Privacy Policy

Who we are and what this covers

Trunk or Treat is a free community event organized by Rocky Mountain Foot & Ankle and Core Medicine (together, "we" or "the organizers"). This policy covers the Trunk or Treat website, the family pass you can open in your browser, and the Trunk or Treat app for iPhone and Android, including the vendor portal and the staff tools inside it.

You can reach us at events@rockyfootandankle.com or at Sky Ranch Medical Building, 4505 Enterprise Way, Caldwell, ID 83605.

This is an event registration system, not a patient portal. Using it does not make you a patient of either practice, and nothing in it is medical advice. Please do not enter medical information, Social Security numbers, financial account numbers, or other sensitive information in the registration form, photo titles, or messages to us. Our Official Event Policies and App Terms of Use also apply.

What we collect

When you register a family

• Your first and last name, email address, and city.
• Your phone number and street address, only if you choose to share them.
• The number of adults and children in your party. We ask for counts only, never children's names or ages.
• Which event section or sections you plan to visit, how you heard about the event if you tell us, and whether you want email reminders.
• When you registered, and whether you registered on the website, in the app, or with staff at the door.

Your family pass

• A random pass token and a short pass code that identify your registration. Staff can also look up your registration by name, email, or pass code if you cannot open your pass.
• On the website, a cookie that keeps your pass open in that browser. In the app, your pass is saved in the phone's secure storage so it works without a connection.

At the event

• When staff scan your pass, we record the time, the entrance or section, and which sections your party has visited. We use this to manage capacity and traffic flow and to know when a party has completed all of its eligible sections.

Things you do in the app

• Scavenger hunt progress, votes, raffle entries, contest entries, reports you file about a photo, and contributors you block.
• Basic activity events, such as opening your pass or uploading a photo, tied to your registration. We use these to run the event and to see which features were used. We do not use any third-party analytics or advertising software.
• Your notification choices: whether you want trunk promos and email reminders.

Photos you upload

• Photos and titles you submit for the costume contest or photo challenges, and when you submitted them. Photo files are stored as you upload them. Files from a phone camera can include hidden metadata such as the time and, on some phones, the place a photo was taken.

Notifications

• If you turn on notifications in the app, a push token (an identifier that Apple or Google issues for your app install) and whether the device is an iPhone or an Android phone. If you turn on notifications on the website, the browser's push subscription and its browser type. We also keep delivery receipts for the notifications we send.

Email

• Which event emails we sent to your address and whether they were delivered. To keep honoring unsubscribe requests after a registration is deleted, we keep a scrambled (hashed) version of the email address and its unsubscribe token, not the address itself.

Vendors, sponsors, and staff

• Login email and password (passwords are stored hashed by our sign-in provider and are never visible to us), contact name and phone, booth details, booth photos and promos, and sign-in and activity records for the vendor portal and staff tools.

Security and abuse prevention

• Our hosting and database providers keep standard server logs, which include IP address, device or browser type, and the pages or requests made. To limit abuse, we count sign-in, registration, and pass-claim attempts using a scrambled version of the IP address, email, or pass code. Those counters expire automatically.

What we do not collect

• Precise location. The event map is a drawing of the lot, not a GPS map, and the app never asks for your location.
• Your contacts, calendar, microphone, or health information.
• Payment card numbers. Trunk fees and sponsorships are paid through a link we provide outside the app.
• Advertising identifiers. There are no ads, no advertising software, and no tracking of you across other companies' apps or websites.

Why we collect it

• To process your registration and give you a QR pass.
• To manage event access, attendance, capacity, and crowd flow.
• To send your registration confirmation and, if you opt in, reminders, weather notices, parking instructions, and other event updates.
• To contact you if something about your registration needs attention.
• To run the scavenger hunt, costume contest, trunk voting, and raffle, including reviewing the photos people upload.
• To respond to your questions and requests.
• To keep the website and app secure and prevent abuse.
• To plan future events using summary numbers, such as how many families came from each city.

Who can see it

We do not sell or rent personal information. We never give the registration list, or any attendee's contact information, to sponsors or vendors, including as a sponsorship benefit, and the vendor portal has no way to view it. Access is limited to:

• Event staff and volunteers with a staff account, limited to what their role needs, such as checking families in or reviewing photos.
• Service providers that run the technology for us and may only use the data to provide their service: Supabase (database, file storage, and sign-in), Vercel (website and API hosting), Expo (push notification delivery) together with Apple Push Notification service and Google Firebase Cloud Messaging, Resend (email delivery), and, on the website, your browser's push service. Each provider is bound by its agreement with us to protect your information at least as well as this policy describes and to use it only to provide its service to us.
• Other attendees, who can see your approved costume contest photos along with the title you gave them. Scavenger hunt challenge photos are seen only by your family and the staff who review them. Nobody sees your name or contact details.
• Vendors and sponsors, who see their own booth information and event-night messages from the organizers. They never receive your name, your contact information, or the registration list. At most, the organizers may share summary numbers with them, such as how many families attended, which do not identify anyone.
• Authorities, when the law requires it or when needed to protect someone's safety, for example a lost child or a medical emergency.

Photos are effectively public

Photos are reviewed by the event team, normally before they appear in the app. Once approved, a costume contest photo is shown in the app to other registered attendees. Scavenger hunt challenge photos are shown only to your family and to the staff who review them. Either way, photo files are stored on our file storage at long, random web addresses, and anyone who has one of those addresses can open the file. Treat any photo you upload as public, and upload only photos you are comfortable sharing, especially photos of children. You can delete your own photos at any time, report any photo, and block a contributor so their photos no longer appear for you.

Children

The website and app are meant for adults. A parent or guardian registers on behalf of the family and manages the pass. We collect only the number of children in a party. We do not knowingly collect personal information directly from children under 13. If you believe a child has given us information, email us and we will delete it. Parents and guardians decide whether to upload photos that include their children and can delete those photos at any time.

How long we keep it

• Registration information and event records are kept for the current event year to run the event and to plan the next one. Each event year has its own registration list.
• Photos are removed when you delete them or delete your registration. Removal from storage can take a short time to finish.
• Push tokens are removed when you turn notifications off, sign out, or delete your registration. Notification delivery receipts are kept for about a day.
• Abuse-prevention counters expire automatically.
• Hashed unsubscribe records are kept so that we keep honoring your request.
• Our service providers keep backups and server logs on their normal schedules.

If you want your information removed sooner, delete your registration in the app or email us.

How we protect it

Connections to the website and app are encrypted. Staff and vendor tools require a password, passwords are stored hashed, and the identifiers we use for abuse prevention are scrambled before they are stored. Access to registration information is limited to the people and providers named above. No system is perfectly secure, so please keep your pass code private and do not share your pass with another family.

Your choices

• Emails: unsubscribe using the link in any event email, or turn reminders off in Settings.
• Notifications: turn trunk promos or all notifications off in the app's Settings, or in your phone's notification settings.
• Photos: delete any photo you uploaded from the Play tab.
• Your registration: delete it yourself in Settings. Vendors can delete their account in the vendor portal after confirming their password. Everything tied to the registration or account is removed, and your pass stops working.
• Access or correction: email us to see what we hold about you or to correct it.
• Help: if you cannot use the app, email us and we will delete your information for you. See Delete your account and data for details.

If your state's privacy law gives you additional rights, email us and we will honor them. We will not treat you differently for exercising them.

Cookies and device storage

The website uses one cookie to keep your family pass open in that browser for up to 120 days, and sign-in cookies for the vendor and staff portals. There are no advertising or analytics cookies. The app stores your pass, your notification choice, and your settings in the phone's secure storage.

Links to other sites

Vendor and sponsor websites linked from the app have their own privacy policies. We do not control them.

Changes to this policy

If we change this policy, we will post the new version here with a new date. If a change affects how we use information you already gave us, we will tell registered families through the app or by email.

Contact

Questions about your information? Email events@rockyfootandankle.com or write to Rocky Mountain Foot & Ankle and Core Medicine, Trunk or Treat, 4505 Enterprise Way, Caldwell, ID 83605.