What we collect, and what we don't

Effective July 29, 2026

Two different things happen on this site

If you only join the waitlist, we collect your email address and nothing else. That part is covered in the next section.

If you buy a FallFest ticket, we collect a great deal more — your date of birth, your phone number, your emergency contact, your vehicle and license plate, and the name and date of birth of every passenger riding with you, including children. That is covered in Buying a FallFest ticket, below. Read it before you check out.

The waitlist

When you join the waitlist, we collect your email address. That's it. The signup form does not ask for your name, phone, or address.

We use it to send you updates about TougeNation events — announcements, ticket drops, schedule info. You opted in by submitting the form. We won't email you about anything else.

Buying a FallFest ticket

Checkout collects the following. Every field is required unless marked optional, and each one is listed with the reason we ask for it.

From you, the driver

First and last name — to find you at the check-in table and to put on your waiver.
Date of birth — you must be 18 or older on October 3, 2026 to drive, and we check that before we take your money. It is also how staff look you up at the gate.
Email address — to send your confirmation, your receipt, and the sign-in link for your order page.
Phone number — so we can reach you on event day about a route change, a delay, or a problem with your car.
Mailing address — your ticket includes driver swag (shirt, banner, route card, stickers) that we ship to you before the event. This is the shipping address. We do not use it for anything else, and we do not mail you marketing.
Emergency contact name and phone — the person we call if you are hurt. Given that this event is driving on mountain roads with limited cell coverage and slow ambulance response, this is the field we most need to be correct.
Vehicle year, make, model, color, and license plate — so staff can identify your car in a 20-car pack, confirm you are the registered driver at the gate, and account for every vehicle on the route.

From each passenger you add

First and last name — for check-in and for their waiver.
Date of birth — this is not optional and it is not cosmetic. A passenger's age on October 3, 2026 decides which legal document has to be signed for them: adults sign for themselves, anyone under 18 needs a parent or guardian to sign, and anyone under 13 additionally needs the COPPA consent addendum. We calculate the age ourselves from the date you enter — we do not take your word for whether someone is a minor.
Parent or legal guardian name, relationship, and phone — required for a minor passenger when the driver is not their guardian. This is who signed, and who we call.

Recorded automatically when you sign

When a waiver or the Code of Conduct is signed, we store the typed signature, the exact version of the document that was on screen, a fingerprint of its text, the timestamp, the IP address, and the browser user-agent. That is the audit trail proving who agreed to what and when. It is the point of an electronic signature, and we cannot drop it.

What we never see

Your card number. Payment is handled entirely inside Stripe's own form. Card details go from your browser to Stripe and never touch our servers or our database. We receive back only a payment confirmation and the amount.

Children under 13

A child under 13 can ride as a passenger. When that happens, we collect the child's full name and date of birth, and the name, relationship, and phone number of the parent or legal guardian who signs for them. Nothing else. We do not ask children for anything directly — a parent or guardian enters it, and a parent or guardian signs the COPPA consent addendum before checkout completes.

We use it for exactly three things: matching the child to the right booking at check-in, reaching a guardian in an emergency, and keeping the signature record. We do not email children. We do not build profiles. We do not disclose a child's information to anyone outside the processors listed below and, in a medical emergency, to responding medical personnel.

If you are the parent or legal guardian of a child in a booking, you can:

Ask to see everything we hold about your child.
Ask us to delete it.
Refuse any further collection. We will honor that — but it means the child cannot ride, because we cannot let an unidentified minor into a vehicle on a closed route without a signed consent on file.

Email privacy@touge-nation.com from the address on the booking, or tell us the order number. We will answer within 10 business days. If we cannot confirm you are the guardian on the booking, we will ask you a question only the guardian could answer rather than hand a child's records to whoever emailed us.

How long we keep it

Ticketing data — 90 days. Everything collected at checkout, for you and for your passengers, is deleted within 90 days after the event ends (that is, by January 1, 2027 for FallFest 2026). This matches the promise in the waiver you sign. Two exceptions, both narrow:

A pending claim. If there is an injury, an accident, an insurance claim, or a legal dispute, the records connected to it are kept until it is resolved. Destroying the waiver of someone who has just filed a claim would be indefensible.
Payment records. Stripe keeps transaction records on its own schedule for tax and anti-fraud reasons, and we keep the amount, date, and order number for the same reason. That is the receipt, not the roster — it does not include dates of birth, addresses, or passenger details.

Waitlist email — until you leave. We keep your email until you unsubscribe or ask us to delete it. There is no automatic purge, because there is no event date to count from.

Honest note: this deletion is performed manually by us after the event, not by an automated job. If you want confirmation that your data is gone, email us and we will confirm it in writing.

Who else touches your data

Three companies. All three are processors — they handle data to run this site for us, and none of them are permitted to use it for their own marketing.

Supabase — the database. Every field described above is stored there, plus the waitlist. Their policy: supabase.com/privacy.
Stripe — payment processing. Stripe receives your card details directly from your browser, plus the amount and an internal order reference. We deliberately do not send Stripe your name, email, date of birth, address, or anything about your passengers. Their policy: stripe.com/privacy.
Resend — email delivery. Receives the recipient email address and the contents of the message we send you (confirmation, receipt, sign-in link). Their policy: resend.com/legal/privacy-policy.

On event day, TougeNation staff working the check-in table can see the roster: driver and passenger names, dates of birth, vehicle, and emergency contacts. That is the job. In a medical emergency we will give responding personnel whatever they ask for.

What we don't do

We do not sell or rent your data. Not to anyone, not ever.
We do not share it with third parties for marketing, including our own sponsors and vendors.
We do not email passengers. Only the driver who made the booking hears from us.
We do not run advertising trackers and we do not set tracking cookies.
We do not use anything collected at checkout to build a marketing list. Buying a ticket does not sign you up for the waitlist.

Your rights

See what we have — email us and we'll send you everything tied to your order or your email address.
Correct it — a wrong date of birth is worth fixing before event day, because it decides which waiver is valid. Email us or use your order page.
Delete it — we'll remove it. Be aware that deleting your booking data before the event cancels your participation: we cannot run you on a route with no waiver on file, and ticket sales are non-refundable.
Unsubscribe — reply to any email with "unsubscribe" in the subject, or email us.

Requests go to privacy@touge-nation.com. We answer within 10 business days.

Security

Data is stored in Supabase, encrypted in transit and at rest by them. The service key that can read the full ticketing tables is held on the server and is never exposed to your browser. Access to the event roster is limited to the people running the event. We are a small team, not a security organization — if you find a problem with this site, email privacy@touge-nation.com and we will take it seriously.

Changes to this policy

If anything changes — new services, new data, new features — we'll update this page and bump the effective date at the top. We won't start doing something materially different with data we already hold without telling the people it belongs to first.

Contact

Privacy questions, data requests, and COPPA parental requests: privacy@touge-nation.com. Anything else: contact@touge-nation.com.

← Back to TougeNation