The Boot Ledger Privacy Policy

1. Information we collect

Google sign-in information

The Boot Ledger uses Google to authenticate accounts.

When you sign in with Google, we receive and retain only the information reasonably necessary to identify and operate your account, including:

• Your verified email address
• Your email-verification status
• A stable identifier assigned to your Google account
• Internal Boot Ledger user and account identifiers
• Account creation and update timestamps
• Session information necessary to keep you signed in
• Temporary security information used to complete or safely recover the sign-in process

The Boot Ledger does not intentionally request or retain:

• Your Google password
• Your Google real name
• Your Google given name or family name
• Your Google profile photograph
• Google access tokens
• Google refresh tokens
• Google ID tokens after authentication is completed
• Authorization to access Gmail, Google Drive, Google Calendar, Google Contacts, or other Google services

Google handles your Google credentials and authentication. The Boot Ledger never receives your Google password.

Public profile information

The Boot Ledger creates a public pseudonymous handle for each account.

We retain:

• Your public handle
• A normalized version of the handle used to enforce uniqueness
• The date and time you acknowledged this Privacy Policy
• The version of the Privacy Policy you acknowledged
• Profile creation and update timestamps

Your public handle is visible to other users and may appear with your identifications, proposals, evidence, and other public contributions.

We strongly encourage you not to use your real name, email address, or other identifying information in your handle.

Legal-document records

We retain each Privacy Policy version you acknowledge, each Terms of Service version you accept, and the corresponding dates. These private records are associated with your internal user ID and are used to determine whether your account may make public contributions and to preserve legal-document history.

These records do not include your email address, IP address, browser user-agent string, session token, OAuth data, or browser fingerprint.

Requests and correspondence

Legal, copyright, safety, support, or privacy requests and related correspondence may include your name, email address, mailing address, telephone number, signature, relevant Boot Ledger URLs or contribution identifiers, correspondence, and other information reasonably necessary to process the request or comply with law.

Do not provide unrelated sensitive information.

Content you submit

We collect content that you choose to submit to the service, including:

• Boot photographs
• Identification requests
• Brand, model, style, and marking information
• Identification proposals
• Supporting evidence
• Descriptions and other text
• Revision, archival, resolution, and moderation information
• Timestamps associated with contributions

Content submitted to public portions of The Boot Ledger is public. It may be viewed, copied, indexed, quoted, or shared by other people.

Do not include personal information in public submissions unless you are comfortable making it public.

Photograph and file metadata

Uploaded photographs and files may contain embedded metadata, such as the date a photograph was created, the device used to create it, and potentially location information.

You should remove metadata that you do not want processed or stored before uploading a file.

The Boot Ledger does not intentionally use photograph metadata to identify or track users. However, we cannot promise that every uploaded file has had all metadata removed unless the service expressly confirms that removal during upload.

Technical and security information

Our application intentionally avoids storing IP addresses and browser user-agent strings in its account and session database.

However, internet infrastructure necessarily processes certain technical information when you connect to the service. Our hosting, security, and network providers may temporarily process information such as IP address, request time, requested URL, browser or protocol information, security and abuse-detection signals, and network or service errors.

We use this information only as reasonably necessary to operate, secure, troubleshoot, and protect the service.

Cookies

The Boot Ledger uses cookies that are necessary to complete Google authentication, protect the sign-in process, maintain your signed-in session, and prevent certain security attacks.

We do not currently use advertising cookies or cookies for cross-site behavioral advertising.

Disabling essential cookies may prevent account sign-in or other authenticated features from working.

2. How we use information

We use collected information to:

• Authenticate users
• Maintain user accounts and sessions
• Generate and manage public handles
• Display public contributions and attribution
• Operate the boot-identification service
• Prevent duplicate or conflicting account records
• Detect, investigate, and prevent abuse or security incidents
• Enforce service rules
• Respond to support, privacy, and legal requests
• Maintain, troubleshoot, and improve the service
• Comply with applicable law

We do not use your email address as your public identity.

We do not use your email address as the permanent provider-side key for your Google account.

3. Information visible to the public

The following information may be public:

• Your public handle
• Photographs and text you submit publicly
• Identifications, proposals, evidence, and resolutions associated with your handle
• Dates or times associated with public contributions
• Public moderation or archival status where relevant

The following information is not intended to be public:

• Your email address
• Your Google account identifier
• Internal authentication identifiers
• Session information
• Security markers
• OAuth credentials or tokens
• IP addresses
• Browser user-agent strings
• Private account timestamps not required for a public feature

If your account or public profile is removed, prior contributions may be attributed to a neutral label such as “Former member.”

4. When we disclose information

We do not sell personal information.

We do not share personal information for cross-context behavioral advertising or targeted advertising.

We may disclose limited information to service providers, including Google for authentication and Cloudflare for hosting, network delivery, application execution, databases, file storage, security, and related infrastructure.

These providers may process information only as necessary to provide their services, secure their systems, comply with law, and perform other activities described in their own terms and privacy notices.

We do not authorize service providers to use Boot Ledger account or contribution data for their own targeted advertising.

We may disclose information when reasonably necessary to comply with law, protect users or the service, investigate abuse or security incidents, or establish or defend legal claims.

If ownership or operation of The Boot Ledger changes, information may be transferred as part of that transaction, subject to applicable law. We will provide notice of materially different privacy practices when required by law.

5. Data retention

We retain information only for as long as reasonably necessary for the purposes described in this Policy.

In general:

• Account and profile information is retained while your account remains active.
• Sessions are retained until they expire, are invalidated, or are no longer reasonably needed.
• Temporary authentication and provisioning information is retained only long enough to complete or safely recover an authentication attempt.
• Public contributions may remain until they are removed, anonymized, or no longer needed to maintain the historical integrity of the service.
• Security and operational records may be retained for a limited period when reasonably necessary to detect abuse, investigate incidents, or protect the service.
• Information may remain temporarily in managed backups or disaster-recovery systems until those copies are overwritten or expire under the applicable provider’s retention processes.
• We may retain information longer when required by law, necessary to resolve disputes, or necessary to protect legal rights.

We aim to delete or de-identify information that is no longer reasonably necessary for the purposes described in this Policy.

6. Your choices and privacy rights

You may view and change your public handle, choose not to include identifying information in public content, sign out, and request access, correction, a copy, deletion, removal, or de-identification of information associated with your account.

Submit privacy requests to the privacy contact address listed below.

To report a nonconsensual intimate depiction or request image removal, use the Safety and image removal page. A Boot Ledger account is not required.

We may need to verify that you control the relevant account before completing a request.

Depending on the request and applicable law, we may retain or de-identify limited records when reasonably necessary to preserve identification history, prevent abuse, comply with law, resolve disputes, or protect legal rights.

Deleting or revoking The Boot Ledger’s access through your Google account does not automatically delete your Boot Ledger account. Contact us separately if you want Boot Ledger account data deleted.

We will not discriminate against you for making a privacy request.

7. Browser privacy signals and tracking

The Boot Ledger does not currently sell personal information, share it for targeted advertising, or use third-party cross-site behavioral advertising trackers.

Because we do not currently perform those activities, browser “Do Not Track” settings generally do not change how the service operates.

Where applicable law requires recognition of a legally valid browser-based opt-out signal, such as Global Privacy Control, we will honor that signal for any covered activity.

Third-party service providers may process limited technical data necessary to provide authentication, hosting, security, and network services. We do not authorize those providers to use Boot Ledger account or contribution data for cross-site targeted advertising.

8. Security

The service uses safeguards intended to protect information, including authentication through Google rather than locally stored passwords, data-minimization controls, restricted public-data serializers, authenticated access controls, secure transport, session-security protections, and separation of public profile information from private authentication information.

No internet service or storage system can guarantee absolute security. You are responsible for protecting access to your Google account and devices.

If we discover a security incident involving personal information, we will investigate it and provide notice when required by applicable law.

9. Children’s privacy

The Boot Ledger is not directed to children. Public contributions are limited to users who represent that they are at least 18 years old.

We do not knowingly collect account information from children under 13. If we learn that a child under 13 has created an account or submitted personal information, we will take reasonable steps to remove or de-identify the information.

Parents or guardians may contact privacy@thebootledger.com regarding a child’s information.

10. International use

The Boot Ledger is operated from the United States. Service providers may process information in the United States and other locations where they operate, subject to their own terms, privacy notices, and applicable law.

11. Changes to this Policy

We may update this Policy when our service, technology, providers, or legal obligations change.

When we update it, we will revise the Last Updated date and Policy version.

For material changes, we may provide additional notice through the website or account interface. We may require users to acknowledge a new version before making additional public contributions.

Changes will not retroactively authorize materially different uses of personal information without additional notice or consent where required by law.