Privacy Policy

BST Airsoft Privacy Policy

Last Updated: September 30, 2026

BST Airsoft operates the BST Airsoft website (https://bstairsoft.com), iOS app, and Android app (collectively, the “Service”), a platform for buying, selling, and trading airsoft gear. This Privacy Policy explains how information is collected, used, shared, retained, and protected when the Service is used. By using the Service, users acknowledge the practices described below.

For questions or to contact BST Airsoft, visit https://bstairsoft.com/contact-us/.

1. Information Collected

1.1. Information Provided by Users

  • Account Information: first & last name, email address, password
  • Profile Data: display name, bio, optional links
  • Listings, Photos & Videos: titles, descriptions, photos, and optional videos (up to 60 seconds) uploaded by users. A listing video is public, like a listing photo.
  • Private Messages: one‑to‑one chat content, including photos and videos sent in chat

1.2. Information Collected Automatically

  • Usage Data: device type, OS version, unique device IDs, IP address, browser type, pages visited, timestamps
  • Geolocation Data: approximate U.S. state via IP for filtering purposes
  • Analytics: anonymized, cookie‑less usage metrics
  • Crash Reports: error logs, stack traces, device and OS details (only if enabled)
  • Push Tokens: iOS (APNs), Android (FCM), or Web Push subscription tokens
  • Cookies: session and security cookies to maintain authentication, preferences, and protect against fraud

1.3. Private Messages

  • Message text is stored in the database and encrypted at rest using industry‑standard encryption
  • Photos sent in chat are stored in a private storage bucket and delivered through temporary links
  • Videos sent in chat are stored by Mux, our video hosting provider, not in our database, and are not encrypted with the message key. They are delivered through signed, time‑limited playback links that are only issued to conversation participants
  • Transmitted securely via SSL and encrypted websockets
  • Not end‑to‑end encrypted; administrators may access messages to investigate abuse or enforce rules (see EULA Section 13)

2. Use of Information

Information is used to:

  1. Operate & improve the Service (accounts, listings, search, messaging)
  2. Communicate account notices, password resets, in‑app or email notifications, and (with opt‑in) campaign emails
  3. Personalize features (e.g. auto‑select state filter based on IP)
  4. Analyze & debug via analytics and crash reports
  5. Moderate & enforce community guidelines, investigate abuse reports, and comply with legal obligations

Information is not sold to advertisers or used for cross‑site tracking.

3. Sharing of Information

Data is shared only with trusted service providers who help operate and improve the Service, including:

  • Hosting & Infrastructure
    • DigitalOcean
    • Cloudflare

  • Video Hosting & Delivery

    • Mux (stores, processes, and streams listing and chat videos, and may receive playback data such as IP address and device information when a video is played)

  • Email Delivery

    • Postmark

  • Security & Bot Protection

    • Cloudflare

  • Geolocation Estimation

    • IPinfo.io

  • Push Notification Services

    • Apple Push Notification Service (APNs)
    • Firebase Cloud Messaging (FCM)

Information may also be disclosed to comply with legal process (e.g. subpoenas), to protect rights or safety, or in the event of a merger, acquisition, or sale of assets (with notice to users).

4. Data Retention

Data is retained only as long as necessary:

  • Account/Profile Data, Listings & Messages: until user deletes or terminates account
  • Videos: until the listing or chat video is deleted, replaced, or removed, or the account is deleted. Deleted videos are removed from Mux shortly afterward, and if Mux cannot be reached, deletion is retried automatically until it succeeds. Mux does not keep separate backups for us.
  • Push Tokens: until notifications are disabled or account deletion
  • Usage Data & Analytics: 12 months, then anonymized or deleted
  • Crash Reports: 12 months, then deleted
  • Backups: encrypted backups retained for up to 30 days

5. Data Safety & Tracking

  • Google Play “Data Safety”: Data collection and sharing disclosed in the Play Console Data Safety form match this policy, including video uploads and Mux as a third‑party service provider.
  • App Tracking Transparency (iOS): The app does not track users across apps or websites and does not access device advertising identifiers (IDFA/AAID).

6. Privacy Rights & Controls

  • Access & Update: Account details can be viewed or edited in Settings.
  • Delete Account: Permanently deletes the account and all associated data via https://bstairsoft.com/accounts/delete-my-account/. This includes listings, photos, and videos (including videos hosted by Mux), and private conversations, which are removed for both participants. Video removal from Mux happens shortly after the account is deleted and is retried if Mux is unavailable. Encrypted backups may retain data for up to 30 days (see Section 4).
  • Opt‑Out Analytics: Enable “Do Not Track” in browser or visit https://bstairsoft.com/contact-us/ to request analytics be disabled.
  • Manage Email Preferences: Toggle campaign emails in Settings or use the unsubscribe link. Transactional emails remain mandatory.
  • Manage Push Notifications: Enable/disable in device or app settings.
  • Request Assistance: Visit https://bstairsoft.com/contact-us/ to request data access, correction, or deletion.

7. Children’s Privacy

The Service is intended for users 17 and older. Accounts for anyone under 17 are not permitted. No data is knowingly collected from anyone under 13. If data from a minor under 13 is identified, it will be deleted promptly upon request via https://bstairsoft.com/contact-us/.

8. Geographic Scope

The Service is designed for use within the United States. Access outside the U.S. is at the user’s own risk and subject to local laws. Data is hosted by DigitalOcean in the United States. Mux is a U.S.-based provider that may process and deliver video through its global content delivery network, so video and related playback data may be handled outside the United States.

9. Third‑Party Links

The Service may link to third‑party websites (e.g., airsoft fields, payment gateways). BST Airsoft is not responsible for their privacy practices. Review their policies before sharing information.

10. Cookies

Cookies are used to maintain user sessions, preferences, and security when accessing the Service. Cookies can be disabled in browser settings, but this may affect login or core functionality.

11. Changes to This Privacy Policy

Updates will be posted at https://bstairsoft.com/info/privacy-policy/ with a revised “Last Updated” date. Significant changes may be announced via in‑app notice. Continued use after updates constitutes acceptance.

12. Additional Resources

  • End User License Agreement (EULA): https://bstairsoft.com/info/eula/
  • Privacy Policy (this document): https://bstairsoft.com/info/privacy-policy/

13. Contact

For questions, requests, or to exercise privacy rights, visit:
https://bstairsoft.com/contact-us/