Privacy Policy

Effective date: 2026-08-03

This is the privacy policy for ValidHunt, a hunting-planning application for Wisconsin. The canonical hosted version of this document lives at https://validhunt.com/policies/privacy — if a printed or cached copy disagrees with what's live there, the live version wins.

Who We Are

ValidHunt is a product operated by LearnedGeek. If you have questions about this policy or your data, contact:

[email protected]

Information We Collect

We collect only what the app needs to do its job — telling you whether your hunt is legal at a specific place on a specific date. That means:

• Account information (once auth is enabled for your account):
  • Email address
  • Password (stored hashed via ASP.NET Core Identity's PBKDF2 — the plaintext never lives on our servers)
• Hunter profile (self-reported by you in the app):
  • Date of birth (used only to determine age-based eligibility rules and hunter-education requirements)
  • Residency (Resident / Nonresident — drives license eligibility)
  • Hunter-education completion status
  • Species you follow, saved hunting locations (lat/long), held authorizations (licenses, stamps, permits, tags)
• Session data:
  • Authentication cookie (encrypted, HTTP-only, marked Secure over HTTPS)
  • Antiforgery cookie (CSRF protection)
• Anonymous browsing: visitors who haven't signed in can browse published Wisconsin regulations — season dates, license classes, special rules — without providing any information. No personal state is saved anywhere for anonymous visitors; refreshing the page starts fresh.

We do not collect analytics, tracking pixels, ad identifiers, or device fingerprints. We do not use third-party marketing SDKs.

Cookies

ValidHunt uses two first-party cookies, both functional:

• Authentication cookie (.AspNetCore.Identity.Application) — keeps you signed in across pages. Expires 30 days after last activity.
• Antiforgery cookie (.AspNetCore.Antiforgery.*) — protects form submissions from cross-site request forgery.

Both cookies are encrypted and signed server-side via ASP.NET Core Data Protection (a server-side key system) — the values you see in the cookie jar are opaque ciphertext, not plaintext session data.

No third-party or advertising cookies.

How We Use Your Information

Your data is used exclusively to power the app's decisions:

• Determine what seasons are open on your selected date at your selected location
• Determine what licenses / stamps / permits you need to hunt legally
• Surface special rules that apply to you (age-based rules, mentored hunter rules, hunter-education requirements)
• Weather, sunrise/sunset, and legal-hours calculations for your hunting location

We do not use your data for marketing, advertising, sale to third parties, or any purpose outside of directly serving your hunt-planning requests.

Data Sharing

We share your data with third parties only in these specific, minimal ways:

• NWS (National Weather Service) — when you view the weather panel for your hunt, we send the location's latitude and longitude to api.weather.gov to fetch a forecast. Your identity is not sent; the request is anonymous.
• Google Play Console (once the mobile app is submitted for internal testing) — Play Store telemetry per Google's own policies. We do not share account data with Google beyond what a normal Play Store listing requires.

We do not sell your data. We do not share it with data brokers, advertisers, or analytics vendors.

Data Retention

• Active accounts: we keep your account data while your account is active.
• Deleted accounts: if you delete your account (via [email protected]), we remove your account and profile data within 30 days. Server backups may retain your data for up to 90 days after that, then age out.
• Preview / unauthenticated data: anything you enter without creating an account lives only in your browser's local storage. Clearing your browser data removes it.

Your Rights

You can:

• Access the personal data we hold about you — email [email protected] and we'll send it in a machine-readable format within 30 days.
• Correct any inaccurate data — most fields are editable directly in the app; for anything not editable in-app, email us.
• Delete your account and all associated data — email [email protected].
• Export your saved hunting data (locations, species, held authorizations) — email us and we'll send a JSON export.

Wisconsin residents and residents of jurisdictions with additional data-protection rights (GDPR, CCPA) have all rights granted by their local laws in addition to those listed above.

Security

• Passwords are hashed using PBKDF2 with per-user salt via ASP.NET Core Identity. The plaintext password is never stored.
• Data in transit is encrypted via HTTPS (TLS 1.2+) between your device and our server.
• Data at rest — server-side data lives in PostgreSQL on our hosting infrastructure with encryption enabled at the disk level.
• Cookies are marked HTTP-only (JavaScript can't read them) and Secure (only sent over HTTPS in production).
• Antiforgery protection is applied to all state-changing requests.

No system is perfectly secure, but we hold ourselves to the practices that a small, security-aware product should follow. If you believe you have found a security issue, email [email protected] — please don't disclose it publicly until we've had a chance to fix it.

Children's Privacy

ValidHunt is not directed at children under 13. We do not knowingly collect data from children under 13. If a parent or guardian believes we hold data from a child under 13, contact us and we'll remove it.

Hunting-education programs and mentored-hunter programs may involve minors 13-17; parents/guardians of minor hunters using ValidHunt as a planning aid should set up an account under their own name and enter the minor's DOB / hunter-ed status as part of the profile.

Changes to This Policy

We update this policy when the app's data practices change. Meaningful changes will be announced via:

• Notification email to registered users (for material changes)
• Updated Effective date at the top of this document
• A copy of any earlier version, on request to [email protected]

Contact Us

For any question about this policy, your data, or a privacy request:

[email protected]