Last updated: September 30, 2026
BIGtoken, Inc. (“BIGtoken”, “we”, “us”, “our”) respects your privacy. This policy explains what personal information we collect, why we collect it, who we share it with, what we store on your device, and the rights you have.
It applies to bigtoken.com, app.bigtoken.com (including when you install it to your home screen), and the measurement technology we provide to brands, described in section 6.
BIGtoken is intended for people in the United States, and we operate under United States privacy law. If you use our services from somewhere else, your information will be sent to and processed in the United States. See section 11.3.
1. How to contact us
You can reach us about privacy in either of these ways:
- By email: hello@bigtoken.com
- By post: BIGtoken, Inc., 11 South Run, Cold Spring Harbor, NY 11724
2. What we collect
2.1 If you are a consumer
Account and identity. Your name, email address and phone number, and whether each has been verified.
Profile and demographics. Your date of birth, gender, pronoun and postal code.
Approximate location. We look up map coordinates from the postal code you give us, so that brands can see roughly which areas their survey respondents are in. We do not read the location from your device.
Wallet. We create a blockchain wallet for your account and hold it on your behalf, which means we keep the key that controls it. We record its address and related identifiers.
Your activity. Your survey and engagement responses, rewards, referrals, prize draw entries, cashback, the links you share and clicks on them, and when you were last active.
Communications. Whether you have subscribed to email and SMS, your push notification token, and records of messages we sent you.
Survey questions are written by the brand running the survey. Some may ask about sensitive matters, such as your health or your religious or political beliefs. Your answers are used to show results to the brand running the survey.
2.2 If you are a creator
Your name, email address, phone number, display name, biography, profile image and social media links. Your sign-in method, the address of the wallet we create and hold for you (see section 2.1), and your payout preferences. The campaigns you take part in, your earnings and engagement figures, and your communication preferences.
If you reached us through a partner platform, see section 5.
2.3 If you are a brand user or corporate user
Your business contact details: name, email address and phone number, and for some accounts date of birth and postal code. Also which brands or companies you are attached to, your permission level, invitations you send or accept, and a record of changes to your permissions.
2.4 If you are a visitor
We collect the information described in sections 3 and 4. You do not need an account to browse our sites.
If you use the contact form on bigtoken.com, we collect your name, email address, phone number and whatever you write in the message, so that we can reply to you.
3. What we collect automatically
From everyone who uses our websites:
Your device and connection. Your IP address, browser user agent, device type and platform, and an approximate location worked out from your IP address.
How you use the site. The pages you view, the page that referred you, session identifiers, timestamps and the actions you take.
Video engagement. For campaign and trailer videos, how many seconds you watched, what percentage you completed, whether you paused, and whether the view met our measurement criteria.
Things stored on your device. Cookies and similar technologies, described in section 4.
4. Cookies and similar technologies
This section covers more than cookies. It also covers anything else stored on or read from your device, such as browser local storage and IndexedDB. We use those more than we use cookies.
4.1 The short version
We set no cookies of our own on app.bigtoken.com. What we store ourselves goes into your browser’s local storage or IndexedDB instead.
Other companies whose services we load set their own cookies. They are described in section 4.4.
We group everything into three categories:
- Strictly necessary. The site needs it to work. Without it you cannot sign in, or the site cannot function
- Functional. It remembers your preferences
- Analytics. Optional. It tells us how the site is used
4.2 Strictly necessary storage
Set by BIGtoken, stored in your browser’s local storage, and kept until you clear your site data.
| Name | What it does |
|---|---|
jwt |
Keeps you signed in |
userID |
Identifies your account to the app |
lastAuthSide |
Remembers which sign-in method you used |
newSignup |
Marks a new account so that the welcome steps run only once |
phoneVerificationId |
Completes phone number verification |
survey_visit_id_… |
Identifies a single visit to a survey, so your answers are recorded against the right one |
survey_counted_… |
Remembers that a survey visit has already been counted, so it is not counted twice |
| Your cookie choice | Remembers what you chose, so we do not ask again on every page |
email, phone, username |
Copies of your email address, phone number and name, so the app can complete verification and fill in forms without asking you again. Deleted when you sign out |
Firebase Authentication, the service that signs you in, also stores session information in IndexedDB on your device.
4.3 Functional storage
Set by BIGtoken, kept until you clear your site data.
| Name | What it does |
|---|---|
theme |
Remembers whether you chose light or dark mode |
visited |
Remembers that you have been here before |
readAll |
Remembers which notifications you have read |
hasRejectedNotifications, rejectionTime |
Remembers that you said no to push notifications, so we stop asking |
deviceToken |
Delivers the push notifications you asked for |
userCountry |
Shows you content relevant to your country |
4.4 Other companies’ services
Microsoft Clarity (analytics, optional). Records how people use our site, including mouse movement, clicks, scrolling and which pages they move between, so that we can see where the product is confusing. What you type into forms, and fields such as your email address and phone number, are hidden in the recordings. Recordings are deleted automatically after 30 days. Clarity sets these cookies:
| Name | Set on | How long | What it does |
|---|---|---|---|
_clck |
bigtoken.com |
1 year | Recognises a returning browser across visits |
_clsk |
bigtoken.com |
1 day | Groups the pages you view into a single recording |
MUID |
clarity.ms (Microsoft) |
1 year | Microsoft’s identifier for your browser |
Vercel Analytics (analytics, optional). Counts page views and which page referred you. Vercel also hosts app.bigtoken.com, and processes server request logs including IP addresses in order to deliver and protect it.
Google Sign-In (strictly necessary, sign-in pages only). Loaded only on pages with a Google sign-in button, so that you can use a Google account to sign in. It sets one cookie on our site:
| Name | Set on | How long | What it does |
|---|---|---|---|
g_state |
app.bigtoken.com |
About 6 months | Remembers whether Google’s sign-in prompt was shown or closed, so it is not shown again every visit |
If you are already signed in to a Google account, your browser also sends Google its own cookies when the button loads. Those belong to Google, not to us, and are covered by Google’s privacy policy.
Sentry (strictly necessary). Detects and diagnoses faults. When something goes wrong it records the technical details of the error, the page you were on, and how the site was performing. If you are signed in it also records your account identifier, so that we can trace a fault. It does not record your name or your email address, and it does not record what is on your screen.
Cloudflare (strictly necessary, bigtoken.com). Protects bigtoken.com from automated abuse. It sets one cookie, __cf_bm, which lasts about thirty minutes and is used to tell people apart from bots. It is not used to track you and does not follow you to other websites.
4.5 Your choices
Cookie Preferences on app.bigtoken.com. When you first visit the app, we ask whether you agree to optional analytics, and you can accept or reject them. Microsoft Clarity and Vercel Analytics load only if you agree. You can change your choice at any time using the Cookie Preferences link at the bottom of the app once you are signed in. Withdrawing your agreement stops any further collection, though it does not undo anything that happened beforehand.
In your browser. Every major browser lets you block or delete cookies and clear site data. Blocking strictly necessary storage will stop you signing in.
Do Not Track. Some browsers let you send a “Do Not Track” signal to the websites you visit. Our websites do not respond to this signal.
5. Information we receive from partner platforms
If you reach BIGtoken through a partner platform, inside an experience embedded in their product, that partner sends us a signed message identifying you. It contains an identifier the partner holds for you, your email address, and where available your first name, last name and display name.
We use it to find or create your BIGtoken creator account, so that your campaigns and earnings are the same wherever you look at them.
We do not receive your password or your payment details from the partner.
For this information, BIGtoken acts on its own behalf: we decide how it is used, and this policy applies to it. What the partner does with your information is covered by the partner’s own privacy policy.
6. Measurement on brands’ websites
We give brands a small piece of measurement code that they install on their own websites. It lets them see which campaigns and creators led to a visit or a purchase, so that the right creator is credited.
If you encounter it, we may receive your IP address, your browser user agent, the page you are on, the page that referred you, and events the brand chooses to send us, such as completing a purchase. A brand may also send us its own identifier for you.
It stores the following on the brand’s website, not on ours:
| Name | Where | How long | What it does |
|---|---|---|---|
bt_vid |
Local storage | Until you clear it | Recognises a returning browser |
bt_click |
Local storage and a cookie | 30 days | Connects a later action to the campaign link you clicked |
bt_sid |
Session storage | 30 minutes | Groups your activity into a single visit |
We use this only to work out which campaign and which creator drove an engagement or a sale. We do not combine it across brands, and we do not use it for advertising.
7. Why we use your information
| What we do | Who it applies to |
|---|---|
| Create and run your account | Everyone with an account |
| Run the campaigns, surveys and engagements you join | Consumers, creators |
| Work out your rewards and earnings | Consumers, creators |
| Check that engagement is genuine and prevent fraud | Consumers, creators, visitors to brands’ sites |
| Keep the service secure, reliable and working | Everyone |
| Measure campaign results for brands | Visitors to brands’ sites |
| Understand how our own websites are used | Everyone |
| Send you marketing emails and text messages | People who opted in |
| Meet our legal and tax obligations | Everyone |
Where we ask for your agreement, such as for marketing messages or optional analytics, you can withdraw it at any time. Withdrawing it does not affect anything we did before.
8. Who we share your information with
We do not sell your personal information, and we do not share it for cross-context behavioural advertising.
We share personal information with the following companies, who provide services we need to operate:
| Who | What they receive | What they do with it |
|---|---|---|
| Google Firebase | Email address, phone number, account identifier, sign-in events | Signing you in |
| Neon and Hasura | All account and activity data | Running our database |
| Vercel | Request logs, IP address, page views | Hosting app.bigtoken.com |
| Amazon Web Services | Stored files, background jobs | Storage and processing |
| Amazon SES and Amazon Pinpoint | Email address, phone number | Sending you email and text messages |
| Sentry | Account identifier, error and performance details | Finding and fixing faults |
| Microsoft Clarity | Recordings of how you interact with our own sites | Understanding how the product is used |
| Pinata and IPFS | Campaign and reward content | Storing reward information |
| QuickNode | Wallet address | Connecting to the Solana network |
| Cloudflare | IP address | Delivering and protecting our websites |
| Zippopotam.us | Your postal code and IP address | Looking up the map coordinates of your postal code |
| Form providers used for specific campaigns | Account identifier, name, email address, phone number, and what you enter in the form | Running forms for a campaign, such as event tickets |
| Brands | Overall campaign results, and the conversion events they sent us themselves | Reporting on their campaigns |
| Partner platforms | Confirmation that an account exists and its engagement status | Running the embedded experience |
We also share information with our professional advisers, and with authorities where the law requires it. If our business is sold or merges with another, your information may transfer as part of that, and we will tell you if it does.
9. Information recorded on a public blockchain
Some rewards are issued as tokens on the Solana blockchain and sent to a wallet linked to your account. Related content is stored on IPFS.
We cannot change or delete either of these. A public blockchain is permanent by design and is not controlled by us. A record that a particular wallet received a particular reward stays visible to anyone, indefinitely, even after you close your account. Content stored on IPFS is addressed by what it contains and may stay available on computers we do not control.
The blockchain record shows a wallet address and a reward: which survey or campaign it came from and its value. It does not show your name, your email address or your survey answers.
10. How long we keep your information
We keep your information only as long as we need it for the purposes in section 7, or for as long as the law requires.
| What | What starts the clock | How long we keep it |
|---|---|---|
| Your account information | You close your account, or ask us to delete it | Up to 90 days |
| IP addresses in our measurement records | When we collect them | 90 days |
| Video engagement records | When we collect them | 2 years |
| Conversion and attribution records | When we collect them | 2 years |
| Email and text message delivery logs | When we send the message | 12 months |
| Financial and payment records | The transaction | 7 years, because tax law requires it |
If you stop using BIGtoken, we do not delete your account. Being inactive does not start any of the clocks above. Only closing your account, or asking us to delete your information, does.
Financial and payment records are the exception to deletion. If you ask us to delete your information, we still have to keep those for the period above, because tax law requires it. We will tell you if that applies to your request.
Anything already written to a public blockchain cannot be deleted, for the reasons in section 9.
11. Your rights
11.1 Rights we give everyone
Privacy laws differ from state to state. Rather than give people different rights depending on where they live, we apply the same standard to everyone, based on the strictest US state law that applies to us.
You have the right to:
- Know what personal information we have collected about you, where we got it, why we collected it, and who we shared it with
- Get a copy of the personal information we hold about you
- Correct information that is wrong
- Delete your personal information, subject to the exceptions the law allows, such as records we must keep for tax purposes
- Opt out of the sale or sharing of your personal information. We do neither, but the right stays yours if that ever changes
- Limit how we use sensitive personal information
- Not be treated differently because you exercised any of these rights. We will not deny you service, charge you a different price, or give you a lower quality service
You can use an authorised agent to make a request on your behalf. We will ask them to prove you authorised them, and we may ask you to confirm it directly.
If we refuse a request, we will tell you why and how to appeal. We reply to an appeal within 60 days.
11.2 If you live in California
Everything in 11.1 applies to you. California also requires us to set out specifically: the categories of personal information we collect (sections 2, 3 and 4), where it comes from (from you, from your device, from brands’ websites and from partner platforms), why we collect it (section 7), the categories of company we share it with (section 8), and how long we keep it (section 10).
11.3 If you are outside the United States
Your information is processed in the United States under United States law, which may protect you differently from the law in your own country. The rights in section 11.1 apply to you too.
12. How to use your rights
Contact us using either method in section 1 and tell us what you would like to do.
Checking it is you. Before we act, we will ask you to confirm your identity, normally by proving you control the email address or phone number on the account. This protects you from someone else making a request in your name.
How long we take. We confirm we have received your request within 10 days, and we respond within 45 days. If we need longer, we will tell you why, and we may take up to a further 45 days.
Cost. Free, unless a request is repetitive or excessive.
If we say no. We will explain why, and tell you how to appeal.
One limit we want to be clear about. We cannot delete anything already written to a public blockchain, for the reasons in section 9.
13. Children
Our services are not intended for children and we do not knowingly collect their personal information. You must be at least 13 to use BIGtoken. If you believe a child has given us personal information, contact us using either method in section 1 and we will delete it.
14. Changes to this policy
We review this policy at least once every 12 months. We will post any changes on this page and update the date at the top. If a change is significant, we will let you know before it takes effect.