Draft — not yet published. Three things need filling in before this goes live, each marked LIKE THIS below: the legal entity that runs the service, a contact address, and the governing state. Everything else reflects what the software actually does today, which I verified against the code rather than writing from a template.

Privacy Policy

Last updated: DATE

This policy covers the event tracking service operated by LEGAL ENTITY NAME ("we", "us"), including every event hosted on it.

The short version What we collect Location Why How long we keep it Who else sees it Your choices Children Security Contact

The short version

You can watch an event without an account and without telling us anything that identifies you. An account is only needed to follow a participant, vote, collect scavenger-hunt stops, or run an entry in an event.

We do not track spectators' locations. Location is only ever collected from a participant who has switched sharing on for their own entry, and only while the event is running. We do not sell personal information, and we do not use it for advertising.

What we collect

What	From whom	Why
Email address and a name	Anyone who creates an account	To sign you in and to show your entry's name on the event
A password, stored only as a one-way hash	Anyone with an account	To sign you in. We never store or see the password itself
Entry details: name, organization, description, photo, links, category	Organizers and participants	This is the public listing for the event
Contact email on a lineup row	Uploaded by the organizer	So the organizer can send that participant their invite link. Never shown publicly
Check-ins and positions	Participants during an event	To show the live map and arrival times
Follows, votes, hunt progress	Account holders	To send you alerts, count a vote once, and track your own progress
Push notification subscription	Anyone who enables alerts	To send the alert you asked for. Removed when you turn alerts off
Failed sign-in counts by email address	Automatic	To stop password guessing. Deleted automatically once lapsed

We do not use advertising trackers or third-party analytics. The site stores a sign-in cookie, and remembers your chosen screen style in your own browser.

Location, specifically

This is the part worth reading twice, because it is the part people worry about.

Spectators: we never collect your location. The live map shows participants, not you. If you ask the market page to plan a walking route, your browser may ask for your location to pick a starting point — that is used in your browser for that calculation and is not sent to us or stored.
Participants: location sharing is off by default and switched on by you, per entry, with a button you can switch off at any time. While it is on, your device sends its position so spectators can see where your entry is.
We keep positions only for the event they belong to, and delete them on the schedule below. We do not build a history of where you have been, and we do not use location for anything other than showing the event.

Why we are allowed to hold it

We hold this information to provide a service you or your organizer asked us to provide. For participants, that is the agreement to appear in the event. For account holders, it is to give you the features you signed up for. Where the law in your area requires consent — for location and for push notifications — we ask for it, your device asks again, and you can withdraw it at any time by switching the feature off.

How long we keep it

These are the retention periods we recommend and operate to. They are deliberately short for the sensitive things and longer for the things an organizer needs next year.

Data	Kept for	Why that long
Location points and check-ins	7 days after the event ends	Long enough to settle a dispute about the day, short enough that no movement history accumulates. This is the one we would shorten before any other.
Event listings, entries, photos and results	Until the organizer deletes the event	Chambers reuse last year's lineup to build this year's
Votes and hunt progress	Deleted with the event	Only meaningful for the event they belong to
Accounts (email, name, password hash)	Until you ask us to delete it	So the same login works for next year's event
Push notification subscriptions	Until you turn alerts off or the device unsubscribes	It is the only way to send the alert
Failed sign-in records	30 minutes	Swept automatically; they exist only to slow down guessing
Backups	30 days, rolling	Point-in-time restore. Deleted data disappears from backups as they roll off

The public sees what an event is for: entry names, organizations, descriptions, photos, categories, positions during the event, and vote totals. It never sees email addresses, invite codes, scavenger-hunt codes, private notes between an organizer and their participants, or who voted for whom.
Your organizer — the chamber or group running the event you are in — sees your entry's details and the contact email on your lineup row. An organizer sees only their own events. They cannot see another organizer's participants, and they never see your password.
We can see everything stored, because somebody has to be able to fix a broken event. We look only when operating or supporting the service.
Service providers. Hosting and the database are provided by Cloudflare, and map imagery by MapTiler. Map tiles are fetched by your browser, so the map provider sees the requests your browser makes. We do not send either of them your personal information for their own use.
Nobody else. We do not sell personal information, we do not share it with advertisers or data brokers, and we do not use it to train anything. We would disclose information if required by law, and would tell the person affected unless prohibited.

Your choices

Stop sharing location: switch it off on your participant page. Immediate.
Stop alerts: turn them off in the app or in your browser's site settings.
See or correct your details: your name and the details of your entry are editable on your participant page. For anything else, ask us.
Delete your account: ask us and we will delete it, and the data tied to it, within 30 days. Your entry's public listing belongs to the event, so your organizer decides whether that row stays in their lineup.
Get a copy: ask us and we will send you what we hold about you.
Depending on where you live you may have further rights — for example under the California Consumer Privacy Act or the UK and EU GDPR. We apply the choices above to everyone, wherever they are, rather than operating a different standard by region.

Children

Events like these involve children — school bands, scout troops, dance schools. We do not knowingly create accounts for children under 13. Where a child appears in an event, their entry is registered and run by an adult organizer or group leader, who is responsible for what they publish about the people in their group. If you believe a child under 13 has created an account, tell us and we will delete it.

How it is protected

Passwords are stored only as salted one-way hashes and can never be read back, by us or by anyone else. Sign-in sessions use signed, HTTP-only cookies. Repeated failed sign-ins lock an account's login attempts temporarily. Traffic is encrypted in transit. Access between organizers is separated, so one organizer's account cannot reach another's event data. No system is perfectly secure, and we will tell affected people promptly if a breach puts their information at risk.

Contact

Questions, corrections or deletion requests: CONTACT EMAIL, or write to POSTAL ADDRESS.

If we change this policy in a way that matters, we will update the date at the top and say what changed on this page.