Privacy

The short version

Reading a board or writing on one takes no account, no email address and no name. Your message goes on the board you posted it to, it is deleted within at most 48 hours, and after that nobody — including us — can look up what you wrote.

The rest of this page is the detail behind that, and the exceptions to it. They are further down: messages are checked automatically before they appear, which involves sending the text outside Europe; a message that appears to threaten somebody’s safety is kept for 30 days; and the lines that entered a prize are kept while it runs and for up to seven days after it ends.

Who we are

BravoPin is run by Anatoli Iliev, an individual based in Bulgaria, and “we”, “us” and “our” mean him; BravoPin is the name of the service and not a company. His postal address is Golash 28, 1505, Sofia, Bulgaria, and contact@bravopin.com and the contact form at /contact reach him directly. He is the controller of the personal data this page describes.

For anything about your own data, write to privacy@bravopin.com. For anything else, contact@bravopin.com or the contact form. Wherever you are, including outside the European Economic Area, those addresses are the ones to use and everything on this page applies to you.

If you only read a board

We ask you for nothing and you give us nothing. There is no account and no sign-up.

Your browser stores a few of your own choices, listed further down, and those stay on your device. Our servers see the requests your browser makes, which includes your IP address, as every website’s do: we use the country it implies to order the board list by where you are. We do not keep your IP address in any of our own records. Our hosting provider’s runtime logs hold it for a short period, on the order of a day, as part of running and securing the service.

If you write on a board

Your message goes onto that board with the words you wrote, and a name only if you chose to type one. No account is attached to it and nothing on the board says who you are.

Every message is checked by an AI service outside Europe before it appears, and may be used to improve that service.

The first time you post in a visit, a check by our bot-protection provider confirms a person is posting; it reads signals from your browser and stores nothing on your device.

Alongside the message, and for no longer than the message lives, we keep a keyed hash of your IP address and, where your browser provides them, a keyed hash of some of your browser’s characteristics. These are pseudonymised rather than anonymous: they are still personal data, we hold the key, and we treat them accordingly. They exist so that one person cannot flood a board or vote a hundred times, and they are used for nothing else.

If the board’s owner is running a prize, your line is also copied into that prize’s entries, with the name it was drawn under, so the prize can be settled after the line itself has gone. Removing your own line does not remove that copy. The entries are kept while the prize runs and for up to seven days after it ends, and then deleted. The board’s owner and the people they have named as moderators can read them; while a prize runs the board may show the leading lines with the names they were drawn under and their vote counts, and after it ends the winning line, for five minutes unless the owner sets longer, up to a day; the owner can switch both off.

If you press to claim a line in a prize, you are shown a code, and the board’s owner and the moderators they named see it beside your line; if you are signed in, they also see your name and email address. Any guest with a line in the prize can press, while it runs or in the day after it ends, so pressing is not a claim that you won. The venue that runs a prize decides who wins and receives a claimant’s details; it is responsible for its own use of them.

Your device keeps random values of its own. One lets it offer to remove your message later. Another lets us count how many different phones wrote on a board in an hour: beside each message we keep a keyed hash of it, made separately for each board and deleted with the message, which is pseudonymised rather than anonymous, like the hashes above. Those values are the link between you and what you wrote that lives on your device, and clearing them means nobody including us can make that connection again.

Please do not put sensitive or private information in a message — anything about your health, your beliefs, your finances, or anybody else’s. A board is a screen other people are reading, a public board is on the open web, and once a line is up the only thing that takes it down early is you, from the device you wrote it on.

If you make a board

Then you have an account, and an account has an email address. We use it to sign you in and to tell you things about your own boards, including when one is about to be deleted. We do not send marketing. If you answer the question about how you heard of BravoPin, we keep your answer with your account. With your account we also keep, for each night your boards were used, a few counts of how busy they were; they stay after a board is deleted and go with your account. When you make an account or start a payment, we record the date and which version of the terms you accepted, for as long as the account exists, so we can show what was agreed.

If you make somebody a moderator, we use the email address you typed for them to send them one mail to say so. The mail names your own email address as the person who asked. We keep their address, and the note you left yourself, with the grant until you remove it, delete your account or they ask us to remove it. They need not have an account when you type it, so the mail says why they got it, points to this page and tells them how to ask to be removed.

If you run a prize, any guest who presses to claim a line in it, while it runs or in the day after it ends, is shown a code, and you see on your prize screen the code and the name their line was drawn under; if they were signed in, you also see their name and email address. Those are kept with the entries, for up to seven days after the prize ends. You decide who wins and you are responsible for your own use of what a claim shows you: to check and hand over that prize, and for nothing else.

You decide what your board is for, who you invite to it and how you run it, and you have your own responsibilities for it — the terms at /terms say what they are.

Deleting your account deletes your boards and everything on them, including messages other people wrote there. A board belongs to one owner and it goes when they do.

If you pay for a plan

If you pay for a plan, we hold what an invoice needs: your name, your company’s name, its VAT number and address, the invoices we send you and the payments recorded against them. We use it to invoice you, to be paid and to keep our accounts, on the basis of our contract with you and our legal obligation to keep accounting records. If you pay by card, Paddle.com Market Limited, our reseller, takes the payment and holds your card and billing details as the seller, under its own privacy notice at paddle.com/legal/privacy. We receive from Paddle only which account paid, for how many boards, how often and until when; never your card number.

On our payment page, Paddle’s script, which opens its payment form, also runs Paddle Retain, Paddle’s tool for recovering failed card payments and for its cancellation and payment-reminder messages. We tell it the payer’s Paddle customer number, where there is one, so that it can recognise them, and never our own account number or your email address. Paddle does this as the seller, in the same role as for the payment and under its own privacy notice.

We keep it for the period the accounting law where we are established requires, and then delete it.

Why we are allowed to do each of these

In the language the law uses, with the plain meaning beside it:

• Showing your message on the board you posted it to, and running the board — our legitimate interest in operating the service you chose to use, and for a board owner, our contract with them.
• Checking a message before it appears — our legitimate interest, and for the illegal-content check, compliance with a legal obligation.
• The keyed hashes that prevent flooding and vote-stuffing — our legitimate interest in the service working at all, which is also every other user’s.
• Counting how many different phones wrote on a board in an hour, from the keyed hash kept beside each message — our legitimate interest in knowing whether the boards are used; the hash goes with the message.
• The counts of how busy an owner’s boards were each night, kept with the account — our legitimate interest in knowing whether the boards are used, and the owner’s in a record that does not vanish with a board.
• Your answer to how you heard of BravoPin, if you give one — our legitimate interest in knowing how people find us; answering is optional.
• A board owner’s email address — the contract between us.
• A prize’s entries, and the name and email address a claim shows the venue — our legitimate interest, and the venue’s, in settling which line won and in verifying a claim before a prize is handed over. Pressing the claim button is what puts a signed-in guest’s details there; it is not the basis.
• The email address of a moderator an owner has named — our legitimate interest, and the owner’s, in letting the person they named help run their boards, and in telling them so.
• Invoices and the records behind them — the contract between us, and our legal obligation to keep accounting records.
• Measurement — your consent, where consent is required.
• Keeping a message that appears to threaten somebody’s safety — compliance with a legal obligation. See the section on it below.

How long we keep things

The real periods rather than a category:

• A message: between 45 minutes and 24 hours, decided by how busy its board is, and up to 48 hours where a board owner has set it that way. Then it is deleted, and the hashes beside it go with it.
• A board: a public one 48 hours after the last message on it has gone; a private one on the window its owner chose. Everything on it is deleted with it.
• A report you send us: the record that a report was made is kept; 30 days after it is closed, the reported text, anything you quoted and your email address are erased from it.
• The record that a message was refused: 90 days, with no text in it — which check refused it, and never what was written.
• A board owner’s account: until they delete it.
• A prize’s entries and any claim on it — the lines that entered, the name each was drawn under, the code a claimant was shown and, for a signed-in claimant, their name and email address: while the prize runs and for up to seven days after it ends, and then deleted. Deleting a prize deletes them at once.
• Invoices and billing records for a paid plan: for the period the accounting law where we are established requires.
• A moderator grant: the email address an owner typed and their note, until the owner removes the grant or deletes their account, or the person asks us to remove it.
• Mail you send us, by email or through the contact form: it sits in our mailbox for as long as we need it to answer you. If you were signed in when you used the contact form, we add to that mail your account’s email address and whether it is verified, whether the account is free or paid and how many private boards it may hold, how many boards it owns and which limits you reached in the last 30 days, so we know who is writing; nothing about it is stored anywhere else.
• Measurement data: the provider’s own retention. Our own figures are aggregates with nothing in them that points at a person.

There is nothing else. No profile, no history, no export. Nothing is moved somewhere quieter when a board closes, and once a message has gone, apart from a prize’s entries, nobody — including us — can look up what you wrote.

Who else may see anything

We use a small number of service providers to run the service, and each sees only what it needs to:

• The provider that runs the automatic message check, outside Europe including China. Your message text is sent to it. See the sentence about it above.
• Hosting, content delivery and bot-protection providers, in Europe and the United States. They see requests as any host does.
• Our database provider, in Europe.
• An email provider, in the United States, which sends our mail and so sees each whole mail and the address it goes to: a board owner’s, a moderator’s, or that of somebody who filed a report.
• The board’s owner, and the moderators they named, for a prize claim: they see the name and email address of a signed-in guest who claims a line.
• For a paid plan, our accountant, our bank and the software we invoice with, which see the invoices and the payments against them.
• Our mailbox provider, which holds the mail that reaches us, whether it was sent to our address directly or through the contact form.
• A measurement provider, in the United States, and only where you have consented.
• Law enforcement or another authority, where we are required to disclose something or where the section below applies.
• A professional adviser, or a buyer, if the service were ever sold or reorganised — in which case this page would change first.

Where a provider is outside the European Economic Area we rely on appropriate safeguards for that transfer, such as the European Commission’s standard contractual clauses or an adequacy decision, except where the sentence above says otherwise. We will name the current providers on request — write to the address above.

There are no advertising networks and no data brokers. Nobody buys anything from us, and we do not sell, rent or share personal data for anybody else’s marketing.

What is stored on your device

Almost all of it is your own choices, and almost none of it is a cookie. Nothing here builds a profile of you, and the only third-party cookie is the measurement one, which needs your consent. The payment page is the exception: Paddle’s own script runs there under Paddle’s privacy notice and may keep what it needs on your device to take the payment.

A board put on a television through BravoPin — from its owner’s phone, through a Chromecast, or on a TV linked to an account — stores nothing. It draws no cookie question, because nobody at a screen can answer one, and it sends nothing to a measurement service. It keeps no vote, no message and no device value of its own, so there is nothing on that screen to clear. A television that opens a board’s ordinary page in its own web browser is a browser like any other: it shows the cookie question, and sets the measurement cookie only if somebody presses Accept.

You can clear all of it at any time by clearing this site’s data in your browser. Once you have answered the cookie banner you can change that answer, or withdraw it, from Cookie settings in the display menu on any page, and you can object to measurement from the same place.

Your rights

You can ask us for a copy of the personal data we hold about you, to correct it, to delete it, to restrict how we use it, to object to our using it, or to have it sent elsewhere. Write to privacy@bravopin.com. We answer within one month, which the law allows us to extend where a request is complex, and we usually answer sooner.

Two limits, and the first is the design rather than a policy. Most of what we hold cannot be connected to a person: if you wrote a message with no account, we have no way of finding it from your name or your email address, and we cannot invent one. What you have instead is your own device — the remove control on your own message is an erasure route that needs no request and no proof of who you are, and it works because your device holds the only link. Second, we may need to be satisfied of who you are before acting on a request, and some rights do not apply, or apply only in part, where the law says so.

Where something we hold forms part of a record relating to a suspected criminal offence, we may be restricted in what we can tell you about it. Where that applies we will say so, in the same words to everybody who asks, and it does not mean anything about you either way.

You can also complain to a data protection authority — the one where you live, where you work, or where you think the problem happened. We would rather you came to us first, and we will not treat you any differently if you do not. Our lead authority is the Commission for Personal Data Protection in Sofia (cpdp.bg).

One exception: a threat to somebody’s safety

If a message is refused because it appears to threaten somebody’s life or safety, we keep that message for 30 days and may pass it to law enforcement. We are required to. While we hold it, the rights to object and to erasure do not apply to it.

This describes a category and not an accusation. It is written here because it is the one place in the service where something is kept that the person who wrote it cannot have removed, and a policy that left it out would be untrue by omission. Nothing else works this way, and reporting something you have seen needs no account at all: /notice.

Security, children, and changes to this page

We take reasonable technical and organisational measures to protect what we hold, and the strongest of them is holding very little for very long. No service can be guaranteed completely secure, and we do not promise that.

The service is not directed at children under 13 and we do not knowingly collect their personal data. If you believe a child under 13 has used it, write to the address above and we will delete what we have.

If this page changes, the date at the top changes with it. If a change matters to board owners we will email them, because an account has an address on it; a reader has no address with us, which is the whole design, so a reader should check back here.

Everything stored, item by item