Privacy Policy

1. Information We Collect

We collect information in the following categories:

Information You Provide:

• Account data: Name, email address, and password (stored as a bcrypt hash — we cannot see your password) when you create an account.
• Payment data: Billing address and payment card information, processed securely by Stripe. We never store your full card number on our servers.
• Communications: Any emails or messages you send to us.

Information Collected Automatically:

• IP address: Collected by our servers, Sentry (error monitoring), and Cloudflare (CDN/security).
• Browser and device information: Browser type, operating system, device type, screen resolution — collected by Sentry and Cloudflare.
• Usage data: Pages visited, features used, timestamps, and referring URLs.
• Error data: When errors occur, Sentry collects technical details including error messages, stack traces, and session context to help us fix issues.
• Subscription and purchase history: Stored in our database and processed by Stripe.

Information Stored Locally:

• Saved hunts and preferences: Stored in your browser's localStorage. This data stays on your device unless you use a feature that explicitly syncs it to your account.

2. How We Use Your Information

• Provide, maintain, and improve the Service
• Process payments and manage subscriptions
• Send transactional emails (account confirmations, password resets, subscription receipts)
• Monitor and fix errors and performance issues
• Protect against fraud, abuse, and security threats
• Comply with legal obligations
• Communicate with you about changes to the Service or these policies

We do not use your personal information for advertising or sell it to third parties.

3. Cookies and Similar Technologies

TagMath uses the following cookies:

Essential Cookies (required for the Service to function):

• Session cookies: Set by our authentication system (NextAuth) to keep you logged in. Expire when you close your browser or after your session ends.
• Security cookies: Set by Cloudflare (e.g., __cf_bm) to protect against bots and malicious traffic.

We do not use advertising, marketing, or third-party tracking cookies. We do not use social media pixels or tracking beacons.

You can control cookies through your browser settings, but disabling essential cookies may prevent you from using the Service.

4. Third-Party Service Providers

We use the following third-party services to operate TagMath. These providers process data as necessary to provide their services and are bound by their own privacy policies.

We do not sell your personal information to any third party.

5. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information. We may share your data only in the following circumstances:

• Service providers: With the third-party providers listed above, solely to operate the Service.
• Legal requirements: When required by law, subpoena, court order, or government request.
• Safety: To protect the rights, property, or safety of TagMath, our users, or the public.
• Business transfers: In connection with a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before your data becomes subject to a different privacy policy.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. Specifically:

• Account data: Retained until you request deletion.
• Payment records: Retained for 7 years per tax and accounting requirements.
• Error logs (Sentry): Automatically deleted after 90 days.
• Analytics data: Aggregated and anonymized; retained indefinitely.
• Email records (Resend): Retained for 30 days after delivery.

After account deletion, we may retain anonymized, aggregated data that cannot identify you.

7. Data Security

We implement industry-standard security measures to protect your data:

• All data transmitted via HTTPS/TLS encryption
• Passwords are hashed using bcrypt (we cannot see your password)
• Payment data is processed by Stripe (PCI-DSS Level 1 certified) and never stored on our servers
• Access to user data is restricted to authorized personnel

No system is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

8. Your Rights and Choices

You have the right to:

• Access your data: Request a copy of the personal information we hold about you.
• Correct your data: Update inaccurate or incomplete information.
• Delete your account: Email admin@tagmath.com to request account deletion. We will delete your account within 30 days of a verified request. Deletion includes all personal data except records we are legally required to retain (e.g., transaction records for tax purposes).
• Clear local data: Clear your browser data at any time to remove all locally-stored preferences and saved hunts.
• Export your data: Export your saved hunts from the dashboard.

9. Your California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know what personal information we collect and how it is used
• Request deletion of your personal information
• Opt out of the sale of personal information (we do not sell your data)
• Non-discrimination for exercising your privacy rights

To exercise these rights, email admin@tagmath.com. We will respond within 45 days.

Categories of personal information collected in the prior 12 months:

• Identifiers (name, email address, IP address)
• Commercial information (purchase history, subscription status)
• Internet/electronic activity (pages visited, features used, error logs)

We do not sell personal information. We do not use or disclose sensitive personal information for purposes other than those permitted by the CCPA.

10. Children's Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at admin@tagmath.com, and we will delete that information promptly.

11. International Users

TagMath is operated from the United States and intended for users in the United States. If you access the Service from outside the United States, you consent to the transfer of your data to the United States. If you are located in the European Economic Area (EEA) or United Kingdom, you may have additional rights under the GDPR, including the right to access, rectify, or erase your personal data. Contact admin@tagmath.com to exercise these rights.

12. Data Breach Notification

In the event of a data breach that compromises your personal information, we will notify affected users by email within 30 days of confirming the breach, consistent with applicable law. We will also notify relevant regulatory authorities as required.

13. Do Not Track

We do not currently respond to Do Not Track (DNT) browser signals. We do not engage in cross-site tracking.

14. Data Sources

All draw odds data comes from publicly available Colorado Parks & Wildlife (CPW) reports and other state wildlife agency publications. We do not access any private hunter data, license databases, or personal application records.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or prominent notice on the Service at least 30 days before changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy. The “Last updated” date at the top reflects the most recent revision.

16. Contact

Questions about this Privacy Policy? Email us at admin@tagmath.com.