BarTag Privacy Policy

Last Updated: August 11, 2026

This Privacy Policy explains how BarTag collects, uses, discloses, and protects information when you use our website, app, private links, and related services (the “Service”).

1. Information You Provide

Depending on how you use BarTag, you may provide:

• names, display names, email addresses, and phone numbers;
• account and profile information;
• names and contact details for people you tag;
• photos, messages, beverage details, and selected venue information;
• Round, Tag, Proof, chatter, and notification-preference activity; and
• communications you send to BarTag.

Guests can participate without creating an account. Guest activity is still stored so the Round can work, and a private-link or browser access token may be used to authorize later access.

2. Location and Venue Information

Selecting a venue is currently required for a BarTag moment. You may type a venue or select a Google Places suggestion. When your browser permits location access, BarTag uses your device coordinates to bias nearby search results and sends the search text and coordinates to Google Places. BarTag does not store those device coordinates as your Round location. If you select a venue, we store venue details, which may include its provider-supplied address and map coordinates.

3. Photos

BarTag stores submitted Proof photos in private storage and makes them available to authorized Round viewers through expiring signed links. Before upload, BarTag's photo-processing code checks for and removes common EXIF, XMP, IPTC, text, and embedded location metadata by re-encoding when needed. No technical process is perfect, so review what a photo visibly reveals before submitting it.

BarTag does not use facial recognition.

4. Information Collected Automatically

When you use the Service, BarTag and its providers may process IP address, browser and device type, operating system, referring pages, pages viewed, approximate region, timestamps, app events, and error or performance information. BarTag also uses a one-way hash of the request IP address as part of its Proof-photo upload security.

If you enable Web Push, BarTag stores the browser push endpoint, encryption keys, user agent, and notification preferences needed to deliver and manage notifications.

5. Cookies, Local Storage, and Similar Technology

BarTag uses:

• cookies for account sessions and private-link access;
• browser local storage to remember the 21+ confirmation and tab-scoped session storage to keep unfinished Create and Proof form text for up to four hours; and
• Google Analytics and Vercel Analytics scripts to understand usage and performance. Google Analytics may use cookies or similar identifiers as configured by Google.

Create drafts stay within the current browser tab, expire after four hours, and are cleared after a Round opens, on sign-out, or when the signed-in account changes. For signed-in players, opener identity and contact details are filled from the current account instead of the saved draft.

Proof drafts use the same tab and four-hour limits, are separated by player and Round or Tag, and are cleared after successful submission or sign-out. Selected photos stay only on the current form screen and must be selected again after leaving it.

Browser settings may let you block or delete these technologies, but some account, private-link, draft, or analytics behavior may stop working as intended.

6. How We Use Information

We use information to:

• create accounts and operate private Rounds, Tags, Proofs, and chatter;
• authenticate users and private-link viewers;
• save selected venues and provide nearby venue suggestions;
• deliver email and opt-in Web Push notifications;
• remember preferences and recent players, venues, and beverages;
• secure, troubleshoot, analyze, and improve the Service;
• prevent misuse and enforce our Terms; and
• comply with law and protect rights, safety, and property.

7. Private Links and Public Venue Activity

Round content is private by default and accessible through private links, but a link recipient can forward the link or capture what they see. Do not treat a private link as an absolute confidentiality guarantee.

BarTag's public TagMap and Places pages may show limited information derived from completed Rounds, including venue names and addresses, map points, connections between venues, dates, and aggregate counts. Those pages do not list private Round photos, messages, beverage details, contact information, or participant identities as part of a private Round.

8. How We Disclose Information

We may disclose information:

• to authorized Round participants and private-link viewers as needed to provide the game;
• to service providers that host, secure, analyze, or deliver the Service;
• when you direct us to share it;
• when reasonably necessary to comply with law, protect people or rights, investigate misuse, or secure the Service; and
• in connection with a merger, financing, acquisition, reorganization, or sale of all or part of BarTag, subject to appropriate safeguards.

9. Service Providers

Current providers and integrations include:

• Supabase for authentication, database, and private photo storage;
• Resend for transactional email delivery;
• Google Places for venue search and venue details;
• Google Analytics and Vercel Analytics for usage and performance analytics;
• Vercel for application hosting; and
• browser, operating-system, and push-network providers for opt-in Web Push notifications.

These providers process information under their own terms and privacy policies. Resend receives the email destination and message content needed to send a notification and may process delivery metadata. A guest Tag email contains its time-limited private access link.

10. Email, SMS, and Push Preferences

BarTag sends transactional emails about Tags and Round activity. You can change Round-notification types and marketing email preferences in your profile, or contact us for help. We may still send service or security messages when needed. BarTag does not currently send automated SMS; text copy and links are handed off to your own messaging app for you to send.

Web Push requires your browser permission. Signed-in users can change push preferences in their profile, disable notifications in the app, or revoke permission through browser or device settings.

11. Retention and Deletion

We retain information for as long as reasonably necessary to operate and secure the beta Service, maintain Rounds and account history, resolve disputes, enforce agreements, and comply with law. Retention varies by the kind of information and why we hold it; we do not promise a fixed retention period in this beta phase. Backups, logs, and information needed for legal or security purposes may remain for a limited time after a deletion request.

You may request access, correction, or deletion by emailing us. We may need to verify your identity and may retain information where permitted or required by law. Deleting your copy of a link or photo does not delete copies another recipient already captured or shared.

12. Security

We use reasonable administrative and technical safeguards, including access controls, private storage, short-lived signed photo links, and upload validation. No system or transmission is completely secure, and we cannot guarantee absolute security. Protect private links and tell us if you believe information has been accessed improperly.

13. Users Under 21

BarTag is for people 21 and older. We do not knowingly collect information through the Service from anyone under 21. If you believe someone under 21 has provided information, contact us so we can investigate and take appropriate action.

14. California Privacy Disclosures

California residents may have rights to know, access, correct, or delete personal information and to receive equal service when they exercise privacy rights, subject to legal exceptions. To make a request, contact us below. We may verify the request and may accept an authorized agent request where required by law.

BarTag does not currently sell personal information for money or use it for cross-context behavioral advertising. Analytics providers may collect information directly through the scripts described above. BarTag does not currently respond to browser Do Not Track signals or Global Privacy Control as a separate opt-out because the Service does not currently sell personal information or use it for cross-context behavioral advertising. You can still use browser controls to limit cookies and scripts.

15. International Use

BarTag and its providers may process information in the United States and other countries, where privacy laws may differ from those where you live. The Service is not limited to U.S. users, but you are responsible for deciding whether your use complies with local law.

16. Changes to This Policy

We may update this Policy as BarTag changes. We will update the date above and provide additional notice when required.

17. Contact

Privacy questions and requests may be sent to BarTag at hello@playbartag.com.