Privacy Policy

2.1 Information You Provide Directly

When you create an account, make a purchase, or interact with the Platform, we may collect:

• Account Information: Name, email address, username, password (stored in hashed form), phone number, date of birth, profile photo/avatar, and biographical information you choose to share.
• Payment Information: Billing name, billing address, and payment method details. Credit and debit card information is collected and processed by our PCI-compliant third-party payment processor(s) and is not stored on our servers. Bitcoin payment addresses and transaction hashes are recorded for transaction verification.
• Business Information: If you claim or manage a business listing -- business name, address, phone number, website, hours of operation, services offered, and other business details.
• User Content: Posts, comments, reviews, forum contributions, wiki edits, messages, photos, match scores, and any other content you submit to the Platform.
• Communications: Emails, support tickets, feedback, and other communications you send to us.
• Event Registration: Information provided when registering for events, including discipline preferences, classification, and equipment details.
• Shooter Profile Data: Match results, scores, classifications, ratings (including ELO ratings), and competitive history that you submit or that is imported from recognized sanctioning bodies (USPSA, PITA, ATA, etc.) with your authorization.
• Market Listing Data: When you post a classified listing on the Exchange, we collect the item details you provide (title, description, category, condition, pricing, photos), your location information (city, state, ZIP code), bid history on auction-format listings, listing status and history, communications initiated through the Exchange messaging system, and contact preferences. Listing content is published publicly on the Platform and may be indexed by search engines.
• Compliance Certifications: When you create an Exchange listing, we log your Gun Control Act (GCA) compliance acknowledgment, including the timestamp, IP address, and user account ID associated with the acknowledgment. These records are retained for a minimum of 7 years to support law enforcement cooperation and platform integrity obligations.

2.2 Information Collected Automatically

When you access the Platform, we automatically collect certain information, including:

• Device and Browser Information: IP address, browser type and version, operating system, device type, screen resolution, and language preferences.
• Usage Data: Pages visited, features used, links clicked, search queries, time spent on pages, referring URLs, and Platform interaction patterns.
• Location Information: Approximate geographic location inferred from your IP address. We do not collect precise GPS location unless you explicitly enable location services for features such as finding nearby shooting ranges.
• Cookies and Similar Technologies: Information collected through cookies, local storage, and similar technologies as described in our Cookie Policy.

2.3 Information from Third Parties

We may receive information about you from third parties, including:

• OAuth Providers: If you sign in using Google OAuth, we receive your name, email address, and profile photo as authorized by you during the sign-in process.
• Public Data Sources: We may collect publicly available information about shooting ranges, firearms businesses, and events from public directories, government records, and publicly accessible websites to populate our directories.
• Sanctioning Body Data: With your authorization, we may import match results and scores from organizations such as USPSA, IDPA, PITA, ATA, PractiScore, and other sanctioning bodies.

Platform Operation

To provide, maintain, and improve the Platform and its features, including user accounts, community features, directories, event management, and scoring systems.

Personalization

To personalize your experience, including content recommendations, relevant events, and nearby ranges and businesses.

Communications

To send you transactional emails (account confirmations, subscription receipts, password resets), service-related notifications, event reminders, and newsletters you have opted into.

Payments

To process subscription payments, event registrations, and advertising purchases.

Analytics

To analyze Platform usage, understand user behavior, measure feature effectiveness, and improve our services. We use Umami, a privacy-focused analytics platform that we self-host and that does not use cookies or collect personally identifiable information for analytics purposes.

Safety and Security

To detect, prevent, and address fraud, abuse, security incidents, and technical issues. This includes IP-based rate limiting, automated abuse detection, and content moderation.

Legal Compliance

To comply with applicable laws, regulations, and legal processes, including Idaho's data breach notification requirements.

Business Operations

To manage advertising relationships, business listings, and sponsorship programs.

4.1 Service Providers

We share information with third-party service providers who perform services on our behalf, including:

• Payment Processors: Helcim (credit/debit card and ACH processing) and our self-hosted BTCPay Server (Bitcoin processing)
• Email Services: Nodemailer / SMTP providers for transactional and marketing emails
• SMS Services: Twilio for SMS notifications
• Map Services: Mapbox for map rendering and geocoding
• Error Monitoring: GlitchTip (self-hosted) for application error tracking
• Search: Typesense (self-hosted) for Platform search functionality

Where possible, we use self-hosted services to minimize third-party data sharing. Our service providers are contractually required to use your information only to provide services to us and in accordance with this Privacy Policy.

4.2 Public Profile Information

When you create a public profile, certain information is visible to other users and the general public, including your username, avatar, profile bio, reputation score, achievement badges, and any content you post publicly (posts, reviews, comments, forum contributions, and match scores). You can control the visibility of certain profile elements through your account privacy settings.

4.3 Business Listings

Information submitted in connection with business listings (business name, address, phone, hours, website, etc.) is published publicly on the Platform and may be indexed by search engines.

4.4 Legal Requirements and Law Enforcement

We may disclose your information if required to do so by law, in response to a valid legal process (such as a court order or subpoena), or when we believe in good faith that disclosure is necessary to protect our rights, your safety, the safety of others, investigate fraud, or respond to a government request.

BGC complies with the Stored Communications Act (18 U.S.C. §§ 2701-2712). We respond to lawful subpoenas, court orders (18 U.S.C. § 2703(d)), and search warrants according to their legal scope. We may voluntarily disclose information under the emergency exception (18 U.S.C. § 2702(b)(8)) where we reasonably believe disclosure is necessary to prevent imminent danger of death or serious physical injury.

Law enforcement requests should be directed to [email protected].

4.5 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on the Platform of any change in ownership or use of your personal information.

4.6 With Your Consent

We may share your information with other parties when you have given us explicit consent to do so.

4.7 Market Listings and Communication

When you post a listing on the Exchange, the listing content (title, description, category, condition, pricing, photos, and general location) is published publicly and visible to all Platform users and search engines. Your username and reputation score are displayed on listings you create.

When you contact a seller or respond to a buyer through the Platform's messaging feature, your username and message content are shared with the other party. The Platform does not monitor the content of private messages between Exchange users, but may review messages in response to reports of abuse, fraud, or policy violations.

Users should exercise caution when sharing personal contact information (phone numbers, addresses, meeting locations) through Exchange communications.

• Account Data: Retained while your account is active and for 30 days following account deletion to allow for reactivation.
• User Content: Public posts, reviews, and forum contributions are retained unless you specifically request deletion. Deleted content may be retained in backups for up to 90 days.
• Payment Records: Transaction records are retained for 7 years for tax and accounting purposes as required by law.
• Server Logs: Access logs and security logs are retained for up to 12 months.
• Analytics Data: Aggregated, non-personally-identifiable analytics data may be retained indefinitely.
• Communications: Support tickets and email correspondence are retained for 3 years.
• Market Listings: Active listings are retained while published. Sold, expired, or removed listings are retained in a non-public state for up to 12 months for dispute resolution, moderation records, and platform integrity purposes. Photos associated with removed listings are deleted within 30 days.
• GCA Compliance Certifications: Compliance acknowledgment records (timestamp, IP address, user account ID) are retained for a minimum of 7 years.

Firearms-Sensitive Data

BGC treats all Exchange-related data as heightened-sensitivity information given its association with firearms ownership. This includes listing data, messaging data, bid history, and compliance certifications. We apply encryption at rest (AES-256) and in transit (TLS 1.3) to all user data. We do not collect Social Security numbers, driver's license numbers, or financial account numbers from Exchange users. We do not sell, share, or monetize any data associated with Exchange use.

We implement reasonable technical, administrative, and physical safeguards to protect your personal information from unauthorized access, use, alteration, or destruction. These measures include:

• Encryption of data in transit using TLS/SSL
• Secure password hashing (bcrypt)
• Access controls and authentication for administrative systems
• Regular security monitoring and vulnerability assessments
• Self-hosted infrastructure under our direct control
• Database encryption and secure backup procedures
• IP-based rate limiting and abuse prevention
• Content Security Policy (CSP) headers

7.1 All Users

Regardless of your location, you have the following rights:

• Access: You may access and review the personal information we hold about you through your account settings or by contacting us.
• Correction: You may update or correct inaccurate personal information through your account settings or by contacting us.
• Deletion: You may request the deletion of your account and associated personal information by contacting us at [email protected].
• Communication Preferences: You may opt out of marketing communications at any time by clicking the "unsubscribe" link in our emails or adjusting your notification preferences in your account settings. Note that you cannot opt out of transactional communications related to your account or purchases.
• Data Export: You may request a copy of your personal data in a machine-readable format.

7.2 California Residents (CCPA/CPRA Rights)

If you are a California resident, you have additional rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act:

• Right to Know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purposes for collection, and the categories of third parties with whom we share your information.
• Right to Delete: You have the right to request that we delete your personal information, subject to certain exceptions.
• Right to Correct: You have the right to request correction of inaccurate personal information.
• Right to Opt Out of Sale/Sharing: We do not sell or share your personal information for cross-context behavioral advertising. Should this practice change, we will provide a "Do Not Sell or Share My Personal Information" link.
• Right to Limit Use of Sensitive Personal Information: You have the right to limit our use of sensitive personal information to purposes necessary to provide the services you requested.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA/CPRA rights.

To exercise your California privacy rights, contact us at [email protected]. We will verify your identity before processing your request. We will respond to verified requests within 45 days, which may be extended by an additional 45 days with notice.

Pursuant to California's Firearm Industry Responsibility Act (Cal. Civ. Code §§ 3273.50-3273.55), BGC maintains reasonable controls regarding Exchange listings. BGC does not sell, manufacture, distribute, or import firearms. Exchange listings are user-generated content published by third parties.

7.3 Residents of Other States with Privacy Laws

If you reside in a state with a comprehensive consumer privacy law (including but not limited to Virginia, Colorado, Connecticut, Utah, Oregon, Montana, Texas, Iowa, Indiana, Tennessee, and others enacted after the date of this Policy), you may have similar rights to those described in Section 7.2. To exercise your rights under your state's applicable law, please contact us at [email protected].

For privacy-related questions, requests, or complaints:

• Company: Boise Gun Collective, LLC
• Attn: Privacy
• Address: 784 S. Clearwater Loop, STE B, Post Falls, ID 83854
• Email: [email protected]