Privacy policy

Who we are

bangerhunt ("we", "us") turns milestones on your X account into collectible cards. We are responsible for the personal data described here. Questions go to tim@bangerhunt.app.

X, Twitter and their logos are trademarks of X Corp. We use the X API under X's Developer Agreement and Policy, and we follow X's rules for how its data may be used. Using bangerhunt does not change your relationship with X: X's own privacy policy still covers your X account.

What we collect

From X, when you sign in and about once an hour after that

• Profile: your X user ID, @handle, display name, profile picture link, bio, account creation date and verification status.
• Public counts: followers, following, number of posts and lists you're on. We keep a dated copy each time we check, so we can see when you crossed a milestone.
• Your own posts from after you signed up: the post ID, text, time and public numbers (views, likes, reposts, replies, quotes, bookmarks). We read only original posts from the last 72 hours, never replies or reposts, and we keep re-reading a post for up to 30 days while it's still growing.
• Access tokens that let us make those reads for you. They are encrypted in our database. We never see or store your X password.

We do not read your DMs, the posts you like or bookmark, who follows you, your timeline, or anything from protected accounts other than your own.

From you

• Email, if you give it. It's optional. We ask for it to send you a daily report: one email in the evening listing the cards you earned that day, only on days you earn any. You can turn it off in settings or with the unsubscribe link in every report, and remove your email from settings at any time. Otherwise we use it only for messages about your account. No newsletter, and we never share it for marketing.
• Whatever you write to us when you get in touch.

From our payment provider

Payments are handled by Polar, our merchant of record. Polar collects your card and billing details; we never see them. Polar tells us your customer ID and whether your subscription is active.

Automatically

• A session cookie that keeps you signed in, and a cookie with your browser's time zone so streaks and dates match your day.
• Server logs with your IP address, browser and the pages you requested, used to keep the service running and to stop abuse. They are kept for a short time and then deleted.

That's all the cookies there are. No analytics, no ad pixels, no third-party trackers.

What we make from it

• Cards. We compare your numbers with each card's target and record when you earned it and, for post cards, which post earned it.
• Share images. Pictures of your cards and profile, shown when someone shares your bangerhunt link.

How we use it

• To run bangerhunt: deal your cards, show your collection, check for new milestones, keep your subscription in step.
• To show your public page, if you keep it on.
• To answer you when you write to us.
• To keep the service secure and to meet legal obligations.

We don't sell or rent your data, use it for advertising inside or outside X, build profiles of you from other sources, or use it to train AI models. We don't link your X account to identities outside X.

If you're in the EU, UK or a similar jurisdiction: we process your data to perform our contract with you (running the service you subscribed to), on our legitimate interest in keeping it secure, and with your consent for the optional email and the daily report. You can withdraw consent at any time: switch the report off in settings, use the unsubscribe link in any report, or remove your email.

Your public page

Once your first cards are dealt, you get a page at bangerhunt.app/@yourhandle and a page for each card you earn. Anyone with the link can see them, and when you share one on X, X shows a preview of it. They show your display name, @handle, profile picture, the cards you've earned and, on post cards, the post that earned it, all of which is already public on X.

Your page is on by default. You can turn it off in your settings at any time, and it stops being reachable straight away.

Who else gets your data

Only the services we need to run bangerhunt, each under its own privacy terms and only for that job:

We may also disclose data if the law requires it, or to a buyer if bangerhunt is ever sold, in which case this policy keeps applying to your data.

Some of these providers are in the United States, so your data may be processed outside your country. Where the law requires it, transfers are covered by safeguards such as the EU Standard Contractual Clauses.

How long we keep it

• While you have an account we keep your profile, counts, posts and cards. If your subscription lapses we stop checking X for you but keep your cards, so they're there if you come back.
• Posts stop being refreshed 30 days after you publish them. If you delete a post on X, or it stops being visible there (your account goes private or is suspended), we erase its text as soon as we notice: within a day while we still track it, and within a week for posts that earned a card. Ask us and we do it within 24 hours. Thirty days after we stop tracking a post that earned no card, we erase its text anyway and keep only its numbers.
• When you delete your account we erase your profile, counts, posts and cards straight away. Copies left in backups and server logs are gone within 30 days. We keep only what the law requires (for example, records of payments, which Polar holds).

Your choices and rights

• Delete your account: use "Delete account" in your settings. It cancels your subscription and erases your data at once. If you can't sign in any more, email tim@bangerhunt.app with your @handle and we'll do it for you.
• Cut off our access: revoke bangerhunt at any time in X under Settings → Security and account access → Apps and sessions. We stop reading your account at once.
• Get a copy, fix or limit your data: write to us and we'll answer within 30 days.
• Cancel your subscription from the account menu.

Depending on where you live (for example the EU, UK or California), you have the right to access, correct, delete and port your data, to object to or restrict how we use it, and not to be treated differently for using these rights. We don't sell or share personal information as California law defines those terms. You can also complain to your local data protection authority.

Security

Connections are encrypted, access tokens are encrypted at rest, and only the people running bangerhunt can reach the database. No system is perfectly secure; if a breach affects your data we'll tell you and the authorities as the law requires.

Children

bangerhunt is not meant for anyone under 16, and X itself doesn't allow accounts under 13. We don't knowingly collect data from children. If you think a child has signed up, tell us and we'll delete the account.

Changes

If we change this policy we'll update the date at the top. If a change matters, for example we start collecting something new, we'll tell you in the app or by email before it applies.

Contact

Anything about your data: tim@bangerhunt.app. More ways to reach us are on the contact page.