Privacy Policy

Operated by Heron Networks LLC.

What we collect

An email address for sign-in (magic link, no password stored for that flow), bounty and solution content you post (including the optional town or region you type on a bounty, which is shown publicly), and payment metadata from Stripe (we never see or store your card number).

Sorting bounties nearest first: in the app, the ZIP code or state you type is used on your phone only and is never sent. On the website it is sent with that one request to order the list and is not stored or logged.

"Use my area" in the app is off until you tap it. Then the app asks for your phone's approximate location (never precise, never in the background), turns it on your phone into a 3-digit ZIP area such as "787xx", and throws the reading away. Only that area is sent, with the one request that sorts the list, and we do not store or log it. Your phone remembers the area so it need not ask again; "Stop using my area" forgets it.

Photos, notifications and network information

Photos you attach to a bounty have their location and camera details removed before anyone sees them, and the cleaned file is the only one we keep and show.

Pickup hand-off: when a maker scans the poster's one-time hand-off code in the app, the camera picture is read on the phone and never saved or sent; only the eight-letter code is sent, once. On Android the code is read by Google ML Kit, which sends Google device and app information, an installation identifier and performance figures for its own diagnostics (not the picture). On iPhone the code is read by Apple's own camera framework, which sends nothing.

If you turn on notifications in the app, we store the push token your phone gives us, linked to your account, so we can tell you when a bounty you posted or claimed changes. Expo's push service carries each message to your phone. Deleting your account deletes your push tokens.

When someone who is not signed in requests a sign-in link or submits the takedown form, we count their IP address in a rate-limit counter so a single source cannot flood us with requests; for sign-in links we also count requests per email address, for the same reason. IP addresses are kept for 24 hours for abuse prevention only, then deleted. The counters are used for that and for nothing else. Our host, Cloudflare, also sees IP addresses in the course of delivering the site.

If you report content or block a user, we store who reported what and who blocked whom, so reports can be reviewed and your blocks keep working. The person you reported or blocked is not told.

Cookies and analytics

We set one cookie, diy_bounty_session, when you sign in. It keeps you signed in on this device, is HttpOnly and SameSite=Lax, expires after 30 days, and is cleared when you sign out or delete your account. We set no advertising, preference or tracking cookies. The only thing we keep in your browser's local storage is a bounty you were typing when we asked you to sign in, so you do not have to type it twice: it stays on your device and is removed when the form fills back in, or after one hour.

We count visits with Cloudflare Web Analytics. It sets no cookies, uses no local storage and does not fingerprint visitors. For each page view Cloudflare records the page address, the referring site, the browser, operating system and device type, and the country (worked out from the IP address, which is not kept for analytics). We see only totals, never an individual visitor. We use no Google Analytics, no advertising pixels and no cross-site trackers, so there is no cookie banner.

Creators who share a description link kit can see how many people arrived from each source. Each visit through a kit link is stored as one row holding the creator, the source labels in the link and the page it led to, with no cookie and no IP address, user agent or visitor identifier.

What we never do

We never sell your data. We never show ads. Buyer and maker addresses are never shared with the other party until both agree. Your name is never shown publicly beyond what you choose to post.

Payments

Payment processing is handled by Stripe. Bounty payouts are coming soon. Until they launch, pledging only saves a payment method with Stripe: no card is charged and the platform holds no money. When payouts launch, funds will move directly between poster and solver through Stripe Connect and the platform will not custody them. See /pricing.

Your rights

You can delete your account and its associated data at any time, as described below.

Deleting your account

You can delete your MakeBounty account (operated by Heron Networks LLC) from the web, without the app, even if you have uninstalled it:

1. Go to makebounty.com/sign-in and enter the email address of the account. We email you a one-time sign-in link; opening it signs you in on the web and takes you to your account page.
2. Under "Delete account", type DELETE and choose "Delete my account".

In the phone app the same action is under Account, "Delete account". A program can call DELETE /api/auth/me with the same typed confirmation. If you can no longer receive email at that address, write to support@makebounty.com to request deletion and we will confirm the account is yours before deleting it.

Deletion is immediate. What is deleted: your account and email address, every sign-in session and unused sign-in link, your push tokens, your creator profile, and your open, claimed or cancelled bounties with their photos and unpaid pledges, and solutions that never sold. What is kept: where money has moved, the record of it stays so the other party is not left without one. If you have bought a solution, refunded a pledge or raised a dispute, your account is anonymised instead (the email address is replaced with an unreachable placeholder and your payment-customer link is removed) and the purchase, refund or dispute record is kept. A report you filed is kept as a moderation record with your name removed from it. Deletion waits while a bounty you posted or solved is accepted or paid, a solution of yours has sold, or a charge is still in flight; the account page tells you which, and support can help you close it out. IP addresses in rate-limit counters are deleted after 24 hours, as described above.

If you are a maker and the poster chose your offer, deleting your account takes you off that bounty: it reopens as an open bounty with no maker, and the poster can choose someone else. A bounty already accepted or paid is different, as described above: deletion waits.

Email delivery

Sign-in links and notices are sent through transactional email providers (Resend, Brevo and Postmark). They receive the recipient address and the message.

Contact

Heron Networks LLC — support@makebounty.com, business phone (703) 249-9248.More help: /support.