Privacy policy

Your email address. We collect your email and verify it with a six-digit code (there are no passwords). We use it for two things: to tether you to the berries you have carried, so you can find them again, and to send word when one of your berries resurfaces somewhere new. Nothing else is sent to this address unless you separately subscribe to the newsletter.

Checkpoint text. When you add a checkpoint, we keep what you wrote — a free-text location and an optional note. Checkpoints are public: they appear on the berry's page for anyone holding it. They carry no name or identity — a checkpoint is attached to the berry, never to you — and they are permanent (see “Your choices and rights” below).

Order and shipping details. If you pre-order, you provide a shipping address and payment details at Stripe's payment step. Card details go straight to Stripe — we never receive or keep them. We hold the order record (what was reserved, the shipping address, the order status) to fulfil and support your order.

Newsletter. If you subscribe to the newsletter, we keep that email address to send the occasional word about new berries. It is kept separate from the tether above, with its unsubscribe link in every email — leaving the newsletter never touches the berries you have carried.

Analytics. We use PostHog for basic, privacy-minded analytics — page views and rough device and session information — to understand how the site is used. It is configured to send no email address, no berry name, and no berry URL. We do not sell your data and we do not track you across other sites for advertising.

There are no accounts. No usernames, no passwords, no profiles, and no settings to manage — so there is nothing to breach and nothing left behind. Access is by email code only.

We keep the list short and name each one plainly:

• Supabase — our database, where berries, checkpoints, and email records live.
• Stripe — payments, and the order and shipping details for pre-orders.
• Resend — sends our email: the verification code, the tether note, and order email.
• PostHog — privacy-minded analytics, configured as described above.
• Vercel — hosts the site and serves its pages.

Each handles data only to provide its service to us, under its published terms.

We use only what is needed to run the site and the privacy-minded analytics above. We do not use advertising or cross-site tracking cookies.

Email and checkpoint records last as long as the berries do — the journey is meant to be permanent. Order records are kept as long as needed for support, refunds, and legal and tax requirements. A newsletter subscription lasts until you unsubscribe.

You can, at any time:

• Ask what we hold about you and get a copy.
• Ask us to delete your email address and stop the tether notes.
• Unsubscribe from the newsletter, using the link in any newsletter email.

Depending on where you live, you may have further rights — access, correction, deletion, portability. Email support@bassberry.io and we will help.

The one thing we cannot delete is a checkpoint. Checkpoints are append-only, so the text you wrote stays on the berry's page — the journey is permanent and shared. We can delete your email and cut the link between you and a berry, but the words on the page remain (they were never tied to your name to begin with). The only exception is abusive or illegal content, which we can remove; this is described in our Terms of service.

BassBerry is not directed at children under 13, and we do not knowingly collect their information.

If this policy changes, the date at the top updates. Where a change is significant and affects you, we will send word by email where we can.

Privacy questions, or to make any request above: support@bassberry.io. BassBerry LLC, 8977 S 1300 W #3021 West Jordan, UT 84088.