Privacy Policy

We collect only what we need to run the marketplace. That falls into five buckets:

• Account data. Name, email address, password hash, company or brand name, and the Reddit usernames you connect or submit.
• Billing data. Plan, token balance, invoices, and the last four digits and brand of your card. Full card numbers are handled by Stripe and never touch our servers.
• Marketplace content. Bounty briefs, drafts, submitted links, proof screenshots, messages, support tickets, and payout details you provide as a poster.
• Usage and device data. IP address, browser and device type, pages viewed, feature usage, timestamps, and error logs.
• Public Reddit and search data. Publicly available thread, subreddit, and keyword data we fetch to power Discover, rank tracking, and Brand Brain.

We do not knowingly collect special category data (health, biometric, political, or similar). Please keep it out of bounty briefs, proofs, and support tickets.

• Operate the marketplace: create bounties, match posters, verify proofs, settle tokens.
• Process payments, subscriptions, token purchases, referral commissions, and payouts.
• Send account, claim, submission, and billing notifications you have opted into.
• Detect fraud, bot activity, duplicate accounts, banned accounts, and payment abuse.
• Power AI features such as Scout and Brand Brain on the content you supply.
• Measure and improve product performance, and produce aggregate, non-identifying stats.
• Meet tax, accounting, and other legal obligations.

• Contract: running your account, bounties, payments, and payouts.
• Legitimate interests: security, fraud prevention, product analytics, and service communications.
• Consent: marketing email, optional cookies, and any integration you explicitly connect (for example Slack).
• Legal obligation: tax records, accounting, and lawful requests.

Scout and Brand Brain send the prompts, brand documents, and thread context you provide to our model providers so they can generate a response. Your content is used to answer your request and to keep your chat history available across devices. We do not sell it, and we do not use your private brand content to train public models. Chat history and uploaded knowledge files can be deleted from inside the app at any time.

We do not sell personal data and we do not share it for cross-context behavioural advertising. We share only with processors that help us run the service, each bound by contract:

• Payments and invoicing (Stripe).
• Database, authentication, and application hosting.
• File storage for proofs, bounty images, and knowledge files.
• AI model providers for Scout and Brand Brain.
• Search, keyword, and SERP data providers.
• Email delivery and, if you connect it, Slack.

Between users, we share only what a job requires: advertisers see the submitted link, proof, and the Reddit username used; posters see the brief and the advertiser brand name. We may also disclose data when required by law, to enforce our Terms of Service, or in a merger or acquisition, in which case this policy continues to apply.

Cookies are small files stored on your device. We use three categories:

• Essential: sign-in sessions, security, and fraud prevention. The service cannot run without them.
• Functional: remembering preferences such as your dashboard view, filters, and notification settings.
• Analytics: aggregate measurement of which pages and features are used, so we can improve them.

We do not run third-party advertising or cross-site retargeting cookies. You can clear or block cookies in your browser, though sign-in stops working without the essential ones.

We operate globally, so your data may be processed in the United States, the European Union, and other countries where our providers run infrastructure. Where data leaves the EEA or UK, transfers rely on Standard Contractual Clauses or an equivalent safeguard.

Data is encrypted in transit with TLS and at rest by our infrastructure providers. Access is restricted by row-level database policies, role-based permissions, and least-privilege staff access. Proof and image files are served through short-lived signed URLs. No online service can promise absolute security. If a breach affects your personal data, we will notify you and the relevant regulator as required by law.

• Account and profile data: while your account is active.
• Bounties, submissions, and proofs: up to 24 months after completion for dispute handling.
• Payment and token ledger records: up to 7 years, as tax law requires.
• Support tickets: 24 months.
• Server and security logs: up to 12 months.

After you delete your account we remove or anonymise personal data within 30 days, except records we must keep for legal, tax, or fraud-prevention reasons.

Depending on where you live, you can request access, correction, deletion, restriction, a portable copy of your data, or object to processing based on legitimate interests. EEA and UK users may also complain to their local supervisory authority. California residents can request disclosure of the categories collected and shared, request deletion, and opt out of sale or sharing; we do not sell or share personal data, and we will never discriminate against you for exercising a right.

Email hello@reddbounty.com with the address on your account. We verify identity before acting and respond within 30 days.

Transactional email about your account, bounties, and billing is part of the service and cannot be switched off while your account is open. Product and marketing email is optional and every message includes an unsubscribe link. Notification preferences live in your settings.

ReddBounty is not for anyone under 18. We do not knowingly collect data from children. If we learn that a minor has created an account, we close it and delete the data.

The service links to Reddit and other third-party sites we do not control. Their privacy practices are their own. Anything you post publicly on Reddit is governed by Reddit's own policies, not this one.

We use automated systems to score threads, match posters to bounties, detect fraud and banned accounts, and generate AI drafts. These systems support human decisions rather than replace them. Where an automated check materially affects you, for example a suspension or a rejected submission, you can ask for human review by emailing hello@reddbounty.com and we will have a person look at it.

If a breach creates a risk to your rights, we notify the relevant supervisory authority within 72 hours of becoming aware of it and inform affected users without undue delay, with a description of what happened, what data was involved, and what we are doing about it.

We may update this policy as the product evolves. Material changes are announced in the app or by email at least 14 days before they take effect, and the date at the top of this page always reflects the current version. Continued use after the effective date means you accept the update.

Privacy questions, data requests, and legal notices all go to hello@reddbounty.com. It is the only contact address we operate, and it is monitored on business days. See also our Terms of Service and Refund Policy.