Privacy Policy

1. Introduction

GDBounty is committed to being fully transparent about how we collect, use, and protect your personal data. This policy applies to all users of the GDBounty platform, including visitors, registered users, bounty creators, and claimers. By using GDBounty, you agree to the practices described in this policy.

We will never sell your personal data to third parties. We collect only what we need to run the platform, and we aim to be clear about exactly what that is.

2. Who We Are

GDBounty is an independent platform built for the Geometry Dash community. For any privacy-related questions or requests, contact us at support@gdbounty.com.

3. What Data We Collect

We collect the following categories of data when you use GDBounty:

Account Data

• Email address — used for authentication, transactional emails, and account recovery.
• Username — your public display name on the platform.
• Password — stored as a secure hash via Supabase Auth. We never see or store your plain-text password.
• Country — optionally provided for your public profile.

Profile Data

• Avatar image — uploaded by you and stored in Supabase Storage.
• Bio and social links — optionally provided and publicly visible on your profile.
• Account role — whether you are a standard user, moderator, or admin.
• Premium/Pro status — whether your account has an active Pro subscription.

Platform Activity

• Bounties you have created, including all fields you submitted (level name, description, requirements, video URL, etc.).
• Donations you have made to bounties, including amounts and timestamps.
• Claims you have submitted, including video proof URLs, platform, and description.
• Watchlist entries — bounties you have bookmarked.
• Comments posted on bounty pages.
• Global chat messages sent on the platform.
• Notifications sent to your account.
• Reports you have submitted about content or users.

Payment Data

• We do not store credit card numbers, bank details, or any raw payment credentials. All payment processing is handled by Stripe.
• We store Stripe customer IDs and Stripe Connect account IDs linked to your GDBounty account to enable donations and payouts.
• Transaction records (amounts, timestamps, bounty references) are stored in our database for platform accounting and dispute resolution.
• Credit balance — any GDBounty wallet credit earned from approved claims is stored on our platform.

Technical Data

• IP address — logged by Supabase and our hosting provider for security and abuse prevention.
• Session tokens — used to keep you logged in. Stored in browser cookies.
• Browser and device information — collected passively by our infrastructure for error monitoring and security.

4. How We Use Your Data

We use your data solely to operate and improve GDBounty. Specifically:

• To run the platform — displaying your profile, processing bounties, handling claims and payouts.
• To process payments — passing necessary data to Stripe to handle donations and payouts securely.
• To send transactional emails — account verification, password reset, payout notifications, and important platform updates via Resend.
• To enforce our Terms of Service — reviewing reports, moderating content, and taking action on policy violations.
• To improve the platform — understanding how features are used so we can fix bugs and build better tools.
• For security — detecting fraud, abuse, and unauthorised access attempts.

We do not use your data for advertising, profiling, or any purpose beyond what is listed above.

5. Data Storage & Retention

• Your data is stored on Supabase servers. Supabase hosts data in data centres within the European Union (EU) by default.
• Uploaded files (avatars, bounty images) are stored in Supabase Storage.
• We retain your account data for as long as your account is active.
• If you delete your account, your personal data (email, username, avatar, bio) is removed. Platform activity records (bounties, claims, donations) may be retained in anonymised or redacted form for accounting and integrity purposes.
• You can request full account deletion at any time from your account settings or by contacting support.

6. Third-Party Services

GDBounty uses the following third-party services to operate. Each service has its own privacy policy:

• Supabase — database, authentication, and file storage. supabase.com/privacy
• Stripe — payment processing, bounty donations, and creator payouts. stripe.com/privacy
• Resend — transactional email delivery (verification, password reset, notifications). resend.com/privacy
• Vercel — platform hosting and deployment. vercel.com/legal/privacy-policy

We share only the minimum data required with each provider to deliver their service. We do not share your data with any other third parties.

7. Cookies

GDBounty uses a minimal set of cookies:

• Authentication cookies — set by Supabase Auth to maintain your login session. These are strictly necessary and cannot be opted out of while logged in.
• Preference cookies — used to remember UI preferences such as theme settings.

We do not use advertising cookies, tracking pixels, or any third-party analytics cookies. We do not participate in any ad networks.

8. Public Data

The following information is publicly visible to all visitors of GDBounty, whether logged in or not:

• Your username and avatar.
• Your public profile (bio, social links, country, badge collection).
• Bounties you have created.
• Claims you have submitted (username and outcome visible, not video proof).
• Comments and global chat messages you have posted.
• Your position on leaderboards.

Your email address, payment details, IP address, and private account settings are never publicly visible.

9. Your Rights (GDPR)

If you are located in the European Union or United Kingdom, you have the following rights under GDPR:

• Right of access — you can request a copy of the personal data we hold about you.
• Right to rectification — you can correct inaccurate data directly from your account settings.
• Right to erasure — you can delete your account and associated personal data at any time.
• Right to restriction — you can request that we limit how we process your data in certain circumstances.
• Right to data portability — you can request an export of your data in a machine-readable format.
• Right to object — you can object to processing of your data where we rely on legitimate interests as the legal basis.
• Right to withdraw consent — where processing is based on consent, you can withdraw it at any time.

To exercise any of these rights, contact us at support@gdbounty.com. We will respond within 30 days.

10. Age Requirement

GDBounty is not intended for users under 18 years of age. We do not knowingly collect personal data from minors. If we become aware that a user is under 18, we will promptly delete their account and associated data. If you believe a minor has registered on the platform, please contact us immediately.

11. Data Security

We take reasonable technical measures to protect your data, including:

• All data is transmitted over HTTPS/TLS.
• Passwords are hashed and never stored in plain text.
• Database access is restricted and managed through Supabase Row Level Security (RLS) policies.
• Payment data never passes through our servers — it goes directly to Stripe.

No system is 100% secure. In the event of a data breach that affects your personal data, we will notify affected users as required by applicable law.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, the "Last updated" date at the top of this page will be revised. For significant changes, we will notify users via email or a platform notice. Continued use of GDBounty after changes are posted constitutes your acceptance of the updated policy.

13. Contact

For any privacy questions, data requests, or concerns, contact us at support@gdbounty.com or reach out on our Discord server. We aim to respond to all privacy-related enquiries within 30 days.