RootPass Scan Privacy Policy

1. Data controller

RootPass ("we") is the controller responsible for processing the data handled by this app. For questions about this policy, contact: newbiz@rootpass.xyz.

2. Who the app is for

RootPass Scan is not intended for the general public: it is used exclusively by operators authorized by each event's organizer, with credentials assigned in advance (event, device ID and password).

3. Data the app processes

3.1 Operator device data

• Access credentials (event slug, device ID, password): sent to the RootPass server to authenticate the device and stored securely on the device (the operating system's Secure Store / Keystore) to keep the session signed in.
• Device identifier and model: logged along with accreditation activity so the event organizer can track which device performed each operation.

3.2 Attendee data

In order to validate tickets, the app downloads and stores locally (and syncs with the server) the following attendee data, provided by the event organizer through the RootPass platform:

• First and last name
• Email
• Ticket type, purchase date and usage status
• QR code associated with the ticket

This data is used exclusively to validate entry to the event (verifying that a ticket is valid, was not previously used, and recording when and with which device it was used) and, when requested by the operator, for manual attendee lookup and identity verification via a code sent by email.

3.3 Camera

The app uses the device camera exclusively to read QR codes in real time. Camera images are never saved or sent to any server; only the content of the detected QR code is processed.

3.4 Technical data

The app records connectivity status (online/offline) and a local log of operations pending synchronization, so it can keep working offline and send that information to the server once the connection is restored.

4. Who data is shared with

Data is shared only with the RootPass server (api.rootpass.xyz), operated by RootPass, in order to sync ticket status across all accreditation devices for the same event. Data is not shared with third parties unrelated to the event's operation, nor is it used for advertising purposes.

5. Storage and security

• Device credentials are stored encrypted using the operating system's secure mechanisms (Secure Store).
• Attendee data is stored locally on the device (SQLite database) to allow ticket validation offline, and is periodically synced with the server.
• Access to this data is restricted to operators authorized by the event organizer.

6. Data retention

Attendee data is kept on the device for as long as the operator's session remains active for that event, and is deleted or replaced when syncing with a different event or signing out. Data retention on RootPass's servers is governed by the agreement between RootPass and each event's organizer.

7. Permissions used by the app

8. Data subject rights

Attendees whose data is processed by this app can exercise their rights of access, rectification or deletion by contacting the relevant event organizer directly, or RootPass at newbiz@rootpass.xyz.

9. Changes to this policy

This policy may be updated to reflect changes to the app or to applicable regulations. The date of the last update appears at the top of this document.