New Bern Bear Hunt — Privacy Policy

Effective date: October 13, 2026 (updated to disclose Bear Patrol reports — missing-bear reports, alert answers, and map fixes — and the services that host the site and draw its map)

Operator: Matt (operator of New Bern Bear Hunt)

Contact: mattsapps321@gmail.com

Plain-English summary (read this first)

• We collect very little, and only to make the game work.

• No account needed to play. In guest mode, all of your game data stays on your own device — none of it is sent to us. The only things a guest ever sends us are Bear Patrol reports (like reporting a missing bear), and only if you choose to send one (Section 2).

• If you make an account, we store your email, your game progress (which bears you found, when, which mode), and the display name you put on your certificate, plus any Bear Patrol reports you send while signed in.

• Your photos are private to you. If you snap pictures with statues, they go into private storage that only you can open. We don't look at them, publish them, or share them.

• We do NOT track your location/GPS, run ads, or take any payment. We never sell your data, and we never share it except with the services that host, run, measure, and map the site for us (below).

• We measure the game with Google Analytics. It tells us things like how many people visited, which screens they looked at, which bears are being viewed, found, and photographed across all players, how often special offers get redeemed, and how many accounts get created — page views, scrolls, clicks on links that leave our site, and those in-app actions. It sets analytics cookies in your browser and sends measurement data to Google, but it records that activity against the bear, not you: it is not connected to your account, name, or display name, it never receives your photo images, we keep advertising features turned off, and Google says Google Analytics 4 doesn't log or store your IP address. (Details in Section 5; how to opt out in Section 12.)

• Deleting your data is self-serve: tap "Delete My Account" on the app's Account screen and your account, progress, photos, and any Bear Patrol reports saved to your account are permanently erased right away. Prefer email? That works too.

• North Carolina, USA is home base. We use a U.S. web host (Netlify) to serve the site and deliver Bear Patrol reports, a U.S. cloud provider (Supabase) to run accounts and storage, Google Analytics to measure site traffic, and OpenStreetMap to draw the map.

The full policy is below.

1. Who we are

New Bern Bear Hunt is a free mobile web app operated by New Bern Bear Hunt (an individual, not a company), based in New Bern, North Carolina. When this policy says "we," "us," or "our," it means New Bern Bear Hunt as the operator of the app.

This policy explains what we collect, why, and what we do (and don't do) with it.

2. The short version of what we collect

There are two ways to play, and they're very different for your privacy:

Guest mode — your game data stays on your device

If you play as a guest (no account), all of your game data stays on your own phone or device using your browser's local storage (technical terms: localStorage / IndexedDB — just storage built into your browser). Which bears you found, your timestamps, your mode, and your certificate name are saved only on your device. None of your game data is sent to us or stored on our servers. (Bear Patrol reports are the one exception, and only if you choose to send one — see below.) If you clear your browser data or lose the device, that progress is gone — because we never had a copy.

One thing applies to every visitor, guest or not: like most websites, we count overall site traffic with Google Analytics (Section 5). It measures visits, screens viewed, and in-app activity in aggregate — which bears get viewed, found, or photographed, plus special-offer redemptions and account sign-ups (Section 5) — it still doesn't know who you are, and you can opt out (Section 12).

Account mode — a little is stored in the cloud

If you choose to create a free account, we store some information in the cloud so your progress follows you. Details below.

Bear Patrol reports — only if you send one

Anyone can help the Bear Patrol keep the hunt accurate. All of this is optional:

• Report a Missing Bear (the button on each bear's page): which bear, its usual spot, the reason you picked, and anything you type in the optional note.

• Answer a Bear Patrol alert: when two or more different people report a bear missing, that bear's page asks visitors to help. You can answer "still missing," "it's back," or "here, but slightly off." An answer records which bear and which answer you picked.

• "Here, but slightly off": what doesn't match (the pin, address, clue, or something else), an optional note, and — only if you drag it — a suggested spot for the map pin. That pin is placed by your finger on the map, not taken from your phone's location. A suggestion never moves a bear by itself; we check it first.

Please don't put personal information (like your name or phone number) in a note — we don't need it.

How reports are stored and sent:

• Saved in our database (Supabase, Section 5), so we can track down the bear and spot misuse of these buttons (like fake or repeated reports). Other players can't see anyone's reports. The only things other players see are that a bear has an open alert, and any map-pin fix we've approved — neither says who sent anything.

• If you're playing as a guest: your report is saved without your name or any account. Instead, the app makes a random code the first time you send one and keeps it on your device. That code goes with your guest reports so one phone can't count as several people and so we can spot a device flooding the buttons. It isn't linked to any account, and clearing your browser's site data resets it.

• If you're signed in: your report is saved to your account — what you sent and when — so we can follow up on the report and spot misuse of the buttons. The Report a Missing Bear screen tells you this before you send. If you want a report removed, email us.

• Emailed to us through Netlify: missing-bear reports and "slightly off" fixes also go through our web host, Netlify (Section 5), which keeps a copy and emails it to us. (Alert answers aren't emailed.) Those emailed copies don't include your account or device code. Like any web server, Netlify may also record technical details with them, such as your IP address and browser type. If that send fails, the app opens your own email app with the report filled in — if you send that email, we'll see your email address, the same as any email you send us.

3. What we collect if you make an account

What — Why we have it

• Email address — So you can log in and so we can contact you (e.g., to help with your account).

• Password — To secure your login. We never store your password in readable form — it's handled securely by our sign-in provider (see Section 5). New Bern Bear Hunt cannot see your password.

• Game progress — Which bears you've found, timestamps, which mode you played, and any one-time special offers you've redeemed (so a used coupon stays used on all your devices) — so your hunt is saved.

• Display name — The name you type onto your completion certificate.

• Photos (optional) — If you choose to take pictures with statues, they're uploaded to private cloud storage.

• Bear Patrol reports (only if you send one while signed in) — Missing-bear reports, answers to Bear Patrol alerts, and map-fix suggestions — what you sent and when — saved to your account so we can follow up on the report and spot misuse of the report buttons (see Section 2).

That's the whole list. We don't ask for your real name, address, phone number, birthday, or anything we don't need.

4. Your photos are private to you

• Photos you upload go into access-restricted private storage. They are configured so that only the account that uploaded them can view them. (We've security-tested this restriction to confirm other users can't reach your photos.)

• We don't publish your photos, post them publicly, show them to other users, sell them, or use them to advertise the app.

• New Bern Bear Hunt does not browse user photos. They exist to run the photo feature for you.

• If you want your photos deleted, see Section 8.

5. The outside services we use (Netlify, Supabase, Google Analytics, and OpenStreetMap)

Netlify — hosting the site and the report forms

Our website is hosted by Netlify, a U.S.-based web host. Like any web host, it receives the technical information your browser sends when you load the app (such as your IP address and browser type) so it can deliver the site and keep it secure. Netlify also runs our Bear Patrol report forms: it receives missing-bear reports and map-fix suggestions, keeps a copy, and emails them to us (Section 2). Netlify handles this for us to run the site; we don't use it to advertise to you.

Supabase — accounts and storage

To run accounts and storage, we use Supabase, a third-party U.S.-based cloud provider. Supabase handles:

• Sign-in / authentication — securely checking your email and password so you can log in. This is why we never see or store your raw password.

• Storage — holding your account's game progress and your private photos, plus Bear Patrol reports (Section 2).

Supabase processes this data on our behalf to make the app work. We don't use Supabase (or anyone) to advertise to you.

Google Analytics — counting site traffic

To see how the site is doing, we use Google Analytics 4 (Google's "gtag.js" measurement tool). Here's exactly what that means:

• What it measures: page and screen views (including moving between screens inside the app), how far pages get scrolled, clicks on links that lead away from our site, and certain in-app actions — opening a bear's screen, marking a bear found, adding a photo to a bear, opening a bear's special-offer screen, and redeeming a special offer. Each of those per-bear actions records which bear it was about (the bear's name/number), and for special offers, which business's offer — but never your identity, and never the photo image itself (adding a photo only tells Analytics that a photo was added and to which bear — the picture stays in your private storage). Analytics also counts a few account moments — that a new account was created (and whether it was made with email or Google sign-in), that someone signed in, and that the create-an-account prompt was shown. These are bare counts: the event says "an account was created," never whose — it carries no email address, no name, and no account identifier. It also collects basic technical info like browser type and a general (city-level) location estimated from your internet connection — not GPS.

• Cookies: Google Analytics sets its own analytics cookies in your browser so it can tell a returning visitor from a new one. These are measurement cookies — not advertising or cross-site tracking cookies.

• Where the data goes: the measurement data is sent to and processed by Google. Google states that Google Analytics 4 does not log or store visitor IP addresses.

• What it is NOT connected to: your Bear Hunt account, email, or display name. The per-bear actions above are logged against the bear, not you — so while Analytics can see, in aggregate, which bears get viewed, found, and photographed and which special offers get redeemed across all players, it can't tie any of that to you or rebuild your personal hunt record. The account moments work the same way: Analytics learns that an account was created or signed in — never which account, and never your email address. And the photo image itself is never sent to Analytics — only the fact that a photo was added, and to which bear.

• No ads, no profiles: we keep advertising features turned off in our analytics (no Google Signals, no ad targeting). We use the numbers in aggregate — "how many people visited this week," "which bears get found most," "do people use the map" — never to identify, profile, or follow any individual person.

• Don't want to be counted? Section 12 tells you how to opt out. The game works exactly the same either way.

OpenStreetMap — the map

The map is drawn with map images ("tiles") from OpenStreetMap's public tile servers. To show the map, your browser asks those servers for the tiles covering the area on screen, so — like any website you load — they receive your IP address, your browser type, and which part of the map you're looking at (if you center the map on yourself, that's the area around you). We don't send them anything about you or your account. The "you are here" dot is worked out on your own device; your location itself is never sent to them or to us.

6. What we do NOT collect or do

We want to be clear about this, because it's unusual how little we take:

• ❌ No location / GPS tracking. If you allow it, the map shows a "you are here" dot — that's worked out on your own device, and we never receive or record where you are. Map-fix suggestions are pins you drag by hand, not your location. You walk the town yourself; we don't follow.

• ❌ No payments. The app is free. We collect no card or payment info.

• ❌ No ads. No advertising, no ad networks.

• ❌ No profiling. We use Google Analytics to count site traffic and to measure in-app activity in aggregate (Section 5) — which bears get viewed, found, and photographed, which special offers get redeemed, and how many accounts get created across all players. Those events are tied to the bear or the offer — never to your account or identity. We don't use Analytics, or anything else, to build a profile of you, follow you around the web, or target you.

• ❌ No advertising or cross-site tracking cookies. The only cookies are (1) what's needed to keep you logged in during your session and (2) Google Analytics' measurement cookies (Section 5).

• ❌ We do not sell your data. Ever.

• ❌ We do not share your data with anyone, except the service providers that host, run, measure, and map the app for us — Netlify, Supabase, Google Analytics, and OpenStreetMap (Section 5) — or if the law absolutely requires it (Section 9).

7. Children's privacy (COPPA)

• Accounts are for ages 13 and up. We don't knowingly create online accounts or collect personal information from children under 13. This follows a U.S. law called COPPA (the Children's Online Privacy Protection Act — it limits collecting personal info from kids under 13).

• Kids can still play — safely. Children under 13 are welcome to play in guest mode, where no game data is sent to us and it all stays on the device, under the supervision of a parent or guardian.

• Bear Patrol reports and kids: anyone can send a Bear Patrol report, including kids playing as guests. A guest's report is saved without a name or account (just the random device code described in Section 2). The note box is optional — grown-ups, please help kids leave out names, phone numbers, or other personal details. If a child's personal information reaches us in a report, we'll delete it as soon as we notice, and you can email us to make sure.

• Analytics and kids: our traffic counting (Section 5) runs for every visitor, including kids playing in guest mode. On purpose, we keep it to aggregate measurement only — visits, screens, and which bears get viewed, found, and photographed across all players: it collects no names or emails, isn't linked to any account or to any individual child's activity, and we never use it for advertising or to build a profile of any visitor — child or adult.

• Parents: if you believe a child under 13 created an account and gave us personal info, email us at mattsapps321@gmail.com and we'll delete it promptly.

8. Deleting your data (self-serve)

• Delete it yourself, instantly. Go to the Account screen in the app and tap "Delete My Account." After you confirm, your account, your game progress, any Bear Patrol reports saved to your account, and all photos you uploaded are permanently deleted from our systems right away.

• Deletion is permanent. We can't restore deleted progress or photos, so be sure.

• Report emails and guest reports: missing-bear reports and map fixes also arrive as emails (through Netlify), and those copies don't include your account, so deleting your account doesn't remove them. Reports sent as a guest aren't tied to any account either. If you want any of these deleted, email us and we'll remove them.

• Prefer email? You can also email us at mattsapps321@gmail.com and New Bern Bear Hunt will delete your data by hand. Because that route is manual, it may take a little longer than the in-app button.

• What stays on your device: deleting your account doesn't touch the copy of your progress saved on your own device — you can keep playing as a guest. To remove that too, clear your browser's site data for the app.

• Guest-mode data isn't ours to delete — it lives only on your device. To remove it, clear your browser's site data for the app.

9. When we might have to share data

Beyond the service providers that host, run, measure, and map the app for us (Netlify, Supabase, Google Analytics, and OpenStreetMap — Section 5), we don't share your data, with one narrow exception: if we're legally required to (for example, a valid court order or law), we may disclose information to comply with the law. We'll only share what we have to.

10. How we protect your data

• Passwords are handled securely by our sign-in provider and are never stored by us in readable form.

• Photos are kept in private, access-restricted storage that only the uploading user can reach (security-tested).

• That said, no system is perfectly secure. We do our best, but we can't guarantee absolute security — this is a free hobby app, so please don't store anything sensitive in it.

11. How long we keep your data

• Account data is kept while your account exists, so your progress is there when you come back.

• Bear Patrol reports: reports saved to an account are kept while the account exists and deleted with it. Reports sent as a guest, and the emailed copies of any report, aren't tied to an account, so deleting an account doesn't remove them — email us if you want one deleted (Section 8).

• Analytics measurement data is held by Google Analytics (Section 5). Google automatically deletes the detailed, event-level data after the retention period set on our analytics account; after that we only have the aggregate totals.

• If you ask us to delete it (Section 8), we remove it.

• If the app is ever discontinued, we'll take reasonable steps to delete stored user data.

12. Your choices

• Play as a guest if you'd rather not send us any account or game data at all.

• Don't want to be in our traffic counts? Block analytics with your browser's privacy settings or a content blocker, or install Google's opt-out browser add-on (https://tools.google.com/dlpage/gaoptout). The game works the same either way.

• Skip photos if you'd rather not upload any.

• Bear Patrol reports are optional. If you'd rather a report not be saved to your account, you can send it while signed out — or skip it.

• Delete your account yourself anytime with the in-app button, or ask us by email (Section 8).

• Use any privacy rights North Carolina or federal law gives you — email us and we'll help.

13. Changes to this policy

If we change what we collect or how we handle it, we'll update this policy and change the effective date at the top. If a change is significant, we'll try to make it noticeable in the app.

14. Governing law and contact

This policy is governed by the laws of the State of North Carolina, USA.

Questions, deletion requests, or concerns? Email mattsapps321@gmail.com.