Privacy
ThrillPass is built to need as little about you as possible.
What we store
- Your e-mail address — the only way to sign you in, and the only thing that identifies you.
- Your coasters — which are on your bucket list and which you have stamped, plus an optional ride date.
- Your passkeys — public key material only. The private key never leaves your device, and we could not use it even if we had it.
What we deliberately do not ask for
No name, date of birth, gender, home address, phone number, GPS or location history, contacts, social graph, advertising ID, behavioural profile or device fingerprint. V1 does not need any of it, so it is never collected — not hidden behind a setting, simply absent.
Tracking
There is none. No analytics, no Meta Pixel, no Google Analytics, no advertising or third-party tracking scripts. Fonts are served by ThrillPass itself, so loading a page does not tell anyone else that you did.
Cookies and browser storage
| What | Why |
|---|---|
| Supabase auth cookies | Keep you signed in. Strictly necessary — without them there is no account. HttpOnly and Secure in production. |
tp:pending-action (session storage) | Remembers the one button you pressed before signing in, so it still happens afterwards. Cleared immediately on use, and when the tab closes. |
Both are strictly necessary for something you asked for, so there is no consent banner: showing one would imply a choice that does not exist. Nothing here is used for tracking, profiling or advertising.
Your data, your call
From your Passport you can download everything we hold about you as a JSON file, or delete your account. The deletion is real: your account, stamps, bucket list and passkeys are removed from the database, not flagged as hidden.
How long we keep it
Your account and coaster data are kept until you delete them. Sign-in rate-limit counters are keyed on a one-way hash of your address, never the address itself, and are discarded once you sign in. WebAuthn challenges live for five minutes and are single-use.
Ticket links
“Book tickets” sends you to the park's own site and may be an affiliate link. Those relationships never influence the Top 50 or its ranking, which is editorial.
Contact
For any question about your data, or to exercise a right the buttons in your Passport do not cover, contact the site owner.