PRIVACY POLICY

Password and account security

User and administrator passwords are stored only as one-way salted hashes using industry-standard methods (Argon2 / bcrypt via our authentication provider). No staff member, including administrators, can view an actual password. Google or other external authentication secrets are never stored in this application.

• Production traffic is transmitted over HTTPS with TLS 1.3 where supported by the hosting platform.
• Login sessions use HTTP-only cookies with SameSite controls to reduce XSS and CSRF risk.
• Google OAuth and email OTP, where enabled, receive only authorized basic profile data such as name and verified email.

Third-party SSO safety (Google / OTP)

When you sign in with Google, we request only openid, email, and profile scopes. When you sign in with email OTP, a one-time code is emailed to you and verified server-side. External authentication passwords are never collected or retained by Socials by Studio.

What we collect

We collect information needed to run experiences, deliver tickets, and respond to studio enquiries: name, email, phone, booking details, and messages you send us.

What we do not do

We do not sell, rent, harvest, or share user email, phone numbers, or a user directory with advertisers or data brokers for their marketing.

Cookies and sessions

Session cookies are HTTP-only and are not readable by client-side scripts. See our Cookies notice for details.

Event media

If you attend a public community event, we may photograph or film the event for recaps, portfolio, and social marketing. Contact us before the event if you have concerns about being featured.

Contact

Privacy questions: socialsbystudio@gmail.com. This policy is governed by the laws of India, with disputes subject to the courts in Chennai, Tamil Nadu.