Maben Parks is a theme-park wait-time and planning service operated by Maben Consulting, 2150 Salisbury Ave, Port Coquitlam, BC V3B 0N5, Canada (“we”, “us”) — the controller responsible for the personal information described here. This policy explains what we collect and what we do with it, which is deliberately little. Privacy contact: [email protected].
What we collect
Account data. If you create an account: your email address and a salted, one-way hash of your password. We never store or see your actual password.
Waitlist emails. If you join the waitlist or price-lock list: your email address.
Purchases. If you buy a pass, payment is processed entirely by Stripe — we never see or store your card details. We keep a record of the plan purchased, the Stripe session reference, and (if provided) your email, for support and reconciliation.
Wait-drop alerts. If you set an alert, we store your browser's push-subscription endpoint and your alert settings until the alert fires or you remove it.
Magical fairy chats. Messages you send to your magical fairy are processed to generate a reply (see "Service providers"). We don't build profiles from them.
Reported waits. If you tell us how long you actually waited for a ride, we store that figure, the ride and park, the posted wait at that moment, the hour and date, and which account reported it — the account reference so that one person cannot report the same ride twice in a day, and so we can remove a set of reports if we ever need to. Reports are published only as aggregates: a median across several people at an hour, never your individual figure and never attributed to you. Reporting is entirely optional and dismissing the prompt twice stops it appearing. Reports made while signed in are deleted with your account. Reports made on a pass alone are stored against a one-way hash of that pass and carry no email address, so there is nothing to link back to you — and nothing we could find to delete on request.
Sessions and devices. When you sign in we store a session record: a session id, your email, a short device label, your browser's user-agent string, and when it was created and last used. This powers the five-device limit and "sign out everywhere", and it is what lets you see where your account is signed in.
Your trip and day. If you use the planner while signed in, we store what you told the setup wizard — party size, which age bands are in your group (toddler / kid / teen / adult, never birthdates), the ride types you like, whether you're staying on-site — plus your destination, dates, chosen rides and what you've ticked off. This is what makes the plan yours and lets it follow you between devices.
Magical fairy memory. If you use your magical fairy while signed in, she keeps a short note of what matters for your trip so she doesn't ask the same things every day.
WhatsApp. If you link WhatsApp, we store your phone number, the account it's linked to, and the recent message history of that conversation so the assistant has context. Messages travel through Meta's WhatsApp Business platform, which applies its own terms and privacy policy.
Location. "Find my park" and the you-are-here dot use your device's location, with your permission, entirely inside your browser. Your coordinates are never sent to our server and we never store them.
Usage counts. We count page views in aggregate on our own server (a number per page per day). No tracking cookies, no third-party analytics, no advertising identifiers, no fingerprinting.
The app stores your session, preferences, and favorites in your own browser's local storage; that data stays on your device.
What we never do
We do not sell or rent your data, we do not run ads, and we do not share your information with anyone except the service providers below, to the minimum extent needed to run the product.
Service providers
Railway — hosting infrastructure (our server and database run there).
Anthropic — powers your magical fairy; your chat messages and the current wait data are sent to their API to generate replies (their policy).
Resend — delivers transactional email such as password resets.
Queue-Times.com — the source of wait-time data. Requests for wait data go from our server, not your browser; none of your personal data is sent to them.
Where your data is processed
We are in Canada. The providers listed above process data in Canada, the United States and the European Union depending on the provider. If you are in the EEA or the UK, your information may therefore be transferred outside your country; those transfers rely on the safeguards each provider offers, such as standard contractual clauses.
Your rights
Wherever you live, you can ask to see the personal information we hold about you, correct it, or delete it, and you can withdraw consent for anything you opted into. Account deletion is self-service (below) and needs no request. For anything else, email [email protected] and we'll respond within 30 days. If you're in the EEA or UK you may also complain to your local data-protection authority; in Canada, to the Office of the Privacy Commissioner.
Retention & deletion
Account and purchase records are kept while your account exists. Fired or cancelled alerts are deleted immediately.
You can delete your account at any time, yourself: in the app under 👤 Account, or on the delete your account page if you no longer have the app installed. Deleting signs you out everywhere and starts a 7-day grace period, during which a cancellation link (emailed to you) or simply logging back in restores the account. After 7 days your trips, plans, advisor conversations, reported waits, alerts and sessions are erased and cannot be recovered.
Two things survive deletion in de-identified form, with your email address stripped so they no longer point at you: records of purchases, which we keep for accounting and tax obligations, and thumbs-up/down ratings on advisor replies, which we keep as product feedback. To request a copy of the data we hold about you, email us — we'll act within 30 days.
Children
Maben Parks is a trip-planning tool intended for adults, and our Terms set a minimum age of 16 to hold an account. We do not knowingly collect personal information from children. A plan can describe a family that includes children, but we ask only for age bands — never a child's name, birthdate or photograph. If you believe a child has given us personal information, email us and we'll delete it.
Changes
If this policy changes materially, we'll note the new effective date here.