Effective date: October 15, 2026
Last updated: October 19, 2026
This policy explains what BFT Digital LLC, a Wyoming limited liability company ("BFT Digital," "we"), collects through collegefraturday.com (the "Site"), why, who we share it with, how long we keep it, and your choices.
The short version
- Browsing needs no account. There are no shopper accounts, no checkout and no newsletter.
- No advertising or tracking cookies. We don't sell personal information or share it for cross-context behavioral advertising.
- Community features are switched off today. When they're switched on, organizers give us only what's needed to verify and publish a listing, and verification contact details are deleted once a request is decided.
- We never publish a private home address without the residents' authorization (confirmed by the organizer) and our decision to publish it.
Part A: What we collect today
| Activity | Information | Why | How long |
|---|---|---|---|
| Visiting any page | Our host, Cloudflare, processes the technical data needed to deliver pages: IP address, browser and device information, and the requested web address, including any search text or ZIP code it contains. Our hosting logs record these requests | Deliver the Site; security; troubleshooting | Hosting logs: about 3 days |
| Saturday Forecast | The ZIP code you type. Our server sends only that ZIP to Zippopotam.us, and the location's coordinates to the U.S. National Weather Service; your IP address isn't sent to them | Show your forecast | Our weather cache records only places and weather, never who asked: ZIP-to-location lookups ≤30 days (unrecognized ZIPs 1 day); location-to-forecast-area lookups ≤30 days; forecasts refreshed hourly and kept ≤2 days; weather alerts refreshed every 5 minutes and kept ≤2 days |
| Playlists | Nothing until you tap Play here. Spotify's player then loads, and Spotify's privacy policy and cookies apply | Play music | Not stored by us |
| Print Shop | Card text is processed in your browser and never uploaded. A draft is saved in your browser's local storage | Make your card | On your device until you clear it |
| Shopping links | Nothing. Links are plain links to retailers. The retailer's own policy applies once you're on its site | — | — |
| Emailing hello@, support@ or legal@ | Your email address, any name you give, and your message. Delivered through Cloudflare Email Routing to our mailbox provider | Answer you; handle requests, appeals and legal notices | Routine messages: 12 months, then deleted. Exceptions: see Data Retention Policy §3 |
| Administrator sign-in | Cloudflare Access session for our administrator only | Protect moderation tools | Per session settings |
What we don't do today:
- Site analytics are not enabled: no page-view statistics.
- We don't record clicks or other in-page events.
- If we enable cookieless page analytics (Cloudflare Web Analytics), we'll update this policy first.
Part B: Features not yet available
These features aren't available yet. If we make them available, this is what they'll collect. We'll update this section first if anything changes.
| Feature | Information | Why | How long |
|---|---|---|---|
| Listing request or house claim | House name, type, general area, optional public contact, optional exact address with your authorization statement, your name, your role, a verification contact, your message, and a record that you accepted the Terms (policy version + time) | Verify you and review the listing | Verification contact: deleted when the request is decided. An exact address not chosen for publication: removed 30 days after the decision. The rest: kept as a moderation record for 24 months after the decision, then deleted (Data Retention Policy) |
| Published listing and events | House name, type, area, optional public contact, optional authorized address, Saturday schedule | Public directory | Public until removed. A removed listing or event is no longer public. Any address that was published is deleted when the listing is removed, and the rest of the record is deleted 24 months after removal (Data Retention Policy) |
| Organizer sign-in | Your name and role (admins only), a manage code (stored only as a keyed hash) and a first-party session cookie | Let verified organizers manage their listing | Session ≤12 hours; code hash until rotated; organizer record deleted 24 months after access is revoked |
| Reports | Reason and optional note (no Terms acceptance needed) | Moderation | 24 months after the report is resolved |
| Comments | Display name you choose (or "Anonymous"), comment text, and the Terms-acceptance record (policy version + time) | Pre-moderated public comments | Published: until removed. Rejected or spam: ≤30 days. Removed: 24 months after removal |
| Interest and props (18+, no acceptance box; one-tap) | A keyed hash of the item plus a random device token kept in your browser. No name, account or contact | Count once per device | Interest: deleted 30 days after the event. Props: ≤30 days |
| Abuse prevention on these forms | A keyed, non-reversible hash of your IP address; rate-limit counters; Cloudflare Turnstile bot check | Stop spam and abuse | IP hash: ≤30 days, or cleared earlier when a request is decided. Counters: hours to 2 days. Turnstile: per Cloudflare |
| Audit log | Records of listing, event, organizer and moderation actions | Accountability and safety | 2 years |
Longer retention applies only under the narrow exceptions in Data Retention Policy §3: open disputes, abuse investigations, legal notices, legal holds, and statutory requirements.
Cookies and browser storage
| Name | Type | When | Purpose | Duration |
|---|---|---|---|---|
| Print Shop draft | Local storage | Today, only if you use the Print Shop | Save your unfinished card | Until you clear it |
| Spotify | Third-party cookies | Today, only after you tap Play | Spotify's player | Per Spotify |
| Retailer (Amazon) | Third-party cookies, set on the retailer's site | Only after you click an Amazon link | Credit a purchase to us as an affiliate | Per Amazon |
| Access cookies | Cookies | Today, only for our administrator | Staff sign-in | Per session |
fd_org | Strictly necessary cookie (HttpOnly, Secure, SameSite=Strict) | Part B, signed-in organizers only | Organizer session | ≤12 hours |
fd_device | Local storage | Part B, only if you use interest or props | Count one per device | Until you clear it |
We don't use advertising, social-media or cross-site tracking cookies.
How we share information
We share information only with service providers that operate the Site for us, and as described here:
- Cloudflare: hosting, database, administrator access, email routing, and bot checks (Turnstile, Part B).
- Our mailbox provider: stores email sent to our addresses.
- Zippopotam.us and the National Weather Service: forecast lookups (ZIP or coordinates only).
- Spotify: only when you choose to play a playlist.
We may also disclose information:
- if the law requires it;
- to protect the safety or rights of people or the Site;
- in connection with a merger, sale or reorganization of BFT Digital, with this policy continuing to apply.
We don't sell personal information and don't share it for cross-context behavioral advertising.
Activity across other sites
- We don't allow advertising networks or other third parties to collect information about your activity on our Site for use across other sites.
- A retailer you visit through our links, or Spotify if you play an embed, collects information under its own policy.
- Some links are affiliate links (currently Amazon, as an Amazon Associate). After you click one, the retailer may use its own cookies on its site to credit the purchase to us, under its own policy. See the Affiliate Disclosure.
Do Not Track
- Browsers can send a "Do Not Track" signal. There's no common standard for responding to it, so the Site doesn't change its behavior when it receives one.
- Because we don't track you across sites or use advertising cookies, the result is the same either way.
Your choices and rights
- Directory information. Ask to access, correct or delete directory information about you, or to remove a listing or address: support@collegefraturday.com. We'll respond within 30 days, or sooner if the law requires. We may keep a minimal record that we handled the request.
- Email. Ask us to delete our correspondence with you, unless an exception in the Data Retention Policy applies.
- Browser storage. Clear cookies and local storage, or block scripts. The core Site works without them.
- State privacy rights. Some states give residents additional rights. We honor verified requests as required by the laws that apply to us.
Children
- Browsing is open, but the Site is intended for adults. Participation is limited to people 18 or older.
- We don't knowingly collect personal information from children under 13, or from anyone under 18 through community features.
- If you believe a minor has submitted information, write to support@collegefraturday.com and we'll delete it.
Security
Safeguards in place:
- HTTPS and a strict content security policy;
- secrets kept out of source code;
- keyed hashing of codes and IP addresses;
- rate limits and bot checks on public forms;
- administrator access protected by strong authentication;
- an audit log.
No system is perfectly secure. We'll notify affected people where the law requires.
Retention
See the Data Retention Policy.
Changes and contact
- We'll post changes here with a new effective date, and note material changes on the Site.
- Privacy and data requests: support@collegefraturday.com. Legal notices: legal@collegefraturday.com.