Privacy Policy
Effective: August 14, 2026 · Plain-language summary for review
This policy explains what data the BidMast service (the "Service") collects, how it's stored and used, and the choices you have. It describes the Service as it exists today; as features are added, we'll update this page. This document isn't legal advice — for questions specific to your situation, consult your own attorney.
1. What we collect
- Account information: your name, email address, and a password stored only as a secure (scrypt) hash — we never store your password in plain text.
- Profile data: the details you enter about your business — name, NAICS codes, certifications, bond capacity, past performance.
- Your content: past proposals, drafts, document uploads, saved searches, and the opportunities you view.
- Details you choose to share: for example, name, email, and message submitted through the home-page alert form or the contact form. Contact-form submissions are stored on our servers so we can respond to you, and they are never sold or shared with anyone.
- Community posts: anything you post to the community board — the category, title, body, and the display name you enter — is public to other signed-in users (that's the point of the board). Community posts include your display name and are never sold.
- Technical basics: server logs (like IP address and request time) and a cookie that keeps you signed in.
- Visitor statistics: when anyone visits the site — signed in or not — we log the pages they view, the referral source (for example a search engine, an email link, or directly), and an anonymous visitor ID stored in a cookie. The ID is a random string with no link to any account, name, or email, and it's per-browser: it doesn't track you across devices or browsers.
2. How we store it
Your data is kept in your own per-user data folder on our servers, separate from other users' data. Sign-in sessions use httpOnly cookies — the cookie can't be read by page scripts on your device, and it's sent only over an encrypted connection. Passwords are hashed with scrypt before storage.
Visitor statistics live in a plain-text log on our own servers, not with any third-party analytics service. The log contains no account information and no raw IP addresses — only the anonymous visitor ID, the pages visited, and the referral source — and it's visible only to the site owner.
3. How we use it
- To run the Service: match opportunities to your profile, assemble proposal drafts, save your work, and — on paid plans — email you the proposal bundles you request.
- To communicate with you about the Service: account notices, plan changes, and, if you opt in, product updates. We don't send spam.
- To improve the Service, using aggregated or anonymized information where we can.
- To understand how people find us: anonymous visitor statistics (pages visited and referral sources) show us which outreach is actually bringing visitors to the site. This data is never sold.
4. Sharing — we don't sell your data
We never sell your personal data. We share data only with the providers needed to run the Service:
- Resend delivers the proposal-bundle emails you request on paid plans.
- Stripe processes payments — but payments happen on Stripe's hosted checkout pages, not in the app, and we never see or store your card number.
We share only what those providers need to do their job. We may also disclose data if the law requires it (for example, a valid subpoena) or to protect our rights and the safety of the Service.
5. Your choices and rights
- Access and correction: you can review and update your profile and content any time in the app.
- Deletion: email us at the address below and we'll delete your account and the data we hold for you.
- Email: proposal-bundle emails go only to the address you provide. You can opt out of non-essential product emails at any time; bundle emails you request are part of the Service.
6. Data retention
We keep your data while your account is active so the Service can do its job. When you delete your account, we remove your data. We keep only what we're legally required to keep, and server logs are kept for a limited time for security and troubleshooting. The anonymous visitor log is kept for a limited time for analytics and troubleshooting; it contains no account information.
7. Children
The Service is for adults operating businesses. We don't knowingly collect personal data from children under 13.
8. Changes to this policy
If we change this policy, we'll post the updated version on this page with a new effective date. Material changes will also be called out where you use the Service.
9. Contact
Questions about your data or this policy? Email us at hanscalkins1234@gmail.com. You can also read our Terms of Use.