Privacy Policy

Your account. When you sign in, we store your email address and the name and profile picture your sign-in provider (Google, Discord or Twitch) shares, or just your email if you sign in with an email link. We keep our own copy of that picture, so pages on our site never load it from the provider. We do not keep any access to your Google, Discord or Twitch account: only which account you signed in with. In your account you can add a preferred name, pronouns, a legal name for badge pickup, the name you want printed on your badge, a profile picture, a logo, links to your social accounts, your Discord name, and when you plan to arrive and leave. All of that is optional and you can change or clear it at any time.

Badges and orders. What you bought, when, for how much, the badge holders' names, and any refunds. Payments are handled by Stripe: your card number goes to Stripe, not to us. We see the amount, the last four digits and the email you gave at checkout. If you buy merchandise that ships, we keep the shipping address until it has shipped, and you can remove it from your account afterwards.

Kid Badges and children's badges. A parent or guardian adds a child's badge from their own account, and confirms they are the child's parent or legal guardian before we store anything. We store the child's first name as it should appear on the badge, the child's age, and when that confirmation was given. Children do not get accounts of their own.

Kickstarter backers. If you backed 20XXpo on Kickstarter, we imported your name, email, backer number, pledge level and rewards from Kickstarter's export so we can give you what you backed.

Applications. If you apply to run a panel, play in the Mega Man-athon, host, perform, show a fan game, or cover the event as press, we keep your answers, including links you provide, your availability, and any accessibility needs you tell us about, so the team can review and schedule.

Things you post. Questions on the FAQ page, messages in the stage chat during the event, messages sent through the contact form, and photos uploaded by accredited photographers, with the credit name they choose.

At the event. When a badge is picked up or scanned, we record which badge, when, and which team member handled it. Staff accounts also keep a record of what they did (sales, hand-overs, refunds), so we can answer questions later.

Automatically. Our web server keeps standard logs: the address your connection comes from, the pages requested, the time, and the browser type. We use them to keep the site running and to stop abuse. We do not run advertising trackers or third-party analytics on this site.

When a safety check stops something. If you try to use a word we don't allow, pose as our team, go over a limit (like too many sign-in emails), or enter wrong two-factor codes, we note what happened and where, including the words you tried. Only our Admins can see it, and only to stop abuse.

We use cookies only to keep you signed in and to protect sign-in and forms from forgery. There are no advertising or tracking cookies. Team members who use the Dashboard have a few extra cookies and some data stored in their browser for the registration desk and the merch counter (for example, the list of badges to hand out, so the desk works if the venue Wi-Fi drops). Stripe's checkout pages set Stripe's own cookies; they are covered by Stripe's privacy policy. Embedded YouTube and Twitch players set those companies' cookies, and so may the Google map on the Venue page, which loads only when you press "Show map". Every cookie, what it is for and how long it lasts is listed in the Cookie Policy.

Your browser lets you delete or block cookies. If you block ours, you will not be able to stay signed in. We do not currently respond to "Do Not Track" browser signals, because we do not track.

To sell and deliver badges and merchandise, hand out badges at the door, and send you the emails that go with a purchase (confirmations, receipts, shipping updates, refund notices).

To review applications, build the schedule, and run the Mega Man-athon, panels and stage chat.

To give Kickstarter backers their rewards and backer-only achievements.

To answer your messages and questions.

To keep the site and the event safe: preventing fraud, enforcing the Code of Conduct, moderating chat, and investigating problems.

To send news about 20XXpo by email, if you have not opted out. Every mailing has an unsubscribe link, and you can also opt out in your account. We cannot turn off the emails that go with a purchase or an application, since those are how we deliver what you asked for.

To understand how the event is doing, using totals and anonymized numbers.

Service providers that run parts of the site for us: Stripe (payments and refunds), Resend (sending our emails), Google, Discord and Twitch (sign-in, only what you choose to share with them), EasyPost and the postal carriers (shipping rates, labels and delivery, which means your shipping address goes to the carrier), and our hosting provider in the United States. Each of them only gets what it needs for its job.

Guests, sponsors and the venue. We may share counts and schedules, not personal information, unless you have asked us to (for example, a press application that asks for an interview).

The public. Your preferred name and profile picture show in stage chat and anywhere you post. If you take part as a guest, panelist, performer or runner, your name and the details you provide for the program appear in the schedule and promotional material. Photos approved for the gallery show the photographer's credit name.

When the law requires it, or to protect the safety of attendees, staff or the venue.

If LemonAID Events changes hands, the event's records would go with it, under this policy.

We do not sell or rent personal information, and we never share it for someone else's marketing.

20XXpo is photographed, filmed and streamed. By attending you may appear in photos, video and live streams made by our team, accredited photographers and press, and other attendees. In your account you can say whether we may use pictures of you in our promotion; we honor that choice for material we control. If a photo of you appears in our gallery and you want it taken down, use the removal request on the Photos page or the contact form.

Accounts on 20xxpo.com are for people 13 and older. We do not knowingly collect information from a child under 13 directly; if we learn that we have, we delete it. A parent or guardian adds a child's badge from their own account, confirms they are the parent or legal guardian when they do, and is the one we contact about it. They can change or remove the child's details at any time, and asking us to delete the account removes them too. Attendees under 18 need a parent or guardian's consent to attend, as described in the Code of Conduct.

Your account and what is in it: for as long as you have the account. Orders, payments and refunds: as long as tax and accounting rules require (generally seven years). Shipping addresses: until the order has shipped, then only if you choose to keep them on file. Applications: through the event they were for and the next one, so we can invite you back. Chat messages: through the event, for moderation. Contact messages: until answered and for a reasonable time after. Server logs: about 30 days. Safety-check notes: 90 days. Moderation records (warnings, timeouts, blocks and the team's notes about them): for as long as the account exists. Kickstarter backer records: until every reward has been delivered.

You can see and change most of what we hold about you in your account at any time.

You can unsubscribe from mailings with the link in any mailing or in your account.

You can download a copy of your data, or ask us to delete your account, in your account under Login & Security. You can also ask to see, correct, delete or receive your personal information through the contact form or by emailing legal@20XXpo.com. We will answer within 30 days. We may need to keep some records (for example, a payment) where the law requires it, and we will tell you if so. Deleting your account means losing access to the badges and orders on it, so we will confirm with you first.

If you live in a place with its own privacy rights (the European Union, the United Kingdom, California and others), you have those rights with us too. We do not sell personal information, so there is nothing to opt out of on that front.

Connections to the site are encrypted. Team members who can see attendee information must use two-factor sign-in, and each one only sees what their job needs. Passwords are not stored, because sign-in happens through your email or your Google, Discord or Twitch account. Card numbers never reach our systems. No system is perfectly secure, and we will tell you promptly if we learn of a problem that affects your information.

Our servers and service providers are in the United States. If you use the site from somewhere else, your information is transferred to and handled in the United States under this policy.

Links to other sites (Kickstarter, Discord, Twitch, YouTube, sponsors, the venue) lead to places with their own privacy policies. This one covers only 20xxpo.com and the event.

When we change this policy, we update the date at the top. If a change affects how we use what we already hold, we will email account holders before it takes effect.

Questions about privacy, or a request about your information: use the contact form, email legal@20XXpo.com, or write to LemonAID Events, 3715 196th St SW #2212, Lynnwood, WA 98036.