Privacy
Privacy policy
Effective July 28, 2026
BorealBound is an independent, solo-built site. The short version: we collect what an account and a purchase need to work, we watch anonymous-ish usage so we can improve the product, we send you email you asked for, and that's it. We don't run ads, we don't sell or rent your information to anyone, and we don't track you across other sites. The longer version follows, in plain language.
What we collect
- Account basics. Your email address, and — if you use “Continue with Google” — the name and profile photo Google shares. We never see your Google password. If you sign in with an emailed code, your email is all we have.
- Sign-in records. Sessions are stored server-side with the IP address and browser they were created from, so unusual activity is detectable. Emailed sign-in codes live for 10 minutes and are deleted on use.
- Purchases. Payments run entirely through Stripe — card numbers never touch our servers. We keep a record of what you bought (plan, amount, date, Stripe customer reference) to grant your access and for accounting.
- Emails you give us on purpose. Waitlist and openings-alert signups store the email you entered, for that purpose only.
- Usage. We use PostHog (US cloud) to understand how the product is used: pages viewed, features clicked, and session replays in which everything you type is masked before it leaves your browser. Analytics are served first-party from our own domain. We also collect anonymous page-performance timings (Vercel Speed Insights).
What we never do
No selling or renting personal information. No advertising networks or ad cookies. No cross-site tracking. No data brokers. No buying email lists, and no emailing you things you didn't sign up for.
Email we send
Three kinds, all of which you triggered: sign-in codes (delivered by Resend), purchase receipts (sent by Stripe), and the waitlist or lake-alert emails you asked for. Every non-transactional email has an unsubscribe link, and unsubscribing is honored immediately.
Cookies
One essential cookie (bb.session_token) keeps you signed in for up to a year. PostHog sets a first-party identifier so two visits count as one visitor. That's the list — there are no advertising or third-party tracking cookies, which is why there's no cookie banner.
Who touches your data
We run on a small set of infrastructure providers, each seeing only what its job requires. All primary storage is in the United States.
| Provider | Role | What it handles |
|---|---|---|
| Vercel | Hosts the site and its API (US) | Request logs (IP address, pages requested), performance metrics |
| Neon | Database hosting (US, AWS us-east-1) | Everything in “What we collect” — accounts, sessions, purchases |
| Stripe | Payment processing & billing portal | Card details (we never see them), billing email, purchase history |
| Optional “Continue with Google” sign-in | That you signed in to BorealBound; shares your name, email & photo with us | |
| Resend | Delivers sign-in codes and emails you asked for (US) | Your email address and the messages we send you |
| PostHog | Product analytics (US cloud) | Usage events and session replays with typed input masked |
| Cloudflare | Serves the map tiles | Tile requests only — no account data |
Retention & your choices
- Your account and its data stay until you ask us to delete them. Purchase records are kept as long as tax and accounting rules require, even after account deletion.
- Email hello@borealbound.com to see, correct, export, or delete what we hold about you — a human reads it and acts on it, whether PIPEDA, a US state privacy law, or plain decency applies to you. We'll confirm the request from the email on the account.
- Signing out removes the session server-side, not just the cookie.
Lodge & outfitter listings
Operator pages describe businesses, compiled from the operator's own published information and public directories — here's exactly how. If you run a lodge and want your listing corrected (or removed), email us and we'll sort it out.
The fine print
BorealBound isn't directed at children under 13, and we don't knowingly collect their information. If our practices change, this page changes with them and the effective date above moves — material changes to how sign-ins or payments work get called out on the site, not buried here. Questions about any of this: hello@borealbound.com.