Privacy Policy

Who we are

Bulletin Bored is a US-based service operated from Illinois, and still new. Our boards, and the data behind them, are hosted in the United States. This policy covers Bulletin Bored everywhere it runs — bulletinbored.io and our mobile app. When this policy says "we" or "us," it means Bulletin Bored.

What we collect

Account and profile. When you sign up we collect your name, email address, and either a password (stored hashed by our authentication provider — we never see it in plain text) or your Google or Apple sign-in. Your profile also holds your home city, whether you opted into marketing email, and, if you add them, an avatar photo and a phone number. Business accounts additionally have a business name, logo, bio, and the contact details you choose to publish on your business page.

Content you post. Event notes (title, description, date and time, venue and address, images and flyers, itineraries, bring lists, pricing details, and any payment handles you type in), post-event recaps and reviews, photos, community posts, messages you send in event chats and direct messages, and feedback you send us through the footer forms (along with the reply-to email you provide).

Tips. The tip jar is peer-to-peer: if you want to receive tips you can list your Venmo username, Cash App cashtag, or the email address or phone number you use with Zelle. We store exactly the handles you list and show them only on public events with the jar switched on, to people viewing that event. Tips themselves are paid inside those apps — we don't see, process, or record them, and your card or bank details never come to us.

Guest emails. Hosts can invite people to private events (and cohosts to any event) by email address. We use that address only to deliver the invitation, connect it to an account registered under the same email, and record the RSVP. Guest emails are visible only to the event's host — never to other guests or the public.

Usage analytics. When a note is shown or opened, or its ticket link or "going" button is clicked, we log an event with the note, the board it appeared on, and a viewer id: your profile id if you're signed in, or the anonymous bb_anon cookie id if you're not. These logs power the aggregate view counts promoters see, the "hot" badge, and event recommendations, and the mobile app records the same open/impression events. Raw event rows are deleted after about a week; only per-note hourly totals are kept longer (see Retention below). We also use privacy-respecting product analytics (pages viewed, features used) to understand what's working — served through our own domain, with profiles only for signed-in users.

Push notifications. If you enable notifications in the mobile app, we store your device's push token so we can deliver them; it's removed when you sign out. Which notifications you get is controlled by your toggles in Settings → Notifications.

Device and log data. Like most services, our hosting infrastructure keeps standard server logs (IP address, browser type, pages requested) for security, rate-limiting, and debugging, and when something crashes or errors we capture a technical report (what went wrong, on what kind of device) so we can fix it.

How we use it

• Running the boards — placing your notes on the city boards you chose, ordering the rails, picking the hourly featured note, and showing accurate view and RSVP counts.
• Promoter stats — event owners see aggregate counts of impressions, opens, ticket clicks, and RSVPs for their own notes. They never see who the individual viewers were.
• Recommendations — a simple points system uses your recent opens, clicks, and RSVPs (last 90 days), plus the tags and promoters you follow, to suggest events you might like. There's no advertising profile — it never leaves the service.
• Emails you control — invitations and cohost requests, RSVP confirmations, note milestones ("your note is live," post-event summaries), and optional digests. Notification emails respect your per-type toggles and quiet hours in Settings → Notifications; transactional emails (invites, sign-in codes, password resets) are sent when the action calls for them.
• Marketing email, only if you asked — the "email me tips and local-event updates" checkbox at signup is off by default. If you tick it we may send occasional product news and local-event tips; every one has an unsubscribe link, and you can change your mind anytime in Settings → Notifications.
• Tips — showing the handles you listed to people who want to tip you, and pausing tipping on accounts that misuse it.
• Safety and moderation — note text is automatically scanned when you post, links are checked, and our admins can review and remove content that breaks the Terms & Conditions.
• Account security — optional two-factor login codes, remembering trusted devices, and the encrypted account switcher.

We do not sell your personal information, and we don't use it for third-party advertising.

Cookies

We only set first-party cookies — no advertising or cross-site tracking cookies. (The mobile app doesn't use cookies at all; it keeps your session in the device's secure Keychain.)

Services we rely on

A handful of providers process data on our behalf, under their own security commitments:

• Supabase — database, authentication, and file storage (hosted in the US).
• Vercel — application hosting and server logs.
• Resend — delivers the emails we send you.
• RevenueCat and Stripe — billing for paid plans and Promo Token packs bought on the web, once they're for sale. Card numbers go to them directly and stay there.
• Mux — hosts and processes the video flyers hosts upload (a short clip on an event). The clip itself goes to Mux directly; Mux encodes it, runs an automated content check on sampled frames, and serves it to everyone who views the event. We keep only the clip's playback id, length, and status.
• Venmo, Cash App, and Zelle — where tips are actually paid. Tapping a tip button opens their app or site; what happens there is governed by their privacy policies, not ours.
• Mapbox — map tiles and address search. When you use a map or look up a venue, your request ( including your IP address) is processed by Mapbox; we don't store your device location.
• PostHog — product analytics (which pages and features get used), served through our own domain.
• Sentry — error and crash reporting, so we find out when something breaks.
• Klaviyo — sends the marketing emails you opted into (and records your subscribe/unsubscribe status).
• Google — only if you choose "Continue with Google" to sign in.
• Apple — only if you use Sign in with Apple, plus Apple's push-notification service for the app's notifications.

One more, about businesses rather than users: if we reach out to a business about joining Bulletin Bored, we use its publicly listed contact info and send through Instantly, an outreach tool. Creating an account takes you off those lists.

Who can see what

• Public events are visible to everyone, including signed-out visitors.
• Private events — the event page, guest list, chat, and bring lists — are visible only to the host and invited guests. Guest email addresses are visible only to the host.
• Public events show their host. Business accounts post under their business name and logo; personal accounts post under their public board identity — the display name, photo, and tagline you set for your board. Your email, phone number, and home city are never shown to other users.
• Friend activity — whether friends can see that you're going to events is controlled by your activity-sharing setting; set it to "Nobody" and your RSVPs are never surfaced to others or used for their recommendations.
• Direct messages are visible only to you and the person you're messaging. Event chats are visible to that event's members (the host, co-hosts, and attendees).
• Community posts are public, under the same name your account posts events with.
• Tip handles show only on events where you've switched the tip jar on. Tips themselves happen in Venmo, Cash App, or Zelle — what those apps show the recipient is up to them.
• Recap photos shared by guests appear publicly only after the host approves them.

Retention and deletion

You can delete your account yourself at any time in Settings → Security. Deletion is immediate: after re-confirming with your password (or an emailed code for Google-only accounts), your profile, notes, messages, and uploaded files are removed.

Raw analytics events are deleted after about seven days and rolled up into hourly per-note totals — counts with no viewer ids attached — which we keep so promoters' historical stats stay accurate. Feedback you email us lives in our support inbox for as long as we need it to help you. One exception to immediate deletion: records of purchases (plans and Promo Tokens), and of any tips that went through our earlier card-based tip jar, are kept as long as payment and tax rules require, even after an account is deleted.

Children

Bulletin Bored is not directed at children under 13, and you must be at least 13 to use it. If you believe a child under 13 has created an account, contact us and we'll remove it.

Your choices

• Turn each notification type on or off — and set quiet hours — in Settings → Notifications. Marketing email has its own toggle there, and every marketing email carries an unsubscribe link. In the app, push notifications also respect your device's notification settings.
• Control who sees your event activity in Settings → Friends.
• Block another user anytime — their messages and content stop reaching you (manage blocks in Settings → Security).
• Edit or delete your notes, recaps, and photos anytime.
• Delete your account in Settings → Security (immediate, no waiting period).
• Block or clear cookies in your browser — signed-out browsing works without the bb_anon cookie; you just may be counted more than once in view totals.
• Ask us anything about your data at support@bulletinbored.io.

Changes to this policy

We're still early, so this policy will evolve with the product. When we make meaningful changes we'll update the date at the top and, for significant changes, let you know in the app or by email. Continuing to use Bulletin Bored after a change means you accept the updated policy.

Contact

Questions, requests, or concerns: support@bulletinbored.io. Ideas for the product are always welcome at suggestions@bulletinbored.io.