Privacy Policy

BBSlaps is a public wall. The image, message, display name, tags, and (for business slaps) the link you place are visible to anyone and are intended to remain permanently. Do not place anything you would not want public and lasting. Permanence is a goal, not a guarantee — see our Terms.

We collect only what we need to run the wall:

• Account information (if you sign in): your email address, and either a password (stored only as a salted hash by our authentication provider) or a Google account identifier if you use Google sign-in. We never see your Google password.
• Content you place: the images you upload, your chosen display name, any message, tags, the size, shape, board year, the coordinates of your slap, optional business link, and timestamps. This content is public.
• Gift details: if you send a gift slap, the recipient’s name and email address, used to notify them and let them claim the slap. Gift recipient contact details are kept private and are never shown on the public wall.
• Payment information(for paid slaps): payments are processed by our payment provider (Stripe). We do not receive or store your full card number. We retain transaction metadata such as amount, currency, status, and the provider’s transaction identifiers.
• Technical & abuse-prevention data: your IP address and approximate request metadata, used for rate limiting, fraud and abuse prevention, and security. We use Cloudflare Turnstile, a privacy-preserving CAPTCHA, to tell humans from bots. Turnstile may run invisibly in the background and, to do its job, collects client-side signals such as your IP address, a TLS fingerprint, your browser user-agent, and the site key and page where it runs. Turnstile does not use this information for advertising. Cloudflare’s processing of these signals is governed by the Cloudflare Turnstile Privacy Addendum and the Cloudflare Privacy Policy.
• Reports: if you report content, we collect the report details and any email address you choose to provide.
• Usage & device data: limited, mostly aggregated information about how the wall is viewed and interacted with (for example, counts of views and clicks), to operate and improve the Service. Where this uses a first-party identifier it is described under “Cookies” below.

We do not knowingly collect special-category data (such as health, biometric, or precise geolocation data), and you should not place such information about yourself or others.

• To display the wall and the slaps placed on it, and to operate core features.
• To create and secure your account and let you manage the slaps you own.
• To process payments and send transactional emails (gift notifications, sign-in links, receipts).
• To screen uploads for prohibited content and to review and act on reports.
• To prevent fraud, abuse, and spam, enforce our Terms, and keep the Service secure.
• To understand aggregate usage and improve the Service.
• To comply with law and respond to lawful requests.

Where the EEA/UK GDPR applies, we rely on: performance of a contract (to provide the Service and process your slaps and payments); legitimate interests (security, abuse prevention, and improving the Service, balanced against your rights); consent (where we ask for it, such as non-essential cookies, which you can withdraw at any time); and legal obligation (for example, retaining records or reporting illegal content).

We keep cookies and local storage to a minimum:

• Essential: authentication/session cookies (set by our auth provider) when you are signed in, and CAPTCHA cookies to prevent abuse. These are required for the Service to work.
• Preferences: your light/dark theme choice, stored locally in your browser.
• Analytics: a first-party identifier and counts used to measure views and clicks in aggregate. We do not use third-party advertising trackers and we do not sell your data.

You can clear cookies and local storage in your browser at any time; doing so will sign you out.

We do not sell your personal information. We share it only with service providers who process it on our behalf, and only as needed to run the Service:

• Vercel — application hosting.
• Supabase — database and user authentication.
• Cloudflare— image storage/CDN and CAPTCHA (Turnstile); Turnstile is governed by the Turnstile Privacy Addendum.
• Stripe — payment processing.
• Resend — transactional email delivery.
• Google — sign-in, only if you choose Google sign-in.

We may also disclose information to comply with law, enforce our Terms, protect rights and safety, or in connection with a merger, acquisition, or sale of assets (subject to this Policy). We report apparent child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC) as required by U.S. law.

Anything you place on the wall (other than private fields such as gift recipient contact details and your account email) is public by design and may be cached, copied, screenshotted, indexed by search engines, or shared by others. Even after a slap is removed from the wall, copies may persist outside our control. Please consider this before placing personal information.

• Public slap content is retained for as long as it remains on the wall (intended to be the life of the project) or until removed under our Policy or at your request.
• Account data is retained until you delete your account or ask us to delete it.
• Abuse-prevention data (such as IP-based rate-limit records) is short-lived and expires automatically.
• Payment and transaction records are retained as required for tax, accounting, and legal purposes.

We are based in the United States and process data there. If you access the Service from outside the U.S., you understand your information will be transferred to and processed in the U.S. and other countries where our providers operate, which may have different data-protection laws. Where required, our providers rely on appropriate safeguards such as Standard Contractual Clauses.

Depending on where you live, you may have the right to access, correct, delete, port, or restrict the processing of your personal information, to object to certain processing, and to withdraw consent. Signed-in users can view, edit, and delete their own slaps directly from their dashboard.

EEA/UK: you may exercise the GDPR rights above and lodge a complaint with your local supervisory authority. California (CCPA/CPRA): you may request to know, delete, or correct your personal information, and you have the right to opt out of “sale” or “sharing” — we do not sell or share your information for cross-context behavioral advertising. We will not discriminate against you for exercising any right.

To make a request, email privacy@bbslaps.com. We will verify your request and respond within the time required by applicable law.

The Service is not directed to children. You must be at least 13 years old to use it, and you must meet the minimum age set out in our Terms. We do not knowingly collect personal information from children under 13 (or under 16 in the EEA/UK). If you believe a child has provided us information, email privacy@bbslaps.com and we will delete it.

We use technical and organizational measures to protect your information, including encryption in transit, hashed passwords, access controls, and reputable infrastructure providers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a breach affecting your personal data, we will notify you and the relevant authorities as required by law.

Business slaps may link to external websites we do not control. We are not responsible for the privacy practices or content of those sites; their policies govern your use of them.

We may update this Policy from time to time. We will change the “Last updated” date above and, for material changes, take additional steps where required by law. Your continued use of the Service after an update means you accept the revised Policy.

For questions, requests, or complaints about privacy, contact us at privacy@bbslaps.com.