Platform policy

Privacy Policy

Version 1.20 · Effective 2026-11-10

Privacy Policy

This policy explains what personal information the Service collects, how it is used and who it is shared with. The Service is operated by Bright Board Shop LLC ("we", "us").

1. Scope

This policy covers the public community sites, the Town Today mobile app, subscriptions purchased through the app, and the shared account, registration, directory, event, vendor and administration features of the Service. Event organizers and outside providers may have their own privacy notices, which apply to what they do.

2. Information we collect

Depending on how you use the Service, we may process:

• names, organization names, email addresses and telephone numbers that you give us;
• event, listing, vendor and registration details you submit, including answers to custom registration questions;
• photographs and addresses or locations you choose to provide;
• email preferences and the topics you chose;
• for marketing emails we send you, whether the message was opened and which of its links were used (see section 4);
• account and role information, sign-in records and security and audit records;
• limited technical and usage data, such as pages visited, device and browser type, and approximate location from your network connection;
• if you use Town Today Pro in our mobile app: an anonymous RevenueCat customer identifier, subscription purchase and status information processed by RevenueCat, and the limited subscription access records described in section 5A;
• if you use our mobile app: the town you choose, a random identifier the app creates on your phone, crash and error reports, limited usage and device information, and, only if you turn on notifications, a notification token for your phone and the kinds of alert you chose, and, only if you write to us from the app's Contact screen submit an event in the app, register for an event in the app, sign up to volunteer in the app, express interest in being a vendor at an event in the app, enter a decorated home in a contest in the app, apply to host a location at an event in the app, sign in as staff in the app, or ask us to bring your town to the app, what you enter there (for example your message, the event details, your and the organizer's names, email addresses and phone numbers, your registration answers, the business and contact details you enter as a vendor, the home's address, a photo and the name and line you add to a contest entry, the contact, mailing and location details and typed signature on a location contract, your volunteer sign-up answers including your date of birth, the shifts you choose and, if you are under 18, a parent or guardian's details, the contact details of someone in your town you suggest we talk to, and, for staff sign-in, your email address and the phone you sign in on and any photos or documents you attach to event records), as described in section 5A.

Please do not give us information you do not need to share. Optional fields are optional.

3. How we use it

We use information to answer messages, show listings that were approved for publication, process registrations and organizer review, manage business listing claims, send service messages, honor the email preferences you choose, manage and verify mobile subscriptions, provide access to subscribed content, keep accounts and the Service secure, investigate misuse, keep information accurate, run contests, and improve the Service. Marketing email is separate from what is needed to process a registration, and a registration does not depend on agreeing to marketing.

4. Email and preferences

Some registration forms show an optional email checkbox for community events and things to do. It may appear already checked. If you leave it checked, you may receive those emails; if you uncheck it, you will not be subscribed. You can change your preferences or unsubscribe using the link in any such email or by contacting us. We keep a record of the choice you made.

Measuring our marketing emails. When we send you a marketing email, we measure whether it was opened and which of its links were used, so we can see what is useful and improve what we send. We do this with a tiny image in the email and with links that pass through our own web address before taking you to the page you chose. Each message carries a random code that belongs to that one message and does not contain your name or email address. We record the time, the kind of action (opened, link used, or unsubscribed from that message), and a rough label for whether the request looked automated, such as a security scanner or an email privacy feature. We do not store your IP address or your device or browser details for this measurement, although our hosting providers' ordinary technical logs, described in section 5, may contain them. We review the results as totals for each email, we do not use them to build a profile of you, and we do not share them with advertisers. Opens are only approximate: some email programs load images automatically, which can count as an opened message even if you did not read it, and others block images, which hides a real open. We keep these records for up to about 13 months. Service messages, such as registration confirmations, are not measured this way. If you do not want this measurement, unsubscribe using the link in any marketing email or write to us at support@mtpulaskitoday.com, and consider turning off automatic image loading in your email program.

5. Analytics, cookies and browser storage

We use analytics to understand how the Service is used, and our hosting and security tools keep server logs. We use PostHog for product analytics (on our websites and in our mobile app) and Cloudflare for hosting and web analytics. The Service also uses browser storage for sign-in sessions and remembered settings. Internal staff browsing is excluded from public analytics. You can limit cookies and storage in your browser settings, though some features may then not work.

5A. The mobile app

Our mobile app, Town Today, shows community information from towns available through the Service. The app has no accounts for the general public; organizers and staff can sign in. The app does not ask for your name, email address, phone number or contacts unless you choose to use a feature that needs them. It does not use your phone's location. It accesses a photo only if you choose one for a contest or, if you are staff, to attach to an event record or to add to a contest entry. The app also creates identifiers and processes limited technical, usage and subscription information even when you do not submit a form, as described below.

What the app collects.

• A random identifier. When you first open the app it creates a random code and keeps it in your phone's secure storage. We store only an irreversible fingerprint of it. We use it to check that the app is allowed to load a town and to protect our servers from abuse. It is not used for advertising or tracking and is not shared with advertisers.
• Usage and crash information. We use PostHog, our analytics provider, to receive: which town you chose; which sections you open and how many items loaded (for example "a park was opened", never which park); whether an invite code was accepted (never the code); crash and error reports; the app version; and standard device information such as operating system and version, device model and language. This information does not include anything you type, and we do not record your screen. The analytics service uses its own random identifier, which is separate from the identifier above. We ask it not to look up a location from your network address and to discard the address rather than store it.
• Server records. Our hosting and database providers (Supabase and Cloudflare) process the requests the app makes to load information, as they do for our websites, and keep ordinary technical logs.
• Notifications, only if you turn them on. The app can send alerts about your town, such as water or power outages, boil notices and road closures. They are off until you turn on "Send alerts to this phone" in the app's Settings, and your phone asks your permission first. If you turn them on, we store a notification token for your phone (a code created by our notification provider, Expo), the town and the kinds of alert you chose, and your sound and vibration choices, so we can send you the alerts you asked for. Each alert is written and sent by a person at our organization, not automatically, and is not an emergency service: for an emergency, call 911. Your notification token and each message pass through Expo and then Apple or Google, who deliver it to your phone. We keep the token until you turn notifications off, the app is removed from our system, or the notification provider tells us the token no longer works.
• Town Today Pro subscriptions. Town Today offers an optional paid subscription called Town Today Pro. One subscription gives access to every live town in the app. A sample town is free, and signed-in town staff do not need a subscription. Purchases are made through Apple's App Store or Google Play, which process payment under their own terms. We do not receive your payment-card number or Apple or Google account information. We use RevenueCat to manage subscriptions. The app creates a random, anonymous RevenueCat customer identifier. RevenueCat processes this identifier, purchase and subscription information from the store, and technical information as explained in its privacy notice at https://www.revenuecat.com/privacy. Our server, through Supabase, asks RevenueCat whether the subscription is active and stores, for each installation, an irreversible installation fingerprint, the RevenueCat customer identifier, the subscription end date and the time of the most recent check. We use these records to check subscription access and administer the Service. We do not use these subscription records for advertising or share them with advertisers. Cancelling or removing the app does not automatically delete these records; see sections 7 and 8.
• Messages you send us, only if you send one. In More, then Contact, you can write to us. If you send a message, we receive its text, the kind of request you chose, your town and the app version, and your email address only if you ask for a reply. We do not ask for it otherwise. The message is emailed to our support team through our email delivery provider (Resend) and we use it to answer you, fix problems and improve the app; we do not keep it in the app's database and do not use it for advertising. Please do not include sensitive information, such as payment details or passwords, in a message.
• Events you submit, only if you submit one. In More, then Submit an event, you can send us an event for review. If you send one, we receive the event details you enter (title, description, date, time, place and address, cost and any web links), your name and email address, and the organizer's name, email address and phone number. Our reviewers use this to check the event, contact you or the organizer with questions, and publish the event; the event details may be published, but your and the organizer's contact details are used only by our reviewers and are not shown in the app. This works the same as the Submit an Event form on our websites and is stored in the same review system (Supabase), which sends you a confirmation email through our email provider (Resend). Please do not include sensitive information.
• Event registrations, only if you register. In More, then Event registration, you can register for an event that has registration open (for example a trunk, or your family or group at Trunk or Treat). If you register, we receive the entry or group name, an organization if you give one, a contact name, your email address and/or phone number, and the answers that event asks for (for example how many adults and children are attending, your hometown or ZIP code, or the space a trunk needs). The event's organizers use this to run the event, to contact you about it, and to count and place participants; an entry name may be published in a public lineup only if the registration says so and you agree. If the event also runs a voting contest for its registered entries (for example the Trunk Decorating Contest at Trunk or Treat), the entry name you registered with, and the photo organizers take of your entry, may be shown in that contest once organizers approve it; this is separate from the public lineup and does not depend on it. If you tick the optional box, we also add your email address to our events email list; the box is not ticked unless you tick it. This is the same as registering on our websites and is stored in the same system (Supabase). The app does not keep your registration on your phone. Some events set up a shared tablet where people register one after another; the tablet clears each form after it is sent.
• Town requests, only if you send one. If you cannot find your town in the app, you can ask us to bring it there (from the town list or the screen where you enter an access code). If you send a request, we receive the name of your town and your email address and/or phone number, and anything else you choose to add: your state, your name, your connection to the town, an organization or office, the name, role and contact details of someone in your town we could talk to, what you would like to see, and how you heard about us. We use it to get in touch with you, or with the person you suggest, about bringing your town to the app, and to see how many people are asking for each town. It is stored in our database (Supabase) and emailed to our support team, together with a short code made from your install that cannot be turned back into the install and that lets us tell repeat requests from one phone apart. We do not sell it and do not add you to a mailing list because you sent a request. If you give us someone else's contact details, please do so only if you think they would welcome hearing from us. You can ask us to delete your request at any time.
• Volunteer sign-ups, only if you sign up. In More, then Volunteer, you can sign up for a role. If you do, we receive your first and last name, your email address, your date of birth, the shifts you choose and how you would like to be reached, and anything else you choose to add: your phone number, an emergency contact's name and phone number, notes about restrictions or accommodations, and your skills or experience, plus a shirt size where the role gives one. If you are under 18 we also receive a parent or guardian's name and email address and/or phone number, and if you are under 13 we ask a parent or guardian to complete the sign-up. We use this to schedule volunteers, check each role's age rules, contact you and your parent or guardian about your shifts, and keep volunteers safe. It is stored in our database (Supabase) and seen by the volunteer organizers for your town. After you sign up, the app shows you a private link on your screen for reviewing or changing your sign-up on our website; keep it private, because anyone who has it can see your details. We do not sell it, and we do not add you to a mailing list because you volunteered. Please do not include medical details beyond what an organizer needs to keep you safe. You can ask us to delete your sign-up at any time.
• Vendor interest and vendor listings, only if you send them. For an event that is still being set up, you can tell the organizers you would like to be a vendor. If you do, we receive your business or booth name and category, the name and email address of your contact person, and anything else you choose to add: a phone number, a description of what you offer, your website, Facebook page or Instagram name, and notes. The organizers use it to decide who to invite to the event and to contact you, and we email you a confirmation. It is stored in our database (Supabase) and seen by the event organizers for your town; your contact details are not published. If you add yourself to a stop of an event (for example a location at Christmas on Vinegar Hill), we also receive the stop you choose and where to find you, and any public email address or phone number you choose to add; those, your business name, description and links may be shown with your listing once the organizers approve it. The private contact name, email address and phone number you give are never published. We do not sell it. When you apply to be a vendor in the app, a box that says "Email me about vendor opportunities" is checked to begin with. If you leave it checked, we add the contact email you gave to our vendor opportunity emails, without first asking you to confirm the address; every one of those emails has an unsubscribe link. If you uncheck it, or apply on our website, we do not add you to a mailing list because you sent the application. If we cannot place your application, we keep it on file for that event and may email you when vendor applications for that event reopen; the email we send you when we cannot place you contains a link to stop this and to choose other events, and we never add you to other events unless you choose them. You can ask us to delete it at any time.
• Contest entries and votes, only if you send them. In a contest such as Halloween house decorating, you can enter a decorated home and vote for homes in the gallery. If you enter a home, we receive the address of the home, one photo you choose from your photo library, and anything else you choose to add: a name for the home and a line about it. The app does not ask for your name or contact details for an entry. You choose the photo yourself in your phone's photo picker; the app does not open your camera and cannot see your other photos. Event organizers review each entry before it appears. Once approved, the address, photo, name, line and vote count are public in the app and on our website. Please enter your own home, or one whose owners would welcome it. Photos are stored in our file storage (Supabase) and can be seen by anyone who has their web address. To vote, we keep a code made from your install (not your name) so each phone votes once. We do not sell any of this, and we do not add you to a mailing list because you entered or voted. You can ask us to remove an entry or photo at any time, and the app has a "Report this photo" link on every photo.
• Location applications, only if you send one. For an event that is taking location applications, you can complete and sign its location contract in the app. If you do, we receive the contract's answers: your contact name, phone number, email address and mailing address, the name and address of the location, an optional website, a short description for the printed flyer, the other answers the contract asks for, and your typed name and the date as your electronic signature, which you agree to before you can send it. The event organizers use it to review your location, add it to the event, and contact you. It is stored in our database (Supabase) and seen by the event organizers for your town; your contact details are not published, and the location's name and address may be published if the organizers add it to the event. Fees are paid separately, by check, and we do not receive any payment details through the app. We do not sell it, and we do not add you to a mailing list because you sent it. You can ask us to delete it at any time.
• Staff sign-in and tools, only if you are staff. Committee and board members, event organizers and administrators can sign in with the email address that has access on our websites. If you do, we receive your email address (to send you a one-time code, through our authentication provider, Supabase), and we keep a record of the phone you signed in on: a name for it (the phone's model), whether it is an Android phone or an iPhone, the date you signed in and the last time it was used, and an irreversible code made from your install. We use it to check your access on every request, to end access that was not renewed in 14 days, and so that an administrator can end access on a lost or unwanted device or suspend an account; they are emailed when a device is ended. Your sign-in is kept in your phone's secure storage and is removed when you sign out. Once signed in, you see and add to the same event planning and review information you can use on our websites, within the access you already have there: tasks, discussions, meeting notes and minutes, contact details of vendors, volunteers and committee members, applications and submissions that people have sent us, and, for volunteers, the details they gave when they signed up that organizers need on the day: their age (not their date of birth), a parent or guardian's name and contact details if they are under 18, an emergency contact, and any restrictions they told us about. What you add (a comment, a note, a task, a decision on an application, a note to an applicant, or a photo or document you attach, such as a contract, invoice, proof or artwork for an advertising campaign) is saved to our database under your name, as it is on the website, and a decision may cause the website to email the person who applied. A photo or document you attach is taken with your phone's camera, or chosen from your photos or files, only when you choose to add one; it is stored privately with the event's records, is visible only to people who have access to that event, and is opened for you through a link that expires after ten minutes. Organizers of a contest that takes photos only from organizers (for example a trunk decorating contest) can also take a photo with their phone's camera, or choose one from their photos, to add to a registered entry. Unlike the files above, that photo is stored in the contest's file storage (Supabase); once the entry is approved, the photo and the entry's registered name are public in the app and on our website, and anyone who has the photo's web address can see it. The app does not read your other photos or files. Saving a contact to your phone is only done when you choose it, and uses your phone's share screen; the app does not read your phone's contacts. We do not use staff information for advertising and do not share it.

Your choices. In the app, open More, then About and privacy, and turn off "Send crash reports and usage". It takes effect immediately and is remembered on your phone. In More, then Settings, you can turn notifications off at any time, which deletes your notification token from our system, and choose which kinds of alert you receive. If you subscribe to Town Today Pro, you manage and cancel it through the Apple or Google account used for the purchase. Uninstalling the app does not cancel your subscription. Uninstalling removes the locally stored installation identifier, but does not automatically delete server subscription records. You can request deletion under section 8.

Links to our website. When something else needs personal details, the app may open our website in your browser. What you enter there is covered by the rest of this policy. Opening a map, phone call, email or an outside website from the app is handled by your phone and by that service under its own privacy notice.

Children. The app is for a general audience and is not directed to children under 13. See section 9.

6. Who we share information with

• Event organizers and organization administrators may see registration and submission details they need for their event or listing.
• Service providers process information for us. Today they include Supabase (database and accounts), Cloudflare (hosting and analytics), PostHog (analytics), Resend (email delivery), RevenueCat (subscription management) and, only if you turn on notifications in the mobile app, Expo (notification delivery). Mobile subscriptions are purchased through Apple or Google under their own terms. Payment pages run by PayPal are operated by PayPal under its own terms. We do not receive your payment-card number from these providers.
• Listing information that has been approved for public display can be seen by anyone. Registration contact details are not made public.
• We may disclose information when required by law or to protect people, the Service or others from harm.

We do not sell your personal information.

7. Keeping information

We keep information only as long as needed for the purposes described above, including operations, security, accounting, legal and archival needs. The period depends on the information and why we need it. Backups may keep copies for a limited time after deletion.

For Town Today Pro, our server keeps an irreversible installation fingerprint, the RevenueCat customer identifier, the subscription end date and the time of the last check. We currently have no automatic process for deleting those records after cancellation, expiration or removal of the app, so they may remain after access ends. You can request deletion under section 8; we will review your request and may retain information we are required or permitted to keep. Deleting information from our servers does not automatically delete information retained by Apple, Google or RevenueCat.

8. Your choices and requests

You can ask us to access, correct or delete personal information, or to stop sending you emails, by writing to support@mtpulaskitoday.com. If you use the mobile app, you can turn off crash reports and usage and notifications in the app. You can also request deletion of information associated with an installation or Town Today Pro subscription. We may need more information to identify the record because we store an irreversible fingerprint rather than the original installation identifier; tell us the town and approximate date you installed the app, and we will tell you what else we need. Cancellation is handled through Apple or Google; a deletion request made to us does not cancel your subscription or automatically remove purchase information held by Apple, Google or RevenueCat. We may need to confirm who you are and may retain information we are required or permitted to keep. Rights that apply to you depend on where you live.

9. Children

The Service includes family and school activities, but it is not directed to children under 13, and we do not knowingly collect personal information from them. A parent or guardian may submit a registration that includes children's names, attendance or photos for an event. If you believe a child's information was provided without proper permission, contact us and we will review and remove it where appropriate.

10. Security

We use technical and organizational measures to reduce risk, including access controls and audit records for administrator activity. No online system can promise perfect security. If an incident affects your information, we will notify you when the law requires.

11. Changes

We may update this policy. The current version and effective date are at the top of this page, and we will give appropriate notice of material changes.

12. Contact

Bright Board Shop LLC, PO Box 91, Mt. Pulaski, IL 62548. Email: support@mtpulaskitoday.com.