Privacy Policy

This policy explains what information StubOrder collects when you use our website, how we use it, who we share it with, and the choices you have. By using StubOrder you agree to the practices described here.

Last updated: October 7, 2026

Who we are

StubOrder is an independent online ticket resale marketplace based in Buffalo, NY. In this policy, "StubOrder," "we," "us," and "our" refer to StubOrder. If you have any question about your privacy, contact us through our contact form.

Information we collect

Information you give us

• Contact details you share when you email or call us, such as your name, email address, phone number, and the content of your message.
• Newsletter sign-up. If you subscribe to our email updates, we store the email address you give us, and your name and phone number if you choose to provide them. We use these only to send you StubOrder updates, we do not sell them, and every email includes a one-click unsubscribe link. When you subscribe, your details are added to the email service we use to send campaigns.
• Approximate location on sign-up. When you subscribe to email updates, set a ticket alert, or turn on push notifications, we also record the approximate city and state worked out from your IP address at that moment, so we can tell you about events near you rather than across the country. We store only the city and state, never your IP address and never precise coordinates, and we do not update it afterwards or track where you go. Ask us and we will remove it.
• Order information when you buy tickets. Your payment and billing details are collected and processed by our ticketing partner on the checkout screen, not stored by StubOrder. See "How we share information" below.
• Travel bookings. When you book a hotel or a flight on StubOrder we collect what the booking needs: names and an email address and, for flights, a phone number and each traveller's date of birth, gender, nationality and passport or other government ID details (type, number, issuing country and expiry), exactly as the airline requires them. We also record the choices you make (dates, property or route, room, fare, seats and bags). When you search for or hold a flight we also use Cloudflare Turnstile, a bot check, which processes technical data about your browser and device. When you pay, your browser sends technical data such as your IP address to our travel partner's payment provider, which uses it for fraud screening.

Information we collect automatically

• Usage and device data such as your browser type, pages viewed, referring page, and general interaction, gathered through analytics.
• Approximate location. To show events near you, we look up an approximate city and state from your IP address using a third-party geolocation service. We store a shortened, hashed reference rather than your full IP for this feature, and you can change or clear your location at any time.
• Server logs. Like most websites, our server records each request it receives: the page requested, the time, the response status, your device type, and the website that referred you (the site name only, never the full address). This is not cookie-based and is used for security, troubleshooting, and counting traffic. We do not store your IP address in these records. We do record an approximate location (country, state, and city) worked out from your IP address, so we can see which parts of the country our visitors come from, and any search terms you type into the site search. To count how many separate people visited on a given day, we store a scrambled code derived from your IP address and browser, combined with a secret that is deleted each night, so the code cannot be traced back to you or matched to your visits on any other day.
• Cookies and similar technologies, described in the next section.

Cookies and similar technologies

Cookies are small files a website stores in your browser. Websites can also keep small notes in your browser's local storage, which stays until you clear it, and in its session storage, which is cleared when you close the tab. This section lists what StubOrder's pages store in your browser and who sets it.

Set by StubOrder

• Location (cookie so_loc): the city and state we detected or you chose, so we can show events near you. A location you choose is kept for a year and a detected one for a month. Use the "change location" control in the header to change or clear it.
• Analytics choice (cookie so_consent): whether you opted out of analytics or back in, kept for a year so we can honor your choice on return visits.
• Hotel price check (cookie __Host-so_hp): set only after you ask for live hotel prices. It lasts one hour and lets this browser load them without repeating the check. It holds an expiry time and a signature, nothing about you. Pages that offer hotel prices also keep short notes in this tab's session storage about when that check expires (so_hp_off, so_hp_until and so_hp_go).
• Forms and bookings (a standard session cookie): the contact form and the hotel and flight booking pages use it to protect your form from forgery and keep your booking steps together. It is deleted when you close your browser.
• Flight booking in progress (cookie so_fo): when you start a flight booking, a random code links this browser to that booking for one day. It is sent only to the flight booking pages.
• Your preferences (local storage): your light or dark display theme (so_theme), your settings in the accessibility menu (bv_a11y_v1), your answer when we offer browser notifications, so we do not ask again too soon (so_push_ask), and whether you prefer the seat map or the list when choosing flight seats (so_fx_view). These stay in your browser and are not sent to us.
• This visit (session storage): how many pages you have viewed in this tab (so_pv), so we offer notifications or our app only from your second page, and the website that brought you to StubOrder at the start of the visit (so_first_ref). If you sign up for email updates, a ticket alert, or notifications, that referring website is sent with your sign-up so we know where you found us.

Google Analytics

• Analytics (cookies _ga and _ga_ followed by an ID): Google Analytics helps us understand how visitors use the site, such as which pages are popular and where visitors come from. Analytics is on by default, and you can turn it off at any time (see "Your choices" below).

Set by our ticketing partner's seat map

The interactive seat map and ticket listings on event pages are provided by our ticketing partner (TicketNetwork and its Seatics service). The seat map loads shortly after an event page opens, and it runs our partner's fraud-prevention service (Riskified), which collects technical information about your browser and device so that fraudulent and automated ticket orders can be stopped. It stores the following in your browser on stuborder.com:

• Fraud-prevention cookies: RiskifiedSessionId, which lasts until you close your browser, and rCookie, rskxRunCookie and lastRskxRun, which are set to last up to two years (some browsers keep them for a shorter time). Copies are also kept in local and session storage.
• Seat map settings: gbFeaturesCache in local storage, which remembers which seat map features our partner has switched on, and seatics_user_loc in session storage, which the seat map uses while the tab is open.

These are necessary for the seat map and for buying tickets, so they are set whenever the seat map loads, including when you have opted out of analytics. Our ticketing partner and its fraud-prevention provider handle this information under their own privacy terms.

Expedia links, search box and banners

StubOrder is a member of Expedia Group's affiliate program, which runs on the Partnerize network. Some travel pages link to Expedia for car rentals, things to do, vacation packages, cruises and hotels, and say so next to the links. When you follow one of those links, Expedia Group and Partnerize record that the visit came from StubOrder, using cookies on their own websites, so that we can be paid a commission if you book. We do not receive your booking details, and we do not send Expedia anything about you.

Our car rentals, things to do, vacation packages and cruises pages also show a banner, and two of them a hotel search box, provided by Expedia Group. They load from Expedia's servers only when you scroll to them, and not at all if you have opted out of analytics or your browser sends the Global Privacy Control signal (unless you have expressly opted back in). When they load, Expedia Group may set or read its own cookies under its own privacy policy.

Your choices. You can opt out of analytics at any time using the Cookie Settings link in the footer of every page, and opt back in the same way. Cookie Settings controls Google Analytics and the Expedia search box and banners only. It does not switch off StubOrder's own cookies and storage listed above, which the site's features rely on, or the seat map's fraud-prevention cookies, which are necessary for buying tickets. We also honor the Global Privacy Control browser signal: if your browser sends it, analytics is turned off automatically unless you have expressly opted in. You can also block or delete cookies and clear site data in your browser settings. Doing so resets your preferences, and blocking the cookies described above may stop parts of the site, such as the seat map or checkout, from working.

How we use information

• To run the marketplace: show listings, surface events near you, and let you search and check out.
• To process and confirm your orders through our ticketing partner and provide customer support.
• To understand and improve site performance and content through analytics.
• To keep the site secure, prevent fraud and abuse, and meet legal obligations.

How we share information

We do not sell your personal information. We share information only with the service providers that make the site work, and only as needed:

• Ticketing and checkout partner. Ticket inventory, the interactive seat map, and the checkout are provided by our ticketing partner (TicketNetwork and its Seatics and checkout services). When you buy, your order and payment details are submitted to that partner to complete the purchase, and their handling of that information is governed by their own privacy terms.
• Our travel partner and the airlines. Hotel and flight bookings are fulfilled through Nuitée (LiteAPI), our travel partner, which acts as merchant of record and processes your card through its payment provider (Stripe). Card details go directly to that payment provider and never reach StubOrder. Nuitée processes booking data on our behalf under a data-processing agreement. For flights, traveller details are passed to the airline and its reservation systems to create and ticket the booking, as airlines and government travel-security programmes require; the airlines keep their own records under their own policies. Cloudflare Turnstile checks that flight searches come from people. We do not sell this information and do not use travel document details for any other purpose.
• Analytics provider. Google Analytics processes usage data to produce aggregate reports. We enable IP anonymization.
• Expedia Group affiliate program. We share no personal information with Expedia Group or Partnerize. They learn that a visit came from StubOrder only when you follow an Expedia link or one of their banners or search boxes loads (see "Cookies and similar technologies" above), and what you then do on Expedia is governed by Expedia's own privacy policy.
• Email service. When you subscribe to our newsletter, your email address and any name or phone number you provided are shared with the email service we use to send campaigns, solely so we can email you and honor your unsubscribe requests.
• Location lookup provider. A third-party geolocation service resolves your approximate city and state from your IP address.
• Legal and safety. We may disclose information if required by law, to enforce our terms, or to protect the rights, property, or safety of StubOrder, our customers, or others.

Your choices and rights

• Analytics. Use Cookie Settings, in the footer of every page, to turn analytics off or back on. Declining stops Google Analytics, and the Expedia search box and banners on our travel pages, from loading at all, for your visit and for future visits on that device. It does not affect the seat map's fraud-prevention cookies, which are necessary for buying tickets (see "Cookies and similar technologies" above). Our own server logs, described above, are not cookie-based and continue either way, because they are how we keep the site secure and working. They contain no cookie and no IP address. The only location in them is a broad country, state, and city, which does not identify you personally.
• Location. Use the "change location" control in the header to set or clear the location we use for "events near you."
• Browser controls. You can clear or block cookies and other site data (local and session storage) in your browser, and set your browser to signal Global Privacy Control (GPC).
• State privacy rights. Depending on where you live (for example under the CCPA/CPRA and similar state laws), you may have the right to access, correct, or delete personal information we hold, or to opt out of certain sharing. To make a request, use our contact form and we will respond as required by law. We will not discriminate against you for exercising these rights.
• Travel bookings. To ask about or delete travel booking data, use our contact form and quote your booking reference.

Data retention

We keep personal information only as long as needed for the purposes described here, to comply with our legal obligations, resolve disputes, and enforce our agreements. Analytics data is retained according to our analytics provider's settings. Raw server logs are deleted after about 35 days, and only aggregate counts are kept after that.

Travel data. We keep a passport or ID number in full only while your flight booking is being made (at most two hours), and afterwards only its last four characters. Search results are deleted after 30 minutes and unfinished bookings after 7 days; if you reached the payment step, we keep a minimal payment record (reference, amounts and times, no traveller details) for about 13 months. We keep a confirmed booking's traveller and contact details until 30 days after the trip ends, then delete them, keeping only the booking reference, route, dates and amounts as a financial record. For hotel bookings we keep the reference, property, dates, amounts and the lead guest's contact details for as long as we need them to support the booking and meet our legal and accounting obligations.

Security

The site is served over HTTPS, and we use reasonable technical and organizational measures to protect information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Children's privacy

StubOrder is intended for adults and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us information, contact us and we will delete it.

Third-party links

Our site and checkout may link to sites we do not operate. We are not responsible for the privacy practices of those sites, and we encourage you to read their policies.

Changes to this policy

We may update this policy from time to time. When we do, we will change the "Last updated" date above. Significant changes will be made clear on this page.

Contact us

Questions about your privacy or this policy? Use our contact form.