Privacy Policy
Effective October 17, 2026 · Version 2026-10-17
This policy describes how Leviathan Light and Magic, LLC operates Broadway Pirate Tix at broadwaypiratetix.com. We are an independent service, not SLFS. Contact support@broadwaypiratetix.com for privacy questions or requests.
Information we process
Public browsing retrieves showtimes and film information. Our hosting and security providers process technical information such as IP address, request time, URL, browser information, and security signals to deliver the site and prevent abuse.
If you connect your SLFS account, we process your phone number and one-time code, the upstream session token, account identifier, basic account details, saved-card identifiers and masked card details, billing ZIP when needed to determine tax, membership benefits, loyalty points, and purchase history. A verification code is forwarded for validation and is not stored in our application database. We do not collect full card numbers or card security codes.
For orders, we process the selected screening and ticket types, quoted total, benefits, saved-card reference, payment and purchase references, status, and ticket information returned by the provider. We record the Terms version and time accepted with your account connection. If you email support, we receive the information you include.
Why we use it and who receives it
We use this information to connect your account at your request, display benefits and purchases, submit orders you confirm, prevent duplicate charges, investigate failed transactions, respond to support requests, and prevent abuse. We do not sell your personal information or use it for targeted advertising.
- SLFS / Arthouse+: receives phone authentication requests and account or purchase actions you request, and supplies your ticketing information.
- Stripe: processes payment verification when required by SLFS’s payment flow. It may receive device, transaction, and fraud-prevention information directly through its embedded tools.
- Cloudflare: hosts the site and encrypted application state, provides DNS and network security, and runs Turnstile to detect abuse. See the Turnstile Privacy Addendum.
- Google: serves the site’s web fonts and receives normal request metadata when your browser requests them. Support messages are forwarded through Cloudflare to an inbox hosted by Google.
Providers operate under their own applicable policies and may process information in the United States and other countries. We may also disclose information where required by law, to protect rights and security, or in connection with a lawful business transfer.
Storage and retention
Your browser holds a secure, HttpOnly session cookie; the SLFS session token stays encrypted on our server. The connection expires after seven days, or earlier when you disconnect this browser. Login challenges expire after ten minutes and quotes after five minutes. Expired database entries are cleaned up by an hourly task.
Abuse counters use hashed identifiers and expire within 24 hours. Completed order records are retained for 30 days. Minimal duplicate-prevention references remain longer, and unresolved payment records are retained until the outcome can be reconciled; this helps avoid charging you twice. Provider security logs and support correspondence follow their applicable retention settings and may remain longer for security, dispute resolution, or legal obligations. SLFS and its payment providers retain their own account and transaction records independently.
Browser storage may contain a recent order reference or a pending quote reference to help recover from an interrupted checkout. It does not contain your SLFS session token or card number. We do not add advertising analytics or advertising cookies.
Operational diagnostics record random request and order references, checkout stages, response status, timing, and fixed error categories to troubleshoot failed or interrupted purchases. Application logs exclude phone numbers, email addresses, one-time codes, session tokens, card details, Stripe client secrets, ticket codes, and request or response bodies.
Your choices
You can browse without connecting, use SLFS directly, disconnect your browser, and clear local site data. Email support to request access, correction, or deletion of information we retain, or to exercise privacy rights available under applicable law. We may need to verify your request using information proportionate to its sensitivity; never send a password, one-time code, or full card number by email. We may retain limited records where necessary for security, unresolved transactions, or legal obligations. Account changes, saved-card changes, SLFS purchase records, and refunds must be handled through SLFS.
The connected-account service is intended for adults, and we do not knowingly collect account information from children under 13. If you believe a child has provided such information, contact us.
Updates
We will post revisions here with an updated effective date and provide additional notice where a material change or applicable law requires it.