Birthday Bananas ("we," "us," or "our") operates birthdaybananas.com and the Birthday Bananas mobile app (together, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use the Service.
1. Information We Collect
Information You Provide
- Name and email address when you create an account, contact support, or subscribe
- An optional profile photo URL supplied by your sign-in provider
- Birthday month and day (to personalize your reward experience)
- Locations and search terms you enter, such as a city, ZIP code, or address
- Review text, reward results, location reports, and optional review photos
Information Collected Automatically
- Account and user identifiers when you sign in
- An app-generated device identifier and, if enabled, a push token
- IP address, including approximate location derived from it for nearby fallback, security, and rate limiting
- Browser or device type, operating system, pages or screens visited, app interactions, and in-app search history
- The brand, external destination URL, source screen, and device category when you choose a brand signup or claim link
- Crash logs and performance diagnostics that are not associated with your account user ID
- On Android, Google Maps SDK request and device metadata, an IP address (which can indicate approximate location), a Maps SDK-specific pseudonymous identifier, crash logs and diagnostics, and map interactions such as panning and zooming
- Referring website or search terms that brought you to the website
Location Choices
Approximate location derived from your request IP address is collected automatically. Precise GPS location is optional: we request it only after you grant foreground location permission for nearby search or crawl-arrival features. We do not collect background location. You can deny or revoke device location permission at any time.
Cookies and Similar Technologies
We use cookies, browser storage, and mobile on-device storage to remember preferences, signed-out saved or crawl changes, search location, and authentication state. We use the following analytics services to understand how people use the Service:
- Google Analytics — aggregate page-view and event analytics.
- Microsoft Clarity — heatmaps and session replay of interactions such as taps and scrolling so we can find usability issues. In the mobile app, Clarity runs anonymously: Birthday Bananas does not send its app-generated device ID or account user ID. Form inputs and sensitive text are masked by default. See Microsoft's Clarity privacy notice.
On the website, you can use the cookie banner or browser settings to control analytics cookies. Some features may not work properly without required storage.
2. How We Use Your Information
- To provide and personalize the Service (show nearby rewards, remember your preferences)
- To send you birthday reward reminders and newsletters (only with your consent)
- To sync My Birthday, saved rewards, crawls, reviews, and settings across sessions
- To improve the Service through usage analytics, crash reports, and performance diagnostics
- To measure reward engagement and paid sponsored placements, including impressions, clicks, saves, and detail views
- To detect and prevent abuse, spam, and unauthorized access
- To respond to your inquiries and support requests
3. How We Share Your Information
We do not sell your personal information. We may share information with:
- Service providers — hosting and authentication (including Vercel and Supabase), mapping (Google Maps), analytics (Google Analytics and Microsoft Clarity), diagnostics (Sentry), email delivery, and push delivery (Expo, Apple, and Firebase) that help us operate the Service
- Sponsored businesses — aggregate campaign totals such as impressions, clicks, saves, and detail views; we do not provide them with account IDs or individual activity records
- Legal obligations — when required by law, court order, or to protect our rights
- Business transfers — in connection with a merger, acquisition, or sale of assets
These providers process information for us under their applicable service terms. Sponsored placements are contextual rather than personalized with third-party data. We do not use personal information for cross-company advertising or tracking.
In our Google Play Data Safety disclosure, we report the provider SDK transmission described above as sharing. For the Android app, the shared categories are approximate location, crash logs, diagnostics, app interactions, and device or other IDs. Google uses this telemetry for analytics and to operate, measure, improve, and stabilize its mapping service. This Google Maps SDK telemetry does not include your Birthday Bananas account ID or review text, review photos, reward results, location reports, support messages, or other content you enter or upload to Birthday Bananas.
When you choose a brand signup or claim link, we retain the selected external destination URL, brand, source screen and type, device category, and a one-way daily session identifier to measure outbound and sponsored-placement performance. You are then redirected to the brand's own website. We do not monitor what you browse after leaving the Service. Those sites have their own privacy policies, and we encourage you to review them.
When you choose to create a public birthday plan or crawl link, anyone with the link—including anyone it is forwarded to—can view the public page. Creating the link makes it active even if you dismiss the share dialog, and it remains active until you revoke it or the Service expires it. Depending on the share type, the page can show your first name, birthday month and day, crawl title and scheduled date, selected brands, rewards, and business stops, offer and status or estimated- value details, and saved location names, addresses, and map coordinates. Public share pages do not include your email address or raw account identifier. You can revoke a birthday-plan link from My Birthday on the website and a crawl link from that crawl's details page. Do not share the link with people you do not want to see that information.
4. Data Retention
We retain account information while your account is active or as needed to provide the Service. You can request deletion at any time. After deletion, anonymous, aggregated information such as total reward-result counts may be retained when it can no longer be linked to you. Anonymous or older submissions that were never attributed to your account cannot be identified from an account-deletion request and may remain. We may also retain limited administrative, legal, security, fraud-prevention, payment, or audit records after removing account identifiers. The current mobile app does not send its account user ID to Microsoft Clarity or Sentry. Anonymous telemetry already processed by those providers follows their configured and contractual retention policies; contact privacy@birthdaybananas.com for a privacy follow-up.
5. Data Security
We use industry-standard security measures including HTTPS encryption, secure authentication, and access controls. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.
6. Your Rights and Choices
- Access and correction — You can view and update your account information at any time
- Deletion — Version 1.1.0 includes a signed-in account-deletion control in Profile; you can also use our direct web request path
- Location — You can deny or revoke precise device-location permission at any time; approximate IP-based location is automatic
- Email — You can unsubscribe from marketing emails using the link in each email
- Cookies — You can clear cookies and localStorage through your browser settings
If you are a California resident, you have additional rights under the CCPA, including the right to know what personal information we collect and the right to opt out of its sale (we do not sell personal information).
7. Children's Privacy (COPPA Compliance)
Our Service is not intended for children under the age of 13. We require all users to be at least 13 years old to create an account. The web profile birthday form uses a birth-year check when a birthday is entered, then stores only the birthday month and day; sign-in paths remain subject to the same minimum-age Terms. We do not knowingly collect, use, or disclose personal information from children under 13.
If we discover that we have inadvertently collected personal information from a child under 13, we will take immediate steps to delete that information and terminate the associated account. This includes deletion of:
- Account profile data (name, email, birthday)
- Saved crawl plans and stops
- Reviews, verifications, and submissions
- Any other data associated with the account
For parents and guardians: If you believe your child under 13 has created an account on Birthday Bananas, please contact us immediately at privacy@birthdaybananas.com. We will verify your identity and promptly delete the account and all associated data.
Users aged 13–17: If you are between 13 and 17 years old, you may use the Service with the consent of a parent or legal guardian. We collect only the minimum data necessary to provide the Service (email, name, birthday month/day for reward reminders). We do not sell, share, or use minor data for advertising purposes.
8. Birthday Bananas Mobile App
Birthday Bananas is also available as a mobile app for iOS and Android. The mobile app collects and processes the same categories of information described above, plus the following mobile-specific data:
Authentication providers
- Apple Sign-In (iOS only) — we receive an Apple-issued identifier and, on first sign-in, an email address (either your real address or Apple's private relay address, at your choice). We do not receive your full Apple ID. We use this only to create your account and sign you in.
- Google Sign-In — we receive your Google profile name, email, and avatar. We do not request any additional Google data scopes.
- Email + password — stored via our authentication provider (Supabase); passwords are hashed and never visible to us.
Push notifications
If you opt in to notifications, the app registers an Expo push token tied to an app-generated device identifier (not your IDFA or IMEI). We use this to send you birthday reminders, new-reward alerts, and crawl updates. You can revoke notification permission at any time in your device's Settings app.
Location
With your permission, the app sends precise foreground GPS coordinates and map bounds to our servers to show nearby rewards and support crawl-arrival features. If you do not grant permission, we use approximate location derived automatically from the request IP address. We do not collect background location.
Photo library
If you choose to attach a photo to a review, the app requests access to your photo library using your operating system's standard permission prompt. You pick the specific photo — we cannot read the rest of your library. The selected photo is resized on-device and uploaded to our storage for moderation and display.
Microphone and audio
The app does not request microphone permission and does not collect audio recordings.
Third-party SDKs inside the app
- Google Maps SDK — displays maps and business locations. On Android, Google automatically receives request and device metadata, an IP address (which can indicate approximate location), a Maps SDK-specific pseudonymous identifier, crash logs and diagnostics, and, when you use a map, interactions such as panning and zooming. These categories are shared with Google for analytics and provider operation; the SDK telemetry does not include the user-entered content listed above.
- Microsoft Clarity — session replay of app interactions such as taps and scrolling for usability analysis. Input text and form content are masked by default. Birthday Bananas does not send its app-generated device ID or account user ID to Clarity.
- Sentry — crash, error, and performance reporting. It collects stack traces, device model, OS version, and app state at the time of an error. The mobile app does not attach the account user ID to diagnostics.
- Expo Notifications — routes push tokens to Apple Push Notification service and Firebase Cloud Messaging. Content of notifications is controlled by us; the providers relay the payload to your device.
Advertising identifiers
Birthday Bananas does not use the iOS Identifier for Advertisers (IDFA) and does not request App Tracking Transparency permission. We do not track you across other apps or websites owned by other companies.
Data categories (App Store privacy labels)
The following categories are listed in our App Store privacy nutrition label and correspond to the data described above:
- Contact Info — name and email address (linked)
- Other Data — birthday month and day (linked)
- Identifiers — account user ID and app-generated device ID (linked)
- Usage Data — product interactions and sponsored-placement engagement, including advertising data for paid placements (linked)
- Search History — in-app search history (linked)
- Browsing History — external destination URLs selected from brand reward links (linked to a one-way session identifier)
- Location — optional precise foreground GPS and automatic approximate IP-based location (linked)
- User Content — review text, reward results, location reports, photos, and support requests (linked)
- Diagnostics — crash and performance data (not linked to the account user ID)
We do not collect microphone or audio data, financial information, purchase history, or contacts. We do not monitor browsing after you leave the Service.
9. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.
10. Contact Us
If you have questions about this Privacy Policy or your personal data, contact us at:
Birthday Bananas
Email: privacy@birthdaybananas.com