Last updated: 6 October 2026

The short version

We don’t track you. We count page views with a privacy-first analytics tool that sets no cookies, fingerprints nothing and cannot tell who you are — and that’s the only measurement on this site. No advertising pixels and no third-party tracking. Two things here do come from outside: Google serves the fonts this site is typeset in, which happens on every page, and the demo video on our product pages, which stays a still image until you press play. Neither sets a cookie, which is why there is no cookie banner — there is nothing stored before you choose. We hold your details only if you email us, fill in our contact form, or buy a plugin licence. Our plugins run entirely on your own website and send us nothing.

That’s the whole policy in a paragraph. The rest is detail.

1. Who we are

Blue Brain Media is a web design and development business based in British Columbia, Canada. We operate this website and sell the WordPress plugins Wallet Pass for Amelia and Wallet Pass for Tickera. If you have a question about anything on this page, email support@bluebrainmedia.ca.

2. What this policy covers

This website, our plugins, and the support and client relationships that come with them. It does not cover other companies’ websites we link to, or the separate agreements we sign for client project work.

3. When you just visit the site

We use Cloudflare Web Analytics to count page views and visits. It tells us which pages get read, what site people arrived from, and roughly where in the world and on what kind of device they were. That is the only thing here measuring anything on our behalf.

It is the privacy-first kind, and the distinction matters: it sets no cookies, it does no fingerprinting, it does not follow you to other websites, and it gives us no way to identify you or pick you out of the numbers. We see totals, not people.

There is no Google Analytics here, no tag manager, no advertising or social pixels, no session recording and no chat widget.

There are two exceptions, and both involve Google.

The first is the fonts. This site is typeset in webfonts served by Google Fonts, which means your browser fetches them from fonts.googleapis.com and fonts.gstatic.com when a page loads. That request carries your IP address and your browser’s user agent to Google, as any request to any server does. Google states that it does not set cookies for Google Fonts and does not use the requests for advertising. We would rather serve the fonts ourselves and may yet do so, but as of today we do not, so we are not going to pretend nothing leaves the page.

The second is the demo video on our product pages, which is hosted on YouTube. It sits on the page as a still image, and nothing of YouTube’s loads until you press play — so if you don’t, YouTube never learns you were here. If you do, you are watching on YouTube’s terms, and Google can see it in the same way it would if you had opened the video on their own site. We use their no-cookie player, which reduces what gets set, but it does not make Google a bystander. If you would rather they had nothing at all, don’t press play.

Our web server also keeps standard access logs — IP address, the page requested, the time, your browser’s user agent — because every web server does, and because they’re needed to keep the site secure and working. They’re kept briefly and used for nothing else.

4. When you contact us

There are two forms on this site, and neither asks for more than it needs.

Our contact form asks for your name, phone number and email address, and whatever you write in the message.

Our plugin support form asks for your name and email address, which of our plugins you are asking about, what you need, and your message. It also asks — optionally — for your website address, which wallet is involved, and the version numbers you are running. Those last few are there so we can reproduce a problem rather than send you three follow-up questions.

Either way it arrives in our inbox and is stored on this site so we don’t lose it. We use it to reply to you and to keep track of the conversation, and that’s all. Emailing us directly does the same thing without either form.

5. When you buy a plugin licence

Our checkout is run by Freemius Inc., which acts as the merchant of record for every purchase. Freemius collects what a purchase needs — your name, email address, billing country and payment details — processes the payment, handles sales tax or VAT, and issues your invoice. Your card details never reach us. We can’t see them and we don’t store them.

What we receive from Freemius, and hold, is your name and email address, the product and plan you bought, your licence key, and the websites your licence is activated on. We use it to deliver updates, provide support, honour refunds and meet our tax obligations. Freemius’s own privacy policy covers their side of it.

6. What our plugins do with your data, and your customers’ data

Our plugins run entirely on your own WordPress site. When a pass is generated, the booking or ticket details needed to build it — typically a name, a date and time, a location and a reference — go from your server directly to Apple or Google using your own developer credentials. They do not pass through us at any point, and we never receive them.

The only outbound connections our plugins make to us are a licence check and an update check, which report your site’s address and your licence key so we know the licence is valid and can tell you when a new version is out. No booking data, no customer data.

If you’re using our plugins to serve your own customers, you are the one responsible for those customers’ data, and your own privacy policy is the one that governs it. We’re not a processor of it, because we never hold it.

7. Cookies

If you’re a normal visitor, this site sets no cookies of its own. Our analytics is deliberately the cookieless sort, so counting page views doesn’t change that. If you log in to the WordPress dashboard — which is us, not you — WordPress sets session cookies it needs to keep you logged in.

Pressing play on a demo video is the one thing on this site that can set a cookie, and it is YouTube’s rather than ours. Until you press it, nothing of theirs has loaded. That is also why you won’t see a cookie banner: there is nothing set before you choose, and nothing to consent to if you never do.

8. How long we keep things

Support and contact correspondence stays as long as it’s useful, and we clear out old threads periodically. Purchase and licence records are kept for seven years, because Canadian tax rules require it. Server logs are short-lived. If you ask us to delete something and we’re allowed to, we will.

9. Who else is involved

We keep the list of third parties deliberately short:

• Freemius Inc. – our checkout, payments and licensing. They hold purchase and licence data as merchant of record.
• Cloudflare, Inc. – our website analytics. They process page views on our behalf and, by design, hold nothing that identifies you.
• Google LLC – two separate things. Google Fonts serves the typefaces this site is set in, so every page load sends your IP address and user agent to them. YouTube hosts the demo videos on our product pages; those receive nothing until you press play, and from that point you are on YouTube’s terms rather than ours.
• Our web host – stores this website and its database, including contact and support form entries.
• Our email provider – carries our support correspondence.

Each of these is a service provider handling data on our behalf, under their own privacy terms. We don’t sell your information, we don’t share it for advertising, and we don’t send it anywhere else.

10. Where your data lives

We’re in Canada, and our providers may store or process data in Canada, the United States or the European Union. Where data crosses a border, it stays subject to this policy and to the provider’s own safeguards.

11. Your rights

Under Canada’s PIPEDA and British Columbia’s Personal Information Protection Act, you can ask us what personal information we hold about you, ask us to correct it, and ask us to delete it where we’re not legally required to keep it. If you’re in the UK or EU, the same requests apply under the GDPR, along with the right to object to processing and to receive your data in a portable form.

Email support@bluebrainmedia.ca and say what you want. We’ll respond within 30 days, and usually much sooner. If you’re not satisfied with how we’ve handled a request, you can complain to the Office of the Privacy Commissioner of Canada.

12. Children

Our products are sold to businesses and site owners. We don’t knowingly collect personal information from anyone under 16, and we’ve no reason to.

13. Changes to this policy

If we change what we collect, we’ll update this page and change the date at the top. If a change materially affects existing customers, we’ll email licence holders rather than leave you to notice it.

14. Getting in touch

support@bluebrainmedia.ca — for privacy questions, access requests, deletions, or anything else on this page.