); payment information (card brand and last four digits); internet activity (product analytics, error reports, and your cookie and privacy choices); communications (messages you send us); referral information (whose share link brought you, if any); location information (where your trip started, as a postal code, city or airport; your billing city, state, postal code and country; approximate country from your IP address); account login (email address, and password if you use one).
• Sources: you, your browser, our hosting provider (your approximate country), the friend whose share link you opened, and Stripe.
• Purposes and who receives it: see "How we use it" and "Who we share information with." We disclose personal information to service providers only for business purposes.
• Sale and sharing: we don't sell or share personal information, as California law defines those terms. The event travel statistics described above are aggregate information, not personal information. We don't use or disclose sensitive personal information (your login details) for anything other than signing you in.
• Opt-out signals: we honor Global Privacy Control as described above.
• Your rights: to know, delete, correct, and opt out, and not to be discriminated against for using them. Use the contact details above.

Canada (including Quebec)

You can access and correct your personal information and withdraw consent, as described above. You can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information. Our person responsible for privacy is named under "Who we are."

Brazil

If you're in Brazil, you have the rights in Brazil's General Data Protection Law (LGPD), including to: confirm whether we process your information; access it; correct it; have unnecessary or excessive information anonymized, blocked or deleted; move it to another provider; delete information we process with your consent; know who we share it with; know what happens if you don't give consent; withdraw consent; and object to processing. Our legal bases are those in "How we use it": providing the service you asked for, our legal obligations, our legitimate interests (including event travel statistics, which you can ask us to leave your trips out of), and your consent where we ask for it. To use your rights, email privacy@thrivedom.co, which reaches our person responsible for privacy. You can also complain to Brazil's data protection authority (ANPD).

Mexico

If you're in Mexico, you have the rights to access, correct and cancel your personal information and to object to its use (ARCO rights), and to withdraw consent. We use your information mainly to run Thrivedom: estimating your trips' emissions, selling and retiring carbon credits, and keeping your account and receipts. We also use it for purposes that aren't needed for the service, which you can refuse at any time without losing access: preparing event travel statistics, product analytics, and updates about Thrivedom. To use your rights or refuse any of these purposes, use the choices in "Your choices" or email us at privacy@thrivedom.co.

South Korea

If you're in South Korea, we transfer your personal information outside Korea to provide the service you asked for. It's sent over the internet as you use the site, and kept for the periods in "How long we keep it."

You can say no to analytics. The other transfers are needed to provide the service, so if you don't want them, please don't use Thrivedom or ask us to delete your account. Our person responsible for privacy is our Founder and CEO, reachable at privacy@thrivedom.co.

International transfers

We're based in the United States, and so are all the service providers listed above. We store your information in the United States. Our providers may also process it in other countries where they operate, under the same contracts. When we send information from the EU, UK or Switzerland to a service provider, we use the European Commission's Standard Contractual Clauses (and the UK and Swiss equivalents) in our contracts with them. If you use Thrivedom from outside the US, the information you send us goes to the US, where privacy laws may differ from yours.

Security

We use encryption in transit (HTTPS), store passwords and sign-in codes only in hashed form, limit who can access personal information, and let Stripe handle card details so they never reach our servers. No system is perfectly secure. If a breach affects your information, we'll tell you and the relevant authorities as the law requires.

Children

Thrivedom is for people 18 and older. We don't knowingly collect information from anyone younger. If you think a child has given us information, email privacy@thrivedom.co and we'll delete it.

Changes to this policy

When we change this policy, we'll update the version number and date at the top and keep earlier versions available on request. For material changes, we'll email account holders at least 30 days before the change takes effect. We won't use information you gave us before a change in a new way that this policy didn't describe at the time, unless you agree.

Contact us

privacy@thrivedom.coThrivedom PBC, Inc., 28 Geary St., Suite 650 PMB 5206, San Francisco, CA 94108, United States