Skip to Content
British Columbia Mathematics Association

HOW BCMA USES YOUR DATA

You can enter contests as a guest without creating an account. We assign a random guest name and use a private browser cookie to recover your attempts. Guest answers, scores, and contest activity are visible to authorized organizers, but guest scores remain hidden from participants and are excluded from public standings and prizes. Creating an account or logging in in the same browser within 24 hours of finishing attaches eligible attempts to your account. After that deadline, unclaimed results remain unofficial records for organizer review.

This summary describes what this site actually stores. Contact support@bcma.xyz for access, export, or deletion requests.

You can download your data anytime from Account settings under “Your data”. Students under 13 need a parent or guardian to review these terms before signing up.

WEBSITE TRAFFIC AND REFERRAL ANALYTICS

When enabled, Cloudflare Web Analytics helps us understand visits, page views, referring websites, browser and device categories, country-level traffic, and page performance. We use aggregate reports to improve BCMA and understand which sites bring visitors. Cloudflare Web Analytics does not use cookies or local storage to track visitors and does not track individuals across websites. These reports are separate from the account and contest activity records described above; BCMA does not use this integration to attach a referral source to your account, answers, or score.

Referring websites are only available when the browser supplies that information. Browser privacy settings and content blockers can limit collection. Cloudflare processes this information as our analytics provider; see Cloudflare Web Analytics documentation.

SIGNUP AND MESSAGE CHOICES

You may sign up with Google, Discord, or email and a password. Google supplies your name, email, and account identifier. Discord supplies your identifier, username, and display name; you enter your full name and may add a recovery email. We do not request your Discord email. You choose yes or no to contest reminders, organizer messages, and prize notifications; neither choice is preselected. Discord signup includes explicit age and policy confirmation. If you opt into Discord messages, we send a test DM before enabling delivery. Without a backup sign-in or recovery method, losing Discord access may mean losing BCMA access. Advertising is not included in message consent.

OPTIONAL DISCORD ACCOUNT FEATURES AND MESSAGES

Updated October 13, 2026. Discord is optional. We do not send existing users’ information to Discord through this integration unless they choose to connect. Existing login methods and contest eligibility stay unchanged. Email remains the contest communication channel unless you separately enable Discord messages.

When you expressly consent to linking, we use Discord OAuth to receive your Discord user ID and username. We store those with your BCMA account ID, connection time, disclosure version and acceptance time, and your separate sign-in, direct-message, and participant-role preferences. We do not request your Discord email, password, chat history, friends list, or a full server member list. OAuth access tokens are used temporarily on the server to confirm identity and are not stored in our database or logs.

Connecting Discord enables sign-in using the linked Discord ID. You may also create a BCMA account through Discord, enter your own full name, and edit the public display name suggested by Discord. Recovery email is optional. Disable or disconnect Discord sign-in only after adding another sign-in method. If you separately opt into Discord messages, we send a test message or reuse a successful test, then use Discord for automatic contest reminders, organizer scratch-work reminders, and prize notifications when a verified email enabled for contest messages is unavailable. Discord processes your destination user ID, message content, upload deadlines, contest/account links, and any prize or redemption details included by an organizer. Verification and password-recovery emails remain on email. New messages use verified email with permission first, then opted-in, tested Discord DMs; participants without either receive no contest messages; a temporary Discord failure retains the selected channel for retry. Organizer and prize previews record their chosen channel and destination so retries do not silently switch channels. Existing scratch-reminder-only consent is not expanded to prize or organizer DMs without the new messages opt-in. A reminder can reveal that you participated in a contest and have outstanding work. Automatic scratch-work reminders do not include scores, legal names, scratch-work files, or login tokens. Organizer and prize messages contain the reviewed draft, which may include personal prize details. You may also request individual test messages without enabling ongoing DMs. The bot does not read or act on replies to its DMs; contact support@bcma.xyz for help.

The site owner can view connected usernames, account linkage, sign-in and reminder preferences, and test/delivery status to configure the service and help with account or delivery problems. Contest-group managers cannot access this integration dashboard. We keep reminder consent time, test time, delivery status, retry timing, and limited delivery records (contest/account association, attempts, message ID and sanitized error category). Automatic Discord reminder-delivery records are removed after 30 days or with the connection, account, or contest, whichever occurs first. Expired OAuth state is removed during later authorization attempts and scheduled maintenance; the browser-binding cookie expires after 10 minutes. Automatic Discord reminder-delivery records do not store message bodies. Organizer reminder records store the reviewed message, chosen delivery channel, recipient Discord ID and connection version when applicable, and send time. Prize records also store the subject, message, chosen channel, destination, provider message ID, send attempts, and sending status. These organizer/prize records are not covered by the 30-day automatic-reminder retention period. Recipient-specific records are deleted with the account or contest. Shared prize message drafts remain with the contest, and organizer audit records are kept for up to one year; requests to remove personal information from those records are reviewed separately. Authorized managers can review message drafts and delivery status for their assigned contests; the owner can review them across contests.

If you separately opt into participant roles, we use your submitted contest records and linked Discord ID to check your membership and roles in configured servers and add the matching contest participant role, including for submitted entries that are disqualified. While enabled, hourly rechecks may restore missing roles after you rejoin a server. This does not require DMs or reminder consent. Discord and other server members may see the role and infer your contest participation; we do not publish your score or legal name through the role. We store the role-consent version and time, configured server/role IDs, and assignment status and check time to operate and troubleshoot this feature. Owners can view bot server, role, and channel metadata and configure contest mappings. We do not fetch other participants’ membership lists.

You can stop automatic roles at any time. Opting out, removing a mapping, or disconnecting stops future assignments but leaves existing roles on Discord; ask server staff to remove them. A role assignment already in progress may finish. Disconnecting or deleting your BCMA account removes its role-consent and assignment records. Server metadata and mappings are administrative settings rather than your account records.

You can turn off all optional Discord messages or disconnect in Account settings. Turning messages off returns new contest and prize messages to email where available; it does not unsubscribe you from email. Disconnecting deletes the active connection, associated automatic reminder-delivery records, role-assignment records, and Discord linking-acceptance record; account deletion also removes these and other policy acceptance records. Disconnecting does not erase saved organizer/prize communication records, which remain with the contest as described above. You can request their review, correction, or deletion at support@bcma.xyz. Turning Discord messages off clears the current messaging permission and stops future optional DMs, but a send already in progress may finish. Backup copies may remain for up to 30 days. These actions do not recall messages or delete information already processed by Discord. Discord’s own retention and international processing practices are described in its Privacy Policy.

Connecting Discord enables Discord sign-in. Direct messages and participant roles remain off until you separately enable them. We do not automatically join a server for you, publish your connection, or post personal reminders to a public channel. Discord has its own minimum age and terms; users must be at least 13 and meet any higher local minimum. BCMA users who do not meet those requirements can keep using the other account options.

New signups record the policy version and agreement time. Existing users are not marked as having accepted a new version merely because it is published. Before a significant new use or disclosure requiring consent, we will notify affected users and obtain the necessary consent. You can review the current policies without enabling Discord.

PRIVACY POLICY

Last updated October 24, 2026
This Privacy Notice for British Columbia Math Association (doing business as BCMA) ("we," "us," or "our"), describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:
  • Use BCMA Contest Portal. An online platform operated by the British Columbia Mathematics Association where participants create accounts, take timed mathematics contests, submit answers, and view results and leaderboards.
Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at support@bcma.xyz.

SUMMARY OF KEY POINTS

This summary provides key points from our Privacy Notice, but you can find out more details about any of these topics by clicking the link following each key point or by using our table of contents below to find the section you are looking for.
What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use. Learn more about personal information you disclose to us.
Do we process any sensitive personal information? Some of the information may be considered "special" or "sensitive" in certain jurisdictions, for example your racial or ethnic origins, sexual orientation, and religious beliefs. We may process sensitive personal information when necessary with your consent or as otherwise permitted by applicable law. Learn more about sensitive information we process.
Do we collect any information from third parties? If you choose Google sign-in, Google supplies your basic account identity as described below.
How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent. We process your information only when we have a valid legal reason to do so. Learn more about how we process your information.
In what situations and with which parties do we share personal information? We may share information in specific situations and with specific third parties. Learn more about when and with whom we share your personal information.
How do we keep your information safe? We have adequate organizational and technical processes and procedures in place to protect your personal information. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Learn more about how we keep your information safe.
What are your rights? Depending on where you are located geographically, the applicable privacy law may mean you have certain rights regarding your personal information. Learn more about your privacy rights.
How do you exercise your rights? To exercise your rights, email support@bcma.xyz with the subject "Privacy request". We will consider and act upon any request in accordance with applicable data protection laws.
Want to learn more about what we do with any information we collect? Review the Privacy Notice in full.

TABLE OF CONTENTS

1. WHAT INFORMATION DO WE COLLECT?
2. HOW DO WE PROCESS YOUR INFORMATION?
3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR PERSONAL INFORMATION?
4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?
6. HOW LONG DO WE KEEP YOUR INFORMATION?
7. HOW DO WE KEEP YOUR INFORMATION SAFE?
8. WHAT ARE YOUR PRIVACY RIGHTS?
9. CONTROLS FOR DO-NOT-TRACK FEATURES
10. DO WE MAKE UPDATES TO THIS NOTICE?
11. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?
12. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

In Short: We collect personal information that you provide to us.
We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.
Personal Information Provided by You. The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we collect may include the following:
  • names
  • usernames
  • passwords
  • email addresses
  • contact or authentication data
Sensitive Information. When necessary, with your consent or as otherwise permitted by applicable law, we process the following categories of sensitive information:
  • student data
All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

Information automatically collected

In Short: Some information — such as your Internet Protocol (IP) address and/or browser and device characteristics — is collected automatically when you visit our Services.
We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Services, and other technical information. This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes.
Like many businesses, we also collect information through cookies and similar technologies. You can find out more about this in our Cookie Notice: /cookies.
The information we collect includes:
  • Log and Usage Data. Log and usage data is service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services and which we record in log files. Depending on how you interact with us, this log data may include your IP address, device information, browser type, and settings and information about your activity in the Services (such as the date/time stamps associated with your usage, pages and files viewed, searches, and other actions you take such as which features you use), device event information (such as system activity, error reports (sometimes called "crash dumps"), and hardware settings).

2. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We process the personal information for the following purposes listed below. We may also process your information for other purposes only with your prior explicit consent.
We process your personal information for a variety of reasons, depending on how you interact with our Services, including:
  • To facilitate account creation and authentication and otherwise manage user accounts. We may process your information so you can create and log in to your account, as well as keep your account in working order.
  • To deliver and facilitate delivery of services to the user. We may process your information to provide you with the requested service.

  • To administer prize draws and competitions. We may process your information to administer prize draws and competitions.
  • To evaluate and improve our Services and your experience. We use site performance and usage information to diagnose problems and improve the contest portal.
  • Grade contests and publish results. We use submitted answers to calculate scores, rankings, and contest results.
  • Maintain contest integrity. We use contest activity records to identify possible rule violations for organizer review.

3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR INFORMATION?

In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason (i.e., legal basis) to do so under applicable law, like with your consent, to comply with laws, to provide you with services to enter into or fulfill our contractual obligations, to protect your rights, or to fulfill our legitimate business interests.
We may process your information if you have given us specific permission (i.e., express consent) to use your personal information for a specific purpose, or in situations where your permission can be inferred (i.e., implied consent). You can withdraw your consent at any time.
In some exceptional cases, we may be legally permitted under applicable law to process your information without your consent, including, for example:
  • If collection is clearly in the interests of an individual and consent cannot be obtained in a timely way
  • For investigations and fraud detection and prevention
  • For business transactions provided certain conditions are met
  • If it is contained in a witness statement and the collection is necessary to assess, process, or settle an insurance claim
  • For identifying injured, ill, or deceased persons and communicating with next of kin
  • If we have reasonable grounds to believe an individual has been, is, or may be victim of financial abuse
  • If it is reasonable to expect collection and use with consent would compromise the availability or the accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province
  • If disclosure is required to comply with a subpoena, warrant, court order, or rules of the court relating to the production of records
  • If it was produced by an individual in the course of their employment, business, or profession and the collection is consistent with the purposes for which the information was produced
  • If the collection is solely for journalistic, artistic, or literary purposes
  • If the information is publicly available and is specified by the regulations

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In Short: We may share information in specific situations described in this section and/or with the following third parties.

Service providers. Cloudflare hosts and protects the site and stores account and contest data. If email sending is enabled, Resend sends account verification and password reset codes to the email address on your account. Codes expire after 15 minutes; we store only keyed hashes of the codes and limit verification attempts. If error reporting is enabled, Sentry receives limited error information. We do not sell participant information to advertisers.

Sponsor acknowledgements. We display sponsor names, logos, and links on our Sponsors page. Displaying a sponsor does not give that sponsor access to participant accounts, contest answers, or other participant information. Our current sponsor listings do not load sponsor-hosted advertising scripts or tracking pixels. If you choose to follow a sponsor link, you leave our Services and the sponsor may collect information about your visit under its own privacy practices.

Where information is stored and processed. BCMA is based in Canada, but our service providers are not restricted to storing or processing information in Canada. Cloudflare currently reports that our account and contest database runs in Western North America; that regional designation does not identify a country or guarantee Canadian storage. Our file-storage bucket, used for problem images, currently reports an Asia-Pacific location. Cloudflare may process website requests and logs in other locations, and enabled email or error-reporting providers may process information outside Canada. Information processed in another country may be subject to that country's laws and lawful access requests.

We share information with these providers to operate and protect our Services.

5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

In Short: We may use cookies and other tracking technologies to collect and store your information.
We may use cookies and similar tracking technologies (like web beacons and pixels) to gather information when you interact with our Services. Some online tracking technologies help us maintain the security of our Services and your account, prevent crashes, fix bugs, save your preferences, and assist with basic site functions.
We do not use advertising pixels or permit third-party advertising trackers on the contest portal.
Specific information about how we use such technologies and how you can refuse certain cookies is set out in our Cookie Notice: /cookies.

6. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Notice unless otherwise required by law.
We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). No purpose in this notice will require us keeping your personal information for longer than the period of time in which users have an account with us.
When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

7. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We aim to protect your personal information through a system of organizational and technical security measures.
We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

8. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: In some regions, such as Canada, you have rights that allow you greater access to and control over your personal information. You may review, change, or terminate your account at any time, depending on your country, province, or state of residence.
In some regions (like Canada), you have certain rights under applicable data protection laws. These may include the right (i) to request access and obtain a copy of your personal information, (ii) to request rectification or erasure; (iii) to restrict the processing of your personal information; (iv) if applicable, to data portability; and (v) not to be subject to automated decision-making. If a decision that produces legal or similarly significant effects is made solely by automated means, we will inform you, explain the main factors, and offer a simple way to request human review. In certain circumstances, you may also have the right to object to the processing of your personal information. You can make such a request by contacting us by using the contact details provided in the section "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?" below.
We will consider and act upon any request in accordance with applicable data protection laws.
Withdrawing your consent: If we are relying on your consent to process your personal information, which may be express and/or implied consent depending on the applicable law, you have the right to withdraw your consent at any time. You can withdraw your consent at any time by contacting us by using the contact details provided in the section "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?" below.
However, please note that this will not affect the lawfulness of the processing before its withdrawal nor, when applicable law allows, will it affect the processing of your personal information conducted in reliance on lawful processing grounds other than consent.

Account Information

If you would at any time like to review or change the information in your account or terminate your account, you can:
  • Contact us using the contact information provided.
  • Log in to your account settings and update your user account.
Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms and/or comply with applicable legal requirements.
Cookies and similar technologies: Most Web browsers are set to accept cookies by default. If you prefer, you can usually choose to set your browser to remove cookies and to reject cookies. If you choose to remove cookies or reject cookies, this could affect certain features or services of our Services. For further information, please see our Cookie Notice: /cookies.
If you have questions or comments about your privacy rights, you may email us at support@bcma.xyz.

9. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Notice.

10. DO WE MAKE UPDATES TO THIS NOTICE?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.
We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Revised" date at the top of this Privacy Notice. If we make material changes to this Privacy Notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. When a significant new use or disclosure requires consent, we will notify affected users and obtain the necessary consent before that change applies. Changes to optional Discord processing are presented when you choose that feature. We encourage you to review this Privacy Notice frequently to be informed of how we are protecting your information.

11. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments about this notice, you may email us at support@bcma.xyz.

SCRATCH-WORK PHOTOS AND REMINDERS

We collect scratch-work photos you upload for contest review, along with their upload times and file information. These photos may contain handwriting or personal information you include. Upload only relevant contest work and avoid unrelated personal information. Files are stored privately in Cloudflare R2 and are accessible to your account and authorized organizers. For contests with scratch-work submissions enabled, you may add, replace, or delete photos until the earlier of 24 hours after you submit or your personal timer expires, and the overall contest closing time. Photo records follow the retention and deletion provisions of this policy.

Contests with scratch-work reminders enabled require a verified email or a linked, tested Discord account with messages enabled before starting. Contests with reminders disabled do not require contact verification. We send verification messages when needed for a reminder-enabled contest or when you request verification in Account settings. For contests with reminders enabled, we send a transactional reminder if you finish without uploading scratch work while the upload window remains open. We use verified email with contest-message permission first; otherwise opted-in, tested Discord DMs are used. If neither is available, no contest message is sent. Emails are sent through Resend, and Discord messages follow the optional Discord disclosure above. A reminder is not guaranteed to arrive before a short deadline; the deadline shown on the site applies.

CONTEST ACTIVITY AND ORGANIZER REVIEW

During a contest, we record page activity for organizer review. This includes question visits, answer-field changes and snapshots (including pastes and deletions), answers saved to the server, flags, and timestamps. We also record signals when the contest page loses or regains visibility or focus, or is closed, and limited clipboard activity within the contest. Organizers can review these records and reconstruct the contest session, including recorded periods away from the page. Contest-group managers appointed by BCMA can access contest questions, participant names, answers, activity records, scratch-work photos, and results exports only for their assigned groups. Owners retain access across groups. We also keep operational records of sensitive organizer actions, including the action, affected resource, time, and IP address, for up to one year. We store manager group assignments and the reason, time, and organizer identity for disqualification and restoration decisions to administer contests and review disputed decisions. This is a reconstruction from activity records, not a screen or video recording. We do not record typing outside contest answer fields or identify what you view in other tabs or applications.

Page departures are recorded without individual alerts or warning counters and do not automatically lock or disqualify contestants. Browser signals can be incomplete or inaccurate; organizers use them as context for manual contest-integrity review, not proof of misconduct. We record the time you accept contest instructions and the contest version you accepted. We also record which contest you start within an exclusive contest group to enforce the one-contest-per-group rule. Detailed contest activity snapshots, clipboard event logs, and server-save replay history are normally removed 30 days after the overall contest closes. Organizers may preserve detailed records while a contest-integrity review is ongoing. We retain per-account review summaries (including activity timing and clipboard indicators), official answers, participation records, and organizer decisions under the account retention and privacy-request provisions of this policy. Removing detailed records limits session reconstruction; summaries do not include the full answer-edit history.

Optional Google sign-in

If you choose Continue with Google, we receive your Google account identifier, name, email address, and verification information. We use your Google name as the initial full name visible to organizers and generate a separate public display alias. BCMA never receives your Google password and does not store Google access or refresh tokens. We store the account identifier to recognize later sign-ins. Short-lived authorization and unfinished signup records expire after 10 minutes and are removed during routine maintenance. Signup asks you to accept or decline contest reminders, organizer messages, and prize notifications. No choice is preselected. Email messages require a verified address and permission; otherwise opted-in, tested Discord DMs may be used. Verification, recovery, and security messages you request are separate from this preference. Google-verified Gmail and Google Workspace addresses can be used as verified email addresses; other addresses may require BCMA verification. Google authentication is subject to Google’s own privacy policy. Existing BCMA accounts must be explicitly connected rather than merged by matching email.

12. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

Based on the applicable laws of your country, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. To request access to, correction of, or deletion of your personal information, email support@bcma.xyz with the subject "Privacy request" and enough information to help us identify your account. We may ask you to verify your identity or, if you are requesting on behalf of a child, your authority to act for them before disclosing or changing information. Please do not include passwords or identity documents in your first email.

This Privacy Policy was created using Termly's Privacy Policy Generator

Prize administration and winner communications

We use account identity, contest participation, results, disqualification status, and prize-claim eligibility information to select winners, run prize draws, review claims, and send redemption details. Pre-college eligibility is confirmed when claiming a contest award; it is not required for a prize draw. Prize messages and contests requiring reminders accept either verified email or a linked, tested Discord account with messages enabled.

Authorized owners and managers of the relevant contest group can see verified contact email addresses in the prize tools to confirm claims and contact winners. These addresses are not shown on public leaderboards or disclosed to other contestants. We record selected winners, the draw participant list and selected person, claim correspondence, prize-level labels, email previews, recipient addresses, and sending status for prize administration. Resend processes winner notification emails on our behalf. We use our Discord community to coordinate claims; information you share there is also processed by Discord under its own privacy policy. Email verification confirms access to an email address; Discord linking and a successful test confirm the connected account and message route. Neither is proof of legal identity, age, or prize eligibility.

Prize records and sending history are retained while the associated contest records are retained, or until removed as part of an applicable deletion request, subject to legal recordkeeping requirements. Contact support@bcma.xyz to request access, correction, or deletion.

IMAGE PROCESSING AND PHOTO DELETION

Large uploaded images may be resized and converted in your browser before being sent to BCMA. When this happens, we store the processed image rather than the original file. Images that do not need conversion may retain embedded metadata; remove sensitive information before uploading. You can delete or replace scratch-work photos while your upload window is open. Replaced and deleted photos are removed from active file storage. Authorized administrators can remove team photos, which restores the default BCMA logo. Team photos are public; scratch-work photos remain private to you and authorized organizers.

Organizer audit records

We retain organizer action records for up to one year, including timestamps, responsible manager accounts (or shared owner-token access), and before-and-after values for successful administrative changes. These records may include edited site content, contest questions, eligibility decisions and reasons, and prize email details. They are accessible to the site owner for accountability and troubleshooting. Passwords, session tokens, and API secrets are excluded.