DRAFT, not yet reviewed by a lawyer. Highlighted [bracketed items] must be filled in. Delete this box once the text is approved.

Privacy Policy

Version [v1], effective [date]. Operator: [legal name and address]. Privacy contact: [email].

What we collect

Account: your mobile number, province, display name, avatar or photo you upload, email (optional until you win), your confirmation that you meet the age requirement, and the invite code you used.
Play: which games you play, scores, times, entries, streaks, referrals, and the draw results.
Technical: IP address when you sign up and request codes, device and browser information, and the time of requests. We keep a sign-in token in your browser's local storage. We do not use advertising cookies or trackers.
If you win: your full legal name, email and your answer to the skill-testing question.

Why we use it

To create and secure your account, including checking that your number is a real mobile number and limiting one account per person.
To run the games, the leaderboard and the weekly draw, to check scores for cheating, and to pay and verify winners.
To send you texts: sign-in codes (always), and, only if you opt in, a daily reminder, a Thursday last-call and a result text.
To understand and improve the service (for example how many people play each day).

Text messages (CASL)

Reminder texts are sent only with your express consent, which you give by ticking the reminder box in the app. We record when and how you consented. Messages say who we are and how to stop. Reply STOP to any text, or turn reminders off in your profile, at any time. Message and data rates may apply.

Who we share it with

We do not sell your information. We use service providers that handle it for us: a text-message and phone-lookup provider (Twilio) that receives your number and message content, and a hosting provider [Fly.io, region Toronto]. These providers may process information outside Canada, where it may be accessible to authorities under local law. Your display name, avatar and points are visible to other players on the leaderboard; your number and email are not. We may disclose information when required by law.

Third-party resources

Our pages load fonts from Google Fonts and a 3D library from a public content network, so those providers can see your IP address when your browser loads them. [Remove this paragraph if these files are hosted on our own domain.]

How long we keep it

We keep account and play information while your account is active and for [e.g. 2 years] afterwards. Records of contest results, claims and consent are kept for [e.g. 7 years] for legal and audit reasons. Text logs are kept for [e.g. 2 years].

Your choices and rights

You can see and change your name, avatar, email and reminders in your profile. You can ask to see the personal information we hold about you, to correct it, or to delete your account, and you can withdraw your consent, by emailing [privacy contact]. Some records may need to be kept if you were a winner or if the law requires it. If you are not satisfied with our response you may contact the Office of the Privacy Commissioner of Canada.

Who can use Bash

Bash is for adults who have reached the age of majority in their province. We do not knowingly collect information from minors; contact us if you think a minor has signed up.

Security and changes

We protect information with access controls and encrypted connections, and store sign-in codes only in hashed form. No system is perfectly secure. We will post changes to this policy here and, for material changes, tell you in the app.