1. Information We Collect
We collect different types of information to provide and improve our service.
Account Data
When you create an account through Firebase Authentication, we collect your email address, display name, and authentication credentials. If you sign in via a third-party provider (such as Google), we receive the profile information you have made available to that provider.
Usage Analytics
We collect anonymized usage data including page views, feature interactions, lab completions, quiz scores, challenge attempts, and session duration. This data helps us understand how users engage with the platform and identify areas for improvement.
Device Information
We automatically collect certain device information such as browser type and version, operating system, screen resolution, and device model. This information is used for compatibility testing and to optimize the user experience across different devices and platforms.
2. How We Use Information
Your data is used exclusively to deliver, maintain, and enhance the BountyLabs experience.
- Service Delivery: To authenticate your account, sync your progress across devices, deliver lab environments, and provide AI-powered hints and feedback through our MiniMax AI integration.
- Analytics & Insights: To analyze aggregate usage patterns, track feature adoption, and measure learning outcomes. All analytics data is processed in an anonymized or pseudonymized form wherever possible.
- Platform Improvement: To identify bugs, optimize performance, develop new features, and refine existing content based on how users interact with labs, paths, and challenges.
- Communication: To send essential service-related notifications such as account verification, security alerts, and important platform updates. We do not send marketing emails without your explicit consent.
3. Data Storage & Security
We take the security of your data seriously and implement industry-standard protections.
All user data is stored on Google Cloud Platform via Firebase services. Data at rest is encrypted using AES-256, and data in transit is protected via TLS 1.2+. We enforce strict access controls, meaning only authorized personnel with a legitimate need can access production data, and all access is logged and audited.
Firestore security rules enforce per-user data isolation at the database level, ensuring that no user can read or modify another user's data through the client SDK. We regularly review and update our security policies and conduct internal audits to maintain the integrity of our infrastructure.
4. Third-Party Services
BountyLabs integrates with the following third-party services to deliver core functionality.
Firebase Auth
Handles user authentication, including email/password and federated identity providers. Subject to Google's Privacy Policy.
Cloud Firestore
Stores user profiles, progress data, notes, and application state. Hosted on Google Cloud Platform with region-specific data residency.
Vercel Hosting
Hosts the web application and may process standard request logs, performance diagnostics, and security telemetry. Subject to Vercel's Privacy Policy.
Dodo Payments
Processes payments for premium subscriptions. Dodo Payments handles all payment data directly; we do not store card numbers or CVV codes on our servers.
MiniMax AI
Provides AI-generated hints, explanations, and feedback within labs and challenges. User prompts sent to MiniMax are limited to task-relevant context and are not used to train external models. Subject to MiniMax's own data processing terms.
5. Cookies & Tracking
BountyLabs uses minimal tracking technologies to operate and improve the platform.
Hosting diagnostics: The hosted web application may generate standard server logs and security diagnostics. We do not load Vercel Analytics or other third-party tracking scripts from the application shell.
PWA Storage: As a Progressive Web App, BountyLabs uses local storage, IndexedDB, and the Cache API to store your preferences, offline content, and cached assets on your device. This data never leaves your device unless you explicitly sync it to the cloud via your authenticated account.
We do not use third-party advertising cookies, retargeting pixels, or cross-site tracking technologies of any kind.
6. Children's Privacy
BountyLabs is not intended for children under the age of 13.
Our service is designed for users aged 13 and older. We do not knowingly collect personal information from children under 13. If we become aware that a user under 13 has created an account or provided personal data, we will take immediate steps to delete the account and all associated information. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at connect@xalgorix.com so we can promptly address the situation.
7. Data Retention & Deletion
We retain your data only for as long as necessary to provide our services.
Your account data and associated progress are retained for as long as your account remains active. If you choose to delete your account, all personal data, progress records, XP, streaks, achievements, lab completion history, quiz scores, notes, findings, and wordlists will be permanently removed from our production systems within 30 days.
You can request account deletion at any time by visiting our account deletion page or by emailing connect@xalgorix.com. Anonymized analytics data that cannot be linked back to your account may be retained indefinitely for aggregate analysis.
8. Your Rights
You have control over your personal data.
Right of Access
You have the right to request a copy of all personal data we hold about you. Upon verification of your identity, we will provide your data in a structured, commonly used, and machine-readable format within 30 days.
Right of Correction
You have the right to request correction of any inaccurate or incomplete personal data. You can update your profile information directly within the app, or contact us for assistance with data corrections.
Right of Deletion
You have the right to request the deletion of your personal data. You may delete your account via the account deletion page, and we will process your request within 30 days. Note that certain anonymized data may be retained as described in our retention policy.
9. Changes to This Policy
We may update this privacy policy from time to time.
When we make material changes to this policy, we will notify you via an in-app notification or by email to the address associated with your account. The "Last updated" date at the top of this page reflects the most recent revision. We encourage you to review this policy periodically. Your continued use of BountyLabs after changes are posted constitutes your acceptance of the updated policy.
10. Contact Us
If you have questions or concerns about this privacy policy, reach out to us.
For privacy-related inquiries, data access requests, or to report a security concern, contact us at:
Email: connect@xalgorix.com
Company: Xalgorix
Response Time: We aim to respond to all privacy inquiries within 5 business days.