BST Airsoft Privacy Policy

Last Updated: April 17, 2025

BST Airsoft operates the BST Airsoft website (https://bstairsoft.com), iOS app, and Android app (collectively, the “Service”), a platform for buying, selling, and trading airsoft gear. This Privacy Policy explains how information is collected, used, shared, retained, and protected when the Service is used. Use of the Service constitutes agreement to the practices described below.

For questions or to contact BST Airsoft, visit https://bstairsoft.com/contact-us/.

1. Information Collected

1.1. Information Provided by Users

• Account Information: first & last name, email address, password
• Profile Data: display name, bio, optional links
• Listings & Images: titles, descriptions, photos uploaded by users
• Private Messages: one‑to‑one chat content

1.2. Information Collected Automatically

• Usage Data: device type, OS version, unique device IDs, IP address, browser type, pages visited, timestamps
• Geolocation Data: approximate U.S. state via IP for filtering purposes
• Analytics: anonymized, cookie‑less usage metrics
• Crash Reports: error logs, stack traces, device and OS details (only if enabled)
• Push Tokens: iOS (APNs), Android (FCM), or Web Push subscription tokens
• Cookies: session and security cookies to maintain authentication, preferences, and protect against fraud

1.3. Private Messages

• Stored in the database and encrypted at rest using industry‑standard encryption
• Transmitted securely via SSL and encrypted websockets
• Not end‑to‑end encrypted; administrators may access messages to investigate abuse or enforce rules (see EULA Section 13)

2. Use of Information

Information is used to:

1. Operate & improve the Service (accounts, listings, search, messaging)
2. Communicate account notices, password resets, in‑app or email notifications, and (with opt‑in) campaign emails
3. Personalize features (e.g. auto‑select state filter based on IP)
4. Analyze & debug via analytics and crash reports
5. Moderate & enforce community guidelines, investigate abuse reports, and comply with legal obligations

Information is not sold to advertisers or used for cross‑site tracking.

3. Sharing of Information

Data is shared only with trusted service providers who help operate and improve the Service, including:

• Hosting & Infrastructure
• • DigitalOcean
• • Cloudflare

• Email Delivery

• • Postmark

• Crash Reporting & Analytics

• • Sentry.io

• Security & Bot Protection

• • Cloudflare

• Geolocation Estimation

• • IPinfo.io

• Push Notification Services

• • Apple Push Notification Service (APNs)
• • Firebase Cloud Messaging (FCM)

Information may also be disclosed to comply with legal process (e.g. subpoenas), to protect rights or safety, or in the event of a merger, acquisition, or sale of assets (with notice to users).

4. Data Retention

Data is retained only as long as necessary:

• Account/Profile Data, Listings & Messages: until user deletes or terminates account
• Push Tokens: until notifications are disabled or account deletion
• Usage Data & Analytics: 12 months, then anonymized or deleted
• Crash Reports: 12 months, then deleted
• Backups: encrypted backups retained for up to 30 days

5. Data Safety & Tracking

• Google Play “Data Safety”: Data collection and sharing disclosed in the Play Console Data Safety form match this policy.
• App Tracking Transparency (iOS): The app does not track users across apps or websites and does not access device advertising identifiers (IDFA/AAID).

6. Privacy Rights & Controls

• Access & Update: Account details can be viewed or edited in Settings.
• Delete Account: Permanently deletes all associated data via https://bstairsoft.com/accounts/delete-my-account/.
• Opt‑Out Analytics: Enable “Do Not Track” in browser or visit https://bstairsoft.com/contact-us/ to request analytics be disabled.
• Manage Email Preferences: Toggle campaign emails in Settings or use the unsubscribe link. Transactional emails remain mandatory.
• Manage Push Notifications: Enable/disable in device or app settings.
• Request Assistance: Visit https://bstairsoft.com/contact-us/ to request data access, correction, or deletion.

7. Children’s Privacy

The Service is intended for users 17 and older. No data is knowingly collected from anyone under 13. If data from a minor under 13 is identified, it will be deleted promptly upon request via https://bstairsoft.com/contact-us/.

8. Geographic Scope

The Service is designed for use within the United States. Access outside the U.S. is at the user’s own risk and subject to local laws. All data is processed and stored in the United States.

9. Third‑Party Links

The Service may link to third‑party websites (e.g., airsoft fields, payment gateways). BST Airsoft is not responsible for their privacy practices. Review their policies before sharing information.

10. Cookies

Cookies are used to maintain user sessions, preferences, and security when accessing the Service. Cookies can be disabled in browser settings, but this may affect login or core functionality.

11. Changes to This Privacy Policy

Updates will be posted at https://bstairsoft.com/privacy-policy/ with a revised “Last Updated” date. Significant changes may be announced via in‑app notice. Continued use after updates constitutes acceptance.

12. Additional Resources

• End User License Agreement (EULA): https://bstairsoft.com/eula/
• Privacy Policy (this document): https://bstairsoft.com/privacy-policy/

13. Contact

For questions, requests, or to exercise privacy rights, visit:
https://bstairsoft.com/contact-us/