This policy explains what personal data Bounty Board Company, a Delaware corporation (“Bounty Board,” “we”), collects when you use bountyboard.gg, the Arcade, and our other services, why we collect it, who we share it with, and the choices you have. It applies to studios, creators, players, and visitors. Our Terms of Service explain the rules for using Bounty Board.
Your privacy choices
Advertising partners
Sharing browsing data with advertising partners can count as “selling” or “sharing” personal information under some U.S. state laws. You can opt out here. In the EU, UK, and Switzerland these partners stay off unless you allow them. A Global Privacy Control signal from your browser is treated as an opt out.
BB Analytics
With your permission, BB Analytics, powered by PostHog, helps us understand feature usage and improve Bounty Board. This includes page paths, actions, account role, onboarding status, and an account identifier. We connect selected account and activity records to understand outcomes such as applications, completed work, and recorded playtime.
When you arrive through a tagged link from one of our ads or emails, BB Analytics also records the source, campaign, ad set, ad, and placement named in that link, and connects them to your Arcade play sessions. This tells us which campaigns bring players who stay. The tags are kept in your browser tab and dropped after 30 minutes without activity. BB Analytics never reads ad click identifiers such as gclid or fbclid.
Some public browsing sessions may be recorded with text and inputs masked. Authentication, private workspaces, messaging, payments, and admin pages are excluded from recordings. We do not include private messages, pitches, payment credentials, or submitted content in this analytics dataset. Use Profile → Actions → BB Analytics, or the controls below, to decline or withdraw permission. Browser tracking respects Global Privacy Control and Do Not Track.
Other choices
- Google ad personalization: use Google's ad settings or the Digital Advertising Alliance opt out. Opting out does not remove ads.
- Email: every announcement email has an unsubscribe link.
- Connected accounts: disconnect YouTube, Twitch, Instagram, or TikTok from your profile settings, or revoke access from the platform itself.
- Deleting your account, or any other request: email admin@bountyboard.gg.
What we collect
Information you give us
- Account details: email address, password (stored by our sign-in provider, never in plain text), display name, role, and your age range (13 to 17, or 18 and over). We do not keep your exact age or birth date.
- Profile details: bio, images, social links, skills, and answers to our onboarding questions. Creators can add audience details such as audience age range, region, language, and genres.
- Campaign activity: applications, pitches, submitted work and links, campaign chat messages, ratings, and game keys delivered to you.
- Payout and tax details: Stripe collects your bank and identity details directly; we keep your Stripe account ID, status, and country. If you use PayPal we keep your PayPal email, and once PayPal payouts pass the yearly tax line (or for Arcade payouts) your legal name, business name, entity type, tax residence country, and street address. We do not store tax ID numbers or tax forms.
- Arcade content: games and listings studios publish, build room posts and prompts, likes, and ratings.
- Messages you send us, and your email if you sign up for announcements.
Connected accounts and submitted links
If you connect YouTube, we read your channel ID, title, handle, thumbnail, subscriber, view, and video counts, your list of uploads, and analytics for your channel (views, watch time, average view duration, and subscribers gained and lost), using read-only access. If you connect Twitch, we read your follower count. If you connect Instagram, we read your basic business account profile, your list of posts (to confirm a submitted post is yours), and the views, likes, and comments on posts you submit to campaigns, to pay posts that earn on views and to show view counts on your profile (never like counts, which you can hide on Instagram). If you connect TikTok, we read your TikTok account ID for Bounty Board, display name, username, and profile picture, and, for each video you submit, whether it is yours and its views, likes, and comments, to pay posts that earn on views and to show view and like counts on your profile. We never post, edit, or delete anything on TikTok. Access tokens are stored encrypted.
When you submit a link to a video or post, we fetch its public preview from the platform that hosts it (YouTube, Twitch, TikTok, Instagram, Facebook, or X) and, for YouTube and Twitch, its public view and like counts, to measure and pay the work. For Instagram and TikTok, the views, likes, and comments come through your connected account.
If you remove Bounty Board from your Instagram settings, or ask Meta to delete the data apps hold about you, Instagram tells us and we delete your stored Instagram connection right away: your account IDs, username, account type, profile picture link, and access token. The Instagram link on your profile stays but is no longer marked verified. Links you already submitted for paid work are kept as the record of that work. Questions about a request: email admin@bountyboard.gg.
If you remove Bounty Board from your TikTok settings, or your TikTok account is deleted, TikTok tells us and we delete your stored TikTok connection right away: your account IDs, username, display name, profile picture link, and access tokens. Disconnecting TikTok from your profile deletes the same data and revokes our access at TikTok. The TikTok link on your profile stays but is no longer marked verified. Links you already submitted for paid work are kept as the record of that work.
Connected agents
If you connect an AI agent or other software through our MCP server or the Arcade publishing tools, we keep the connection's name, the permissions you gave it, when it was created, when it expires or was revoked, and the name and return address the agent's application registered with us. For changes an agent makes for you, we keep a fingerprint of each request and its result, so a retried request is never carried out twice. We store access tokens only as one-way hashes. We do not receive your conversations with the agent, only the requests it sends us.
Information collected automatically
- Arcade play: a random player ID stored in a cookie (for players without an account), the games you play, for how long, and where you came from. Signed-in players also have scores, saves, and multiplayer results.
- Device and usage data: pages visited, browser and device type, and the referring page. Our hosting providers process your IP address to deliver the site; we store IP addresses only in hashed form, to limit abuse.
- Data from cookies and similar tools, described below.
How we use it
- To run your account, campaigns, competitions, and the Arcade.
- To carry out requests from AI agents you connect, within the permissions you gave them.
- To process payments, payouts, refunds, and tax reporting.
- To measure views and results for payouts and rankings.
- To match creators and studios, and to show creators campaigns that fit them.
- To keep the Platform safe, prevent fraud and cheating, and enforce our Terms.
- To send account, transaction, and (if you allow them) announcement emails.
- To understand and improve Bounty Board, with your permission where required.
- To show ads in the Arcade and measure our own advertising.
- To comply with the law and respond to lawful requests.
Automated decisions
Some things happen automatically, on fixed rules: applications a studio does not answer within 7 days expire; unused task claims expire; work a studio does not review within 14 days on a funded campaign is accepted and paid; unreviewed work on other campaigns expires; view based payouts and competition rankings are calculated from measured views; and Arcade scores that fail our checks are rejected. If you think one of these affected you wrongly, email admin@bountyboard.gg and a person will review it.
AI tools
When our Arcade review assistant is on, the files and listing of a submitted game are sent to Anthropic's Claude to help our staff check it. The assistant only advises; staff make every review decision.
Who we share it with
Service providers
These companies process personal data for us, under their own privacy terms:
| Supabase | Database, sign-in, file storage, and realtime features |
|---|---|
| Vercel | Hosting, scheduled jobs, and cookieless page analytics |
| Cloudflare | Arcade multiplayer servers |
| Stripe | Payments, payouts, identity checks, and subscriptions |
| PayPal | Campaign payouts, if you choose PayPal |
| Resend | Sending email |
| PostHog | BB Analytics, only with your permission, plus a copy of selected account and activity records for analysis |
| Google sign-in, Google Analytics, AdSense ads in the Arcade, and the YouTube API | |
| Meta | The Meta Pixel on Arcade pages, which measures visits and game starts for our ads |
| AppLovin | A measurement pixel that records page views and signups for our ads |
| Anthropic | An AI assistant that helps our staff review Arcade games (the game files and listing are sent to it) |
| GitHub | Runs the Arcade review assistant |
| Discord | Public announcements of new campaigns and games, and staff notices about game reviews |
| Twitch, Instagram, TikTok, and X | Account data you connect, and public previews and stats for links you submit |
| Spotify | The embedded music player in the Arcade, when you use it |
Other users and the public
Creator and studio profiles are public on Bounty Board, including name, bio, images, social links, skills, and public work. Public profile information may be crawled, indexed, cached, and displayed by search engines, including Google, and updates or removals may take time to appear there. Player cards, leaderboard names, and multiplayer and build room display names are visible to other players. Studios see the applications, pitches, and work sent to their campaigns, and creators see the studio's campaign details.
AI agents you connect
When you connect an AI agent, we send it what its requests ask for, limited to the permissions you gave it and to what your account can see on Bounty Board: for a studio, your games, builds, Arcade review notes, and campaigns; for a creator, open campaigns and your own applications, work, deadlines, and earnings. We never send game keys or payment account details to an agent. The agent's provider, such as Anthropic, OpenAI, or Cursor, receives that data at your direction and handles it under its own privacy policy, not this one. You can see and revoke every connection on the Connected agents page.
Our staff
Authorized staff can read campaign chats and Arcade review threads when needed for support, safety, and disputes. Notification emails about your account, campaigns, and games are copied to one staff inbox for monitoring. Operational alerts are sent only to designated staff.
Legal and business reasons
We share data when the law requires it, to protect people or the Platform, and as part of a merger, acquisition, or sale of assets, under this policy.
Selling and sharing
We do not sell personal data for money. Letting Google, Meta, and AppLovin measure visits can count as selling or sharing for targeted advertising under some state laws; you can opt out under Your privacy choices. We do not knowingly sell or share the personal data of anyone under 16: for accounts in the 13 to 17 age range, advertising partners stay off unless the account holder turns them on, and Arcade ads are not personalized.
Cookies and similar tools
| Name | What it does | Type |
|---|---|---|
| Sign-in cookies (Supabase) | Keep you signed in | Essential |
| bb_arcade_anon | Counts Arcade plays for players without an account; lasts 1 year | Essential |
| Connected account and build room cookies | Secure the account connection flow and build room seats | Essential |
| Preferences (browser storage) | Theme, recently played games, drafts, and your privacy choices | Functional |
| PostHog | BB Analytics, including the campaign link that brought you | Analytics, only if you allow it |
| Google Analytics | Visit and feature measurement | Advertising partners |
| Google AdSense | Serving and measuring Arcade ads | Advertising |
| Meta Pixel and AppLovin | Measuring our own ads | Advertising partners |
Google and its partners may use cookies to serve ads based on your visits to Bounty Board and other sites. Learn how Google uses information from sites that use its services. You can also block or delete cookies in your browser settings; the site still works, but you may need to sign in again.
YouTube data
Bounty Board uses YouTube API Services. By connecting a YouTube account you agree to the YouTube Terms of Service, and Google's handling of your data is covered by the Google Privacy Policy. You can revoke our access anytime from your Google account's third party connections page.
Bounty Board's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Your channel statistics and analytics are shown only to you, on your own profile. Studios and other visitors never see them. If your profile has no picture of its own, your channel thumbnail can stand in for one. View counts on videos you submit for campaigns are public YouTube numbers, which we read without using your connected account.
We don't sell YouTube data, use it for advertising, or share it with our advertising and analytics partners (Google Analytics, AdSense, Meta, AppLovin, and PostHog). It's stored with our database and hosting providers only to show your stats and to check that videos you submit come from your channel. Your YouTube access tokens are encrypted with AES-256.
When you disconnect YouTube, or revoke our access at Google, we delete the channel data and analytics we stored from your account. We keep the links, previews, and view counts of specific videos you submitted for campaigns and competitions, because they are part of the payment record for that work.
Disconnecting Instagram or TikTok deletes the account data we stored. Disconnecting Twitch deletes your tokens, profile image, and follower stats; we keep your Twitch username and the viewer counts of past streams, without titles, because bonuses for streams you already did may still be measured from them.
How long we keep it
- Account and profile data: while your account is open.
- After you ask us to delete your account: we delete it within 30 days, except records we must keep.
- Payment, payout, and tax records: as long as tax and accounting law requires, generally up to 7 years.
- Prize eligibility reviews: kept after deletion to show we followed the prize rules.
- Announcement emails you unsubscribe from: kept on a suppression list so we do not email you again.
- Screenshots taken during Arcade game review: 30 days.
- Connected agents: access tokens last one hour and a connection up to 30 days; the connection records and request fingerprints described above stay with your account while it is open and are deleted with it.
- Backups roll off on our provider's schedule.
Your rights
Depending on where you live, you may have the right to access, correct, delete, or get a copy of your personal data, to opt out of the sale or sharing of personal data and targeted advertising, and to not be treated differently for using these rights. Email admin@bountyboard.gg from your account email. We will verify your request, may ask an authorized agent for proof of authority, and respond within 45 days, or one month in the EU and UK. If we decline, you can appeal by replying to our answer, and if you are still unhappy, contact your state attorney general or data protection authority.
EU, UK, and Swiss visitors
We process your data to perform our contract with you (running your account, campaigns, and payments), for our legitimate interests (security, fraud prevention, and improving Bounty Board), with your consent (BB Analytics and advertising partners, which you can withdraw anytime), and to meet legal obligations. You can object to processing based on legitimate interests and complain to your local data protection authority. Bounty Board is based in the United States, so your data is processed there; where required, our providers transfer it under standard contractual clauses.
California
California residents can ask us about disclosures of personal data to third parties for their direct marketing purposes. We do not make those disclosures. The categories of data we collect, the sources, purposes, and recipients are described above.
Children and teens
Bounty Board is not for children under 13, and we do not knowingly collect their personal data. If we learn we have, we delete it. Players aged 13 to 17 can use the Arcade with a gamer account; creator and studio accounts, payouts, prizes, and purchases are for adults only. If you believe a child under 13 has given us personal data, email admin@bountyboard.gg.
Security
Connections to Bounty Board use HTTPS. Connected account tokens and game keys are encrypted with AES-256, agent access tokens are stored only as SHA-256 hashes, our providers encrypt stored data, and staff access is limited to people who need it. No system is perfectly secure; if you think your account is at risk, email admin@bountyboard.gg right away.
Changes to this policy
When we make material changes, we will update the date above and tell you by email or on the site before the change takes effect.
Contact
Bounty Board Company
Email: admin@bountyboard.gg