Privacy Policy

Who we are

Bounty Box is run by [TBD: legal name], [TBD: mailing address]. You can write to us at [email protected].

What we collect

What you give us on the form, which only a parent or guardian should complete:

• Your first name and your cell number.
• Whether you are local or visiting, and your ZIP code if you are visiting.
• If you choose to give them: how many kids are in your family, and their age ranges.
• Whether you said yes or no to the restaurant's offers by text, the wording you were shown, and when.
• If you choose to answer them, on the page after the form: what would bring you back to the restaurant, and when you usually visit.

We never ask for a child's name, and we ask for ages only as ranges, like 4 to 6.

What the site records by itself:

• A cookie, bb_session, set by bounty.box and kept for 30 days. It is a label for a visit, not who you are. For three hours after the form is sent at a restaurant, it lets another sheet there from the same browser use the details given on the form, so they are not asked again. And while it lasts, it shows in "View my collection" the cards that browser got with that cell number.
• Once the form is sent, a second cookie, __Host-bb_returning, kept in that browser for 180 days. It holds the first name given and the restaurants where a Bounty was claimed from that browser, and no cell number. The next time there, the form fills in the name and does not ask again how many kids are in your family or their ages.
• A scrambled form of the internet address you visit from (a salted hash), changed every month. We never store the address itself.
• Your browser's name and version (its user agent), kept for 90 days.
• On the pages of the Bounty, a note in your browser's own storage for each step it has told Google Analytics about, so that a step is told once. It holds nothing of you, nor the part of the address that names the sheet. The note of a scan goes when the tab is closed; the others stay until your browser's data for bounty.box is cleared.

What happened on the pages, recorded by our server:

• That a sheet's QR code was scanned, or the page for typing a sheet ID was opened.
• That a code was entered, and whether it was right.
• That a grown-up tapped "I'm the grown-up", the step before the form.
• That the form was sent, which of its optional details were given (not what they said), and whether you said yes to the restaurant's offers.
• That a sheet was entered with the details given on the form for another sheet of the same visit.
• That the questions after the form were answered, and which of them (not the answers).
• Whether the entry got a Golden Ticket or a collectible card.
• Which screen was shown to the grown-ups after the Bounty.
• That the review link was tapped.
• That a collectible card was saved.
• That a limit on how often the pages can be used was reached.
• That we sent you a message.

Each record carries the visit's label, the scrambled internet address, the browser's user agent and, where there is one, the sheet it is about. Once the form is sent, that sheet points to your family.

On the pages of the Bounty (the QR code's pages and the page for typing a sheet ID, not the homepage), we also use Google Tag Manager and Google Analytics to measure how families move through those pages. They get:

• Which step happened: a scan, a code entered and whether it was right, "I'm the grown-up" tapped, the form sent, the chest opened, the screen for the grown-ups shown, a card saved, the review link tapped.
• The restaurant, its name and its id, and the id of the batch the sheet came from.
• The page's address, with the part that names the sheet taken out of it.
• The sheet's state, whether you are local or visiting, how many kids are in your family, whether you said yes to the restaurant's offers, whether the chest held a Golden Ticket or a collectible card and which card, which screen was shown to the grown-ups, which review site the link goes to, and how a card was saved.
• What Google gets with every visit to such a page: your internet address, your browser and device, and an approximate location it works out from them.

They never get your name, your cell number, your ZIP code, your kids' ages, your answers to the two questions, or the code on a sheet.

Google Analytics sets two cookies in your browser on those pages, _ga and one that starts with _ga_, kept for 30 days from your last visit to those pages, to tell one visit from another. They are used only to measure those pages, never for advertising: we turn Google's advertising features off. Google's own privacy policy covers what Google does with what it gets, and Google's opt-out add-on for Google Analytics turns it off in your browser.

Children

The Bounty Box sheet is for kids. This website is for their grown-ups.

Because Bounty Box is made for kids, we ask nothing of a child. Details are asked only on a form for a parent or guardian, after the grown-up the child hands the phone to taps "I'm the grown-up". We never ask for a child's name, and we ask for ages only as ranges.

The two cookies and the scrambled internet address are used only to run the site: to count visits, to remember for 30 minutes that a code was entered, to fill in a first name the same browser gave before, to use the details given on a form for another sheet of the same visit for three hours, to show the cards a browser got, and to stop abuse. They are never used for advertising or to build a profile.

Google Analytics' cookies on the pages of the Bounty are used only to measure how those pages are used: to count each step of the Bounty by restaurant, see where families stop, and fix it. What they gather is never used for advertising, to build a profile of anyone, or to contact anyone, and Google's advertising features are turned off for them.

[TBD: the lawyer to confirm that measuring the pages of the Bounty with Google Analytics fits COPPA's support for internal operations, and the notice it asks for.]

If you think a child has given us personal information, write to [email protected] and we will delete it.

How we use it

• To run the Bounty: check the code, decide and show what the chest holds, show the reward card, and text a Golden Ticket prize.
• To know a family that comes back to the same restaurant, by its cell number.
• On the browser that sent the form, to fill in your first name the next time at that restaurant, and not ask again how many kids are in your family or their ages.
• To count how the pilot is going at each restaurant.
• To measure how families move through the pages of the Bounty, with Google Analytics.
• To stop abuse, like guessing codes.

We text you about a prize whether you said yes or no to the restaurant's offers. Those texts are not marketing.

What the restaurant gets

The restaurant named on your form gets your details only if you said yes to its offers. Then it gets:

• Your first name and cell number.
• Whether you are local or visiting, your ZIP code if you are visiting, how many kids are in your family, and their age ranges.
• Your answers to the two questions after the form, if you gave them: what would bring you back, and when you usually visit.
• The dates of your Bounties at that restaurant, and how many.
• When you said yes, and the wording you were shown.

[TBD: the lawyer to word what a restaurant must do before it texts you, the consent federal law asks for marketing texts and how a text is stopped, and whether a text to your number confirms it is yours first.]

We send these to the restaurant by a private link that expires after 7 days. Once the restaurant has them, its own privacy policy covers what it does with them.

If you said no, the restaurant sees only counts, never your details or your answers.

The reward card on your screen shows the time of your claim and a claim reference, and not your name.

If you write to us about a restaurant

Our homepage has a form for restaurants that want to try Bounty Box. It asks for your name and email, your restaurant and its address, how many restaurants you have, and what you would like to explore, and notes the page of our site you sent it from. We keep what you send to answer you and to follow up about Bounty Box, until it is no longer needed or you ask us to delete it at [email protected].

As you type your restaurant's name or address, Google Maps suggests places. Google gets what you type and your internet address, and Google's own privacy policy covers what Google does with them. We keep the place you picked as Google names it, with Google's id for it, and look up its public details on Google Maps, like its phone number and opening hours, when our team reads your inquiry.

[TBD: the lawyer to confirm this section, and whether the form needs a line of its own pointing to it.]

Service providers

Companies that host and run the site handle your information for us, and only to provide their service: Google Cloud, which hosts the site; Supabase, which keeps the database and files; Resend, which sends our emails; Sentry, which tells us about errors; Google, whose Tag Manager and Analytics measure the pages of the Bounty; and Google Maps, which suggests places on the form for restaurants.

We don't sell your personal information, and we don't share it for cross-context behavioral advertising.

How long we keep it

• Your details: for the pilot and 12 months after it ends. [TBD: if you said yes to a restaurant's offers, until you withdraw it.]
• Your browser's user agent: 90 days.
• Google Analytics' detailed records of the pages of the Bounty: 2 months. The totals its reports are made of, which hold nothing of you: as long as we keep them. Its cookies: 30 days from your last visit to those pages.
• The 30-minute record that this visit entered a sheet's code, which lets it go on to the form: one day.
• The cookie in your browser with your first name: 180 days from the last time the form was sent from that browser.
• The record of what happened on the pages: [TBD: how long it is kept]. Its user agents are cleared after 90 days.
• A winner's details and prize record: as long as the Official Rules say, even if you ask us to delete them.
• What you send on the form for restaurants: until it is no longer needed, or you ask us to delete it.

Counts that no longer point to any family, like how many sheets were scanned, are kept.

Your choices

You can withdraw a yes by writing to [email protected].

Saying no on a later visit to a restaurant withdraws a yes you gave it before.

To stop a restaurant texting you, ask the restaurant. [TBD: whether its texts must stop when you reply STOP.]

To have your browser forget your first name, clear the cookies of bounty.box in its settings.

Your rights and requests

You can ask us:

• What personal information we have about you, and for a copy of it.
• To delete it.
• To correct it.
• Not to sell or share it. We do neither.

These are your rights under California law, and we give them to everyone. We will not treat you differently for asking.

To ask, email [email protected] with the cell number you gave us. [TBD: how we confirm the number is yours, for example by a text to it.] Someone you authorize can ask for you. We answer within 45 days.

When we delete your details, we remove your name, cell number and email, and keep only counts that no longer point to you. A winner's details and prize record are kept as long as the Official Rules say, and deleted then.

A first name kept in a cookie in your browser is out of our reach. Clear the cookies of bounty.box to remove it.

Security

Your information is encrypted when it travels and where it is stored. In our admin, only the Bounty Box team can see it, after signing in. Internet addresses are kept only in scrambled form.

No system is perfectly secure. If a breach affects your information, we will tell you, as the law requires.

Do Not Track and Global Privacy Control

We don't track you across other sites, and we don't sell or share your information, so there is nothing for these signals to turn off. We treat them as a request not to sell or share, which we already honor.

Changes to this policy

We post changes here, with the date at the top. If the wording of the question about the restaurant's offers changes, the form shows you the new wording before you answer again.

Contact

Email [email protected], or write to [TBD: mailing address].