Privacy Policy

1. Who this covers

This policy covers the Bounty Go mobile app, the API it talks to, and this website. It explains what personal data is collected, why, who else sees it, how long it is kept and what you can ask us to do about it.

The controller of that data is Studio Perez (סטודיו פרץ), operated by Yaniv Perez, of Tel Aviv, Israel — referred to below as Bounty Go, we, or us. You can reach us at [email protected], which is the address to use for anything in this policy, including a request to exercise your rights. Our studio’s own site is yanivperez.com.

Where the GDPR or the UK GDPR applies to you, the terms controller, processor, personal data and legal basis carry their meanings from those laws. Where the CCPA or CPRA applies to you, personal information carries its meaning from those. Section 8 lists the rights each of them gives you and how to use them.

2. What we collect, and why

Everything below is collected because a feature needs it. There is no category collected speculatively, for a future product, or for advertising.

2.1 Account identity

There are three ways to sign in: with Apple, with Google, or with an email address and a password you choose. Apple and Google hand over no password, and for those two routes we never see one. What the provider returns and we store is:

• The provider's stable subject identifier for you, which is what links a later sign-in to the same account.
• Your email address, when the provider releases one. If you use Sign in with Apple and choose Hide My Email, what we receive is Apple's private relay address, and that is all we ever have.
• Your display name, and a short handle generated from it. Both are shown to other people you interact with.

If you register with an email address and a password instead, we store the address, your display name and handle, and a salted argon2id hash of the password. The password itself is never stored, never logged and never serialised out of the database, and the hash is erased with the account. We email a six-digit code to the address and create the account only once that code comes back, with the password and name sent along with it, so an account registered this way can only be made with an address its owner reads. (The previous version of the app, 1.1.0, registered without a code; an address registered that way stays unverified until its owner confirms it.) Until it is used, the code is kept only as a keyed digest, beside the address it was sent to, in a short-lived record deleted within two days of the code expiring or being used. When somebody asks for a code for an address that has no account, or no account a code can be sent for, we keep the same kind of record for it, so that the answer cannot reveal whether an address has an account here; it is deleted the same way. Accounts registered before October 2026 can verify their address from Settings. A forgotten password is reset with a code sent to the address (“Forgot your password?” on the sign-in screen), once the address is verified, and the reset signs out every device that used the old one. If your address was never verified, write to support instead. A later Sign in with Apple or Google using the same address is linked to a password account only once its address is verified, to stop somebody registering your address and inheriting your sign-in.

A small number of accounts created before August 2026 also carry a phone number, from a sign-in method that no longer exists. Nothing reads it any more, and it is cleared when the account is deleted.

2.1a Email we send you

We send email from [email protected] for things the service needs: a sign-in or password code, a welcome when an account is created, a notice when your password changes, and a notice when you ask to delete your account. These come whether or not you want news, because they are about your account’s security. We send news about Bounty Go only if you turned it on, when registering or in Settings, and every such email has a one-tap unsubscribe link; we keep the time you agreed. Emails are written in the language you use the app in, which we store with your account. We do not track whether you open an email or click its links: there are no tracking images and no rewritten links.

If an email to you bounces because the address does not exist, or you mark one of our emails as spam, Amazon tells us, and we stop emailing that address. To recognise it later we keep a keyed fingerprint of the address, a one-way code made with a secret only our server holds, not the address itself, along with whether it was a bounce or a spam report, when, and Amazon's reference for the report. A spam report also turns off news for the account that uses the address, and that change is recorded like any other unsubscribe. Section 7 says how long the fingerprint is kept. If you stop receiving codes and want them again, write to support from that address and we will lift it.

2.2 Precise location

The app asks for location permission when you first open the map, and the operating system, not us, decides whether you granted it. Precise location is used for four things:

• Centring the map and ordering listings by how near they are to you.
• Recording where a lost pet or item was last seen, when you are the owner creating a listing.
• Recording where you saw something, when you report a sighting.
• Working out whether you are close enough to a listing for a check in or a daily challenge to count.
• Checking that a sighting was reported from somewhere near where it says it was. For that, a grid cell of roughly one kilometre around your last reported position is held on the server for 30 minutes and then expires. Section 4 says exactly what that cell is and is not.

The coordinates you attach to a sighting are visible to the owner of that listing, because a sighting with no location tells them nothing. Everything else derived from your position is either fuzzed before publication or kept to your own account. Section 4 sets out exactly what that means.

2.3 Coarse and derived location

• Background alert cells: not in this version. An earlier design reported a coarse cell of a few kilometres so that a new listing nearby could reach you while the app was closed. That feature is not in the current release, the app declares no background location permission, and nothing of the kind is collected. If it returns, it will ask first and this policy will say so before it does.
• Place names. A listing's town, region and country are derived from its already fuzzed point, not from the true one, using the GeoNames dataset. That is why a listing says the town rather than the street.

2.4 Photos

Listing and sighting photos are uploaded to our object storage and fetched back by the server, which decodes them, checks them, and re-encodes them before anything is served. That re-encode is the point: the file other people see is one we produced, and it carries no EXIF, XMP or IPTC metadata at all. Any GPS tag your camera wrote into the original is gone before the photo is visible to anyone, and the server refuses to publish a render that still has metadata on it.

We do not keep your original file after the render and thumbnail are produced. We do not scan your photo library. The app only ever receives the specific images you pick or take.

2.5 Messages, notes and reports

Chat messages between two people about a claim, the free text note on a sighting, and the text you write when you report someone are all stored on our servers. They are not end to end encrypted, because moderation and abuse reports would be impossible if they were, and because a report of a threat that no human can read is not a safety feature. Staff read message content only when a report, a legal obligation, or an investigation into fraud requires it.

2.6 Push notifications and device identifiers

On iOS the app can send push notifications. It never asks on first launch: the operating system prompt appears once, after you have published a listing or reported a sighting, or whenever you turn notifications on from Settings inside the app, and if you decline, nothing is registered. If you allow it, Apple issues a push token for this device and the app stores that token against your account, with the platform and the language the phone is set to, so that a sighting on your listing, a claim or handover step, a message in a claim, a change to one of your listings or a safety decision about your account can reach you while the app is closed. What a push carries is the listing's title, which is already public on the map, and the reward shown on it. It never carries message text, coordinates, phone numbers or anybody's name; the app fetches the detail when you open it.

The token addresses one device and nothing else. It is not an advertising identifier and it is shared with nobody but Apple, in the act of delivery. It is deleted when you sign out and when your account is deleted, and if Apple reports it no longer valid we stop using it and keep only the fact that it was disabled. The switches in the app decide what is sent at all: turn notifications off there and nothing is sent, or switch them off for Bounty Go in your phone's own settings. Android has no push in this release, so no token is registered there.

The account identifier is a random UUID we generate, tied to nothing outside Bounty Go, and it is not an advertising identifier. We do not use an advertising identifier, and we do not track you across other apps or websites.

2.7 Purchases and the subscription

Nothing is sold in the app from version 2.1: posting a listing is free. Before that, two things were paid for inside the app: a monthly subscription that kept up to two of your listings on the map, and optional one-off boosts that made a listing more visible. Both were bought through Apple's App Store or Google Play. Those stores collected the money and hold the card details. For each purchase we received a receipt or purchase token from the store, validated it with the store's servers, and kept a record of the transaction, the product, the amount in minor units, and its status. Those records are still kept, for as long as section 7 says.

For a subscription we also keep a subscription record: the store's stable identifier for it, the product, whether it is active, in a grace period after a failed payment, expired or revoked, when the paid-for period ends, and the date you turned auto-renewal off if you have. A subscription bought before 2.1 keeps renewing through the store until you cancel it, and the store tells us when it renews, lapses or is refunded, which is the only way the record changes. It no longer decides whether your listings are on the map.

A reward on a listing is not a purchase and does not appear here. Rewards never pass through Bounty Go at all, so there is nothing about them for us to store.

2.8 Progression and in-app activity

Confirmed sightings, completed returns, daily challenges, streaks, check ins, shares and the cosmetic items you have earned are recorded against your account, with a timestamp, so the levels and streaks in the app can be computed. Under Apple's labels this is Product Interaction data, and it is declared as such.

This ledger is walled off from anything financial by design. Experience points cannot become money, cannot change a reward, and cannot affect trust or moderation. There is no database link between the two, and a test fails the build if one is ever added.

2.8a The runner and its weekly board

From version 2.1 the app has a small running game, opened from your profile. When you start a run we record it against your account: when it started, the number that lays out its course, and which version of the rules it uses. When it ends, the app sends the moments you tapped and the score it showed you, and our server replays the run to work the score out itself. We keep the result (the score, the distance, what the run picked up, how long it lasted, and whether the app's score matched ours), and your best score in each week. Under Apple's labels this is Gameplay Content.

The weekly board ranks every active player by their best score that week, and starts again each Sunday at midnight, Israel time. Other players see your rank, your score and your distance. They see your handle and your avatar only if you chose to show them, and never your display name; if you did not, or if either of you has blocked the other, your row is anonymous to them. You can change that choice in the game at any time. You always see your own row.

Runs are not location data, they award nothing (no experience points, no items, no prize), and like the rest of the game they have no link to anything financial.

2.9 Trust and safety signals

We compute a trust score for each account from its own history: verified returns, confirmed sightings, account age, reports upheld against it. The raw score is never shown to anyone, including you, and never to another user. We also store reports you file or that are filed about you, the people you have blocked, moderation decisions, and an audit log of significant actions that records identifiers rather than identities.

2.10 Technical data

Our servers log the IP address a request came from, the time, the path, and the outcome. IP addresses are used for rate limiting, brute force protection, fraud investigation and diagnosing faults. Raw coordinates are never written to a log line. Sensitive fields are redacted before anything is logged.

3. Legal bases

If you are in the UK, the EEA or Switzerland, this is the basis we rely on for each purpose.

4. The location promise

This is the part of the policy worth reading twice, because it is the part that would hurt if we got it wrong.

1. A published listing point is not the real one. When a listing is created, the server computes a display point by moving the true last-seen point in a random direction by a random distance between 80 and 250 metres. The offset is derived from a server side secret, so it cannot be reversed or averaged out by watching the listing, and it is recomputed with a fresh offset whenever the owner moves the pin.
2. The true point leaves the server only for the owner. Every other response, every map tile and every notification carry the display point and nothing else. The town shown on a listing is derived from the display point, not the true one.
3. A resolved listing's ghost is offset again. Listings that have been recovered leave a marker on the map for a while. That marker is moved by a second, independent offset of 300 to 700 metres, so watching a listing before and after it resolves does not narrow anything down.
4. Your own position is not a thing other people can request. There is no endpoint that returns where a user is, and no history of where you have been. Your position is used to answer the request in front of it, with one bounded exception: while the map is open, a grid cell of roughly one kilometre by half a kilometre around your last few reported positions is held in a short-lived server cache for 30 minutes, solely to check that a sighting you report was reported from nearby. It is a cell, not a coordinate, so it cannot be an address; it is never written to the database, is never returned to anyone, including you, and expires on its own.
5. The search radius is the owner's estimate, not a measurement. The circle drawn around a pin is how far the owner thinks the subject could have travelled. It says nothing about where anybody is now.

5. What other people can see

A signed in user looking at one of your listings sees the title, the description, the category, the photos, the reward amount, the fuzzed point and its search circle, the town, when it was last seen, how many sightings it has, and your display name and handle. They do not see your email, your phone number, your position, the true last-seen point, your trust score, or anything you have bought.

This website does not show the live map; it shows screenshots of the app. It does still serve the feed that map used to read, at bountygo.app/map/listings.json: the newest open listings, each as its title, category, reward, fuzzed point, town and thumbnail, with no name and no handle. Anyone can fetch that feed without an account, so a listing that is live in the app is public in that form too, and it stops appearing there within a few minutes of the listing closing.

Inside a claim, the two of you can message each other. Contact details are never revealed automatically. If you want to swap a phone number, that is something you choose to type.

If you play the runner, other players see your rank, score and distance on its weekly board, and your handle and avatar only if you chose to show them (2.8a).

6. Who else receives data

We do not sell personal information, and we do not share it for cross context behavioural advertising, as the CCPA and CPRA use those terms. We have never done so. The complete list of third parties that receive anything is below.

• Apple and Google, for sign-in. When you sign in with either, the provider learns that you signed in to Bounty Go and hands us the identifiers in section 2.1. Their handling of that is governed by their own privacy policies. An email and password sign-in involves neither of them.
• Apple, for push notifications. On iOS, a notification you have turned on is handed to Apple's push service addressed to your device token, as section 2.6 describes. Apple sees that a notification went to that device and what it said, which is never message text, coordinates or a name.
• Apple and Google, for payments. All in-app purchases run through the App Store or Google Play. They take the payment, hold the card details, and give us a receipt. We never see a card number.
• Mapbox, for maps. The map in the app is drawn by Mapbox; this website makes no request to Mapbox. Loading map tiles necessarily tells Mapbox roughly where you are looking, and your IP address. Beyond that, the Mapbox SDK bundled in the app declares in its own privacy manifests that it collects precise location, coarse location, a user identifier, product interaction, performance data and other diagnostic data, and that it uses them for analytics as well as for app functionality. That collection is Mapbox's, not ours: none of it flows to us, and we get no analytics out of it. We are naming it here because it happens inside our app and you are entitled to know. Mapbox's privacy policy governs it.
• Amazon Web Services, for email. The emails in section 2.1a are sent through Amazon Simple Email Service, in the EU (Stockholm) region. Amazon receives the address an email goes to and what it says, and handles it on our behalf to deliver it, under its own privacy terms. When an email bounces or is reported as spam, Amazon tells us so through its Simple Notification Service, naming the address and the kind of report. We keep the fingerprint described in 2.1a, the kind of report and Amazon's reference for it, and nothing else from the report.
• Cloudflare, as the front door. Every request to bountygo.app and to our API passes through Cloudflare, which terminates TLS, filters abusive traffic and forwards the request to our server. Cloudflare therefore processes your IP address and request metadata on our behalf.
• Our hosting. The API, the database, the cache and the object store holding your photos all run on servers we rent from a third-party hosting provider in the United States. The provider has physical custody of the machines; nobody outside Bounty Go has an account on them, and the provider does not process your data for any purpose of its own. We will name the provider on request.
• PM2 Plus, for operational monitoring. Our API's process logs are streamed to PM2 Plus, a third party monitoring service, so that faults can be diagnosed. Those logs contain IP addresses, request paths and error detail. They do not contain coordinates, message content, photos, or authentication tokens.
• Google Fonts, on this website only. This page loads its display typeface from Google's font service, which sees your IP address in the process. The app itself loads no fonts remotely.

We will also disclose data if we are legally required to, if it is necessary to investigate fraud or a credible threat to someone's safety, or if the business is ever sold, in which case you will be told before your data moves and this policy will follow it.

7. How long we keep things

8. Your rights

Depending on where you live, you have some or all of the following rights. We apply them to everyone, wherever you are, because running two standards would be worse.

• Access. Ask what data your account carries, and get a copy of it.
• Portability. Get that copy in a structured, machine readable format, or ask us to send it to another service where that is technically feasible.
• Correction. Have anything inaccurate fixed. Your display name and your listings you can edit yourself in the app.
• Deletion. Have your account and its content erased. The in-app route is Settings, then Delete account, and the off-app route is on the Delete your account page.
• Objection and restriction. Object to processing we do on the basis of legitimate interests, or ask us to pause processing while a dispute is resolved.
• Withdraw consent. Turn off location for Bounty Go in your device settings. The app keeps working without it: you can browse the map by moving it yourself, and only reporting a sighting needs a real position. Withdrawing consent does not undo what was done while it was given.
• Non-discrimination. Using any of these rights does not get you a worse service or a different price.

To use any of them, email [email protected] from the address on your account, or from any address if you tell us your handle. We will confirm receipt and answer within 30 days. If we need more time on a complicated request we will say so, and why, before the 30 days are up. We do not charge for this.

If we get it wrong, you are entitled to complain to your data protection supervisory authority. If you are in the EEA that is the authority for your country; in the UK it is the Information Commissioner's Office. We would rather you told us first, but that is your choice, not a precondition.

9. Children

Bounty Go is for people aged 13 and over. It is not directed at children under 13, is not listed in a children's category, and carries nothing designed to appeal to under 13s. We do not knowingly collect personal data from anyone under 13.

If you believe a child under 13 has created an account, email [email protected] and we will delete the account and its data. If you are a parent or guardian of a teenager who uses Bounty Go, the same rights in section 8 are available to you on their behalf.

10. International transfers

Our servers are in the United States. Cloudflare, Apple, Google and Mapbox all operate globally, so data reaching them may be processed in a country other than yours, including the United States.

Where we send personal data outside the UK or the EEA, we rely on the UK and European Commission standard contractual clauses, or on an adequacy decision where one covers the destination. You can ask us for a copy of the clauses we rely on.

11. Security

The measures below are the ones that actually exist, rather than a list of what sounds reassuring.

• Everything travels over TLS. The API is not reachable except through the edge that terminates it.
• The database, the cache and the object store listen on the loopback interface only, so they are not addressable from the internet.
• Photo storage is private. Images are reached through short-lived signed URLs, never by a public bucket path.
• Sign-in tokens are stored hashed, rotate on every use, and a replayed token revokes the whole session family rather than just failing.
• Every route that touches a resource checks ownership against the database on each request, and answers as though the resource does not exist when it is not yours.
• Uploaded images are decoded, bounded, stripped and re-encoded before they are served, so the bytes anyone downloads are ours and not a stranger's file.
• Coordinates and secrets are redacted from logs.
• Rate limits apply per account and per address, on sign-in, on uploads and on the map feed.

None of this makes a service impossible to breach, and we are not going to claim it does. If a breach affects your personal data and is likely to put you at risk, we will tell you and the relevant regulator within the time the law allows.

12. This website

bountygo.app sets no cookies of its own, runs no analytics, and carries no advertising or tracking pixels. Reading it identifies you to nobody.

Two requests do leave your browser to other companies while a page loads: the display typeface comes from Google Fonts, and the whole site is served through Cloudflare, which may set a cookie of its own to keep abusive traffic out. Each of those sees your IP address, because that is how the internet works, and each is covered by its own privacy policy. The site makes no request to Mapbox; the map you see on it is a screenshot.

The beta form is the one thing on the site that asks for anything. If you fill it in, we store your name, your email address, which phone you use, and your two answers, for exactly one purpose: sending you an invite to the beta and knowing which store it has to come from. Asking grants nothing and creates no account. The list is kept while the beta runs and deleted when it closes; if you go on to create an account, your row goes with that account (see section 7). A row is deleted sooner on request: write to [email protected] from the address you gave, and it is removed within two business days. Submitting the form is rate limited by IP address, and the address is used for nothing else.

13. Automated decisions

A trust score is computed automatically from your own history and can affect how prominent your listings are and how quickly some limits apply to you. It never decides on its own that an account should be suspended or removed: a person makes that decision, and you can appeal it by writing to support. No automated profiling produces a legal effect on you.

14. Changes to this policy

When this policy changes, the new version is published on this page with a new date at the top. If a change materially affects what we collect or who receives it, we will tell you inside the app before the change takes effect, and where the law requires consent we will ask for it rather than assume it. Old versions are available on request.

15. Contact

Questions, requests and complaints about this policy all go to the same place: [email protected]. A person reads it.

See also: Terms of Service · Support · Delete your account