Privacy Policy

Last updated: January 10, 2025

1. Introduction

This Privacy Policy explains how Boundfire ("we," "us," or "our") collects, uses, stores, and protects your information when you use our services, including Boundfire Bond and PuppyClicker (collectively, "the Services"). By using our Services, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Boundfire Bond - Information You Provide

• Account Information: Email address, username, and password (encrypted)
• Profile Information: Display name, pronouns, bio, and avatar
• Relationship Data: Relationship roles, preferences, and settings
• Content: Messages, photos, videos, journal entries, and task data
• Location Data: GPS coordinates (only when explicitly enabled)

2.2 PuppyClicker - Information You Provide

• Account Information: Email address, username, and password (encrypted)
• Profile Information: Display name, pronouns, preferred terms, and avatar
• Friend Connections: Friend codes, friend relationships, and connection history
• Click Data: Click history, messages attached to clicks, and interaction logs
• OpenShock Configuration: API keys (stored encrypted), device IDs (hashed), intensity and duration preferences
• REST API Endpoints: Custom endpoint URLs and configurations (stored encrypted)
• Push Notification Tokens: Device tokens for delivering click notifications

2.3 Information Collected Automatically

• Device Information: Device type, operating system, and app version
• Usage Data: Features used, interaction patterns, and performance metrics
• Log Data: IP address, access times, and error reports

3. How We Use Your Information

3.1 General Use

We use collected information to:

• Provide and maintain the Services
• Enable relationship features and task management (Bond)
• Deliver clicks and notifications between friends (PuppyClicker)
• Send notifications (with your consent)
• Improve and optimize the Services
• Ensure security and prevent abuse
• Comply with legal obligations

3.2 PuppyClicker-Specific Use

For PuppyClicker, we additionally use your information to:

• Execute click commands to your friends' devices
• Send OpenShock commands (shock, vibration, sound) via the OpenShock API
• Trigger your configured REST API endpoints
• Deliver push notifications for received clicks
• Manage friend connections and approvals
• Enforce rate limiting and safety features

4. Data Security

We implement industry-standard security measures to protect your data:

• Encryption: All data is encrypted in transit and at rest
• API Key Security: OpenShock API keys and REST API configurations are encrypted using AES-256
• Device ID Hashing: OpenShock device IDs are stored as hashed values
• Access Controls: Strict authentication and authorization protocols
• Regular Audits: Security assessments and vulnerability testing
• Secure Infrastructure: Hosted on secure, compliant cloud infrastructure

5. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties.

We do not use your data for AI training or machine learning model development.

We may share information only in these circumstances:

• With Your Consent: When you explicitly authorize sharing
• Within Relationships (Bond): Content shared with your relationship partners
• Between Friends (PuppyClicker): Click notifications and messages sent to your approved friends
• Service Providers: Trusted partners who assist in operating the Services (under strict confidentiality agreements)
• Legal Requirements: When required by law or to protect rights and safety

5.1 Third-Party Services - PuppyClicker

PuppyClicker integrates with third-party services that have their own privacy policies:

• OpenShock: When you configure OpenShock integration, we send commands to the OpenShock API on your behalf. Your API key is never shared with other users. OpenShock's privacy policy applies to data processed by their service.
• Custom REST API Endpoints: When you configure custom endpoints, we send HTTP requests to your specified URLs. We do not control or monitor what these endpoints do with the data. You are responsible for the privacy practices of your configured endpoints.

6. Your Privacy Rights

You have the right to:

• Access: Request a copy of your personal data
• Correct: Update or correct inaccurate information
• Delete: Request deletion of your account and data
• Export: Download your data in a portable format
• Restrict: Limit how we process your data
• Object: Opt-out of certain data processing

7. Data Retention

We retain your data only as long as necessary to provide the Services and comply with legal obligations:

• Active Accounts: Data retained while account is active
• Messages (Bond): Deleted from our server within 90 days or once all users have a copy
• Click History (PuppyClicker): Retained for 30 days, then automatically deleted
• Deleted Accounts: All data deleted immediately, may persist in online backups up to 30 days and offline backups up to 90 days
• Legal Holds: Data may be retained longer if legally required

8. Location Privacy (Boundfire Bond)

Location features are entirely optional and require explicit consent:

• Location sharing is relationship-specific
• You control when and how location is shared
• Location history can be deleted at any time
• Geofencing data is only visible to authorized partners

9. OpenShock Data Handling (PuppyClicker)

For users who connect OpenShock devices:

• API Keys: Your OpenShock API key is stored encrypted and is never shared with other users or third parties
• Device IDs: OpenShock device IDs are stored as hashed values and are not shared
• Command Data: Shock, vibration, and sound commands are sent directly to OpenShock's API and are not logged permanently
• Intensity/Duration: Your configured safety limits are stored securely and enforced by our servers
• Revocation: You can remove your OpenShock integration at any time, which immediately deletes all stored API keys and device configurations

10. Children's Privacy

Our Services are not intended for use by anyone under 18 years of age. We do not knowingly collect personal information from children under 18.

11. International Data Transfers

Your information may be transferred to and maintained on servers located outside your country. We ensure appropriate safeguards are in place to protect your data in accordance with this Privacy Policy.

12. Third-Party Services

We use limited third-party services to operate our Services:

• Payment Processing: Stripe, Apple Pay, Google Play, Patreon (payment data not stored by us)
• Analytics: Anonymous usage analytics to improve the Services which don't include any media or personal information
• Cloud Infrastructure: Secure server providers
• Push Notifications: Apple Push Notification Service (APNs), Firebase Cloud Messaging (FCM)

13. Content Moderation and Safety

To ensure compliance with guidelines and user safety:

• Automated Scanning: Content is automatically scanned for policy violations
• Human Review: Reported content is reviewed by trained moderators
• Safety Measures: We implement technical measures to prevent harmful content
• Zero Tolerance: Content involving minors or non-consensual activities results in immediate account termination

14. Cookies and Tracking

We use minimal cookies and similar technologies:

• Essential Cookies: Required for authentication and security
• Preference Cookies: Remember your settings and preferences
• No Third-Party Tracking: We do not use advertising or tracking cookies
• No Cross-App Tracking: We do not track users across other apps or websites

15. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will notify you of any material changes via the app or email.

16. App Store Privacy Requirements

16.1 Apple App Store

For users who downloaded from the Apple App Store:

• All data collection is disclosed in our app store privacy labels
• iOS permissions require explicit user consent
• Sign in with Apple is supported as a privacy-focused authentication option
• We comply with App Tracking Transparency requirements

16.2 Google Play Store

For users who downloaded from Google Play:

• Data collection practices are disclosed in Google Play's Data Safety section
• All sensitive permissions are requested with clear explanations
• We comply with Google Play's privacy and content policies

17. Contact Us

If you have questions or concerns about this Privacy Policy or your data, please contact us:

• Email: privacy@boundfire.com
• Discord: discord.gg/j9CQJHAheM