Privacy Policy

This policy explains what personal information Treasure Idaho (treasureidaho.com, the "site") collects, why, who we share it with, how long we keep it, and the choices and rights you have. "We", "us" and "our" mean the operator of the site, doing business as Treasure Idaho, based in Idaho, USA (mailing address: 141 N. Palmetto Ave, Eagle, Idaho 83616, USA).

Short version: we collect what you give us to run accounts, listings, forms and community features; we keep a first-party activity log of page views and clicks; and when a measurement ID is configured we use Google Analytics 4 to measure traffic. Lead and availability forms are routed to the relevant realtor, host, builder, business or employer. We do not sell personal information. See also our Terms and Conditions.

1. Who we are

The site is operated by the operator of Treasure Idaho, doing business as Treasure Idaho, based in Idaho, USA (mailing address: 141 N. Palmetto Ave, Eagle, Idaho 83616, USA). For the purposes of the EU and UK General Data Protection Regulation (GDPR), we are the "controller" of the personal information described in this policy.

Privacy questions and requests: use the contact form. We aim to reply within 30 days. We do not publish an email address on this page.

2. Information we collect

Account information.

When you create an account we store your email address, the name you give us, and (if you use email and password) a one-way hash of your password — never the password itself. Sign-in is provided by our own authentication system. You can sign in with Google or LinkedIn (when offered), or with email and password.

Social sign-in.

If you choose Google or LinkedIn, that provider sends us basic profile information such as your name, email address, whether the email is verified, a profile photo URL and a provider account ID. We store these to create and sign in to your account. We do not receive your provider password, and we do not post on your behalf. See section 6.

Profile and membership information (optional).

Display name, bio, photo, saved home city, role preferences (for example realtor, host, builder, shop owner or instructor), notification settings, and other fields you choose to fill on your profile or dashboard.

Content you post.

Reviews, photos, comments, community posts, stay testimonials, business or listing claims, job-seeker profiles, and other material you upload or submit.

Forms and leads.

Contact and sponsor forms; "request info" leads on homes and builders; realtor contact messages; stay "check availability" requests (name, email, phone, dates, guests, note); open-house and listing interest sent to realtors; business, builder, stay, realtor, shop and instructor claim applications (including license and brokerage details where required for realtors); and newsletter or alert sign-ups.

Voting and game activity.

Best of Idaho award votes (tied to your signed-in account, with IP-based Idaho eligibility checks), gem hunt finds and optional device location while you play, deal unlocks, and similar activity.

Technical and usage information.

When you use the site our hosting provider receives your IP address, browser user agent and the pages you request. When you sign in we may store IP address and user agent with your session for security. Our first-party activity log records page views, clicks and dwell time (see section 5). For spam limits we store a one-way hash of your IP address (and sometimes of the email you typed) for a short period when you submit a form. We may derive a rough city from IP (hosting geo headers or our offline GeoIP database) for sorting "nearest first" lists and for Idaho-only voting.

Email events.

Transactional and notification email is sent through an email delivery provider. That provider may tell us if an address bounced or was marked as spam so we stop emailing it. Some messages include an unsubscribe link.

3. Where we get information

• From you, when you create an account, fill in a profile, post, vote, play the gem hunt, or submit a form.
• From Google or LinkedIn, when you choose to sign in with them.
• Automatically, from your browser and device when you visit (IP address, user agent, approximate city, pages viewed, links clicked, and — only if you allow it — device location for the gem hunt or "use my location").
• From public sources for site content: public job postings on employers' own boards, public business and listing information, and similar publicly available material.
• From representatives who claim a listing (business, builder, stay, realtor, shop or instructor) and from hosts, builders and realtors who receive leads you asked us to send.

4. How we use information

We use personal information to:

• Create and run your account, keep you signed in, and show your profile and dashboards.
• Operate listings, claims, community features, awards voting, the gem hunt, deals and boosts.
• Route contact, lead and availability forms to the right realtor, host, builder, business or to our administrators.
• Send service emails (confirmations, password resets, lead notices, hunt or deal alerts you turned on) through an email delivery provider.
• Send newsletters and saved-search or deal alerts you asked for, with a one-click unsubscribe.
• Measure traffic and usage with our first-party activity log and, when configured, Google Analytics 4.
• Prevent spam and abuse, enforce our Terms, and comply with law.

If you are in the EEA or UK, we rely on performance of a contract (our Terms), consent (where you opt in, such as newsletters, optional location, or analytics where required), legitimate interests (security, basic product analytics, routing forms you submitted), and legal obligation where applicable. We do not use your information for automated decision-making that has legal or similarly significant effects on you, and we do not build advertising profiles to sell.

5. Cookies, local storage and tracking

Google Analytics 4

When a Google Analytics measurement ID is configured for the site, we use Google Analytics 4 (GA4), provided by Google LLC, to measure traffic and usage. GA4 sets cookies such as _ga and _ga_<container-id>, which may remain for up to about 2 years. It collects device and browser information, pages viewed, approximate location and referrer information. Google handles IP addresses according to GA4's IP-handling features and policies; Google may process this information in the United States. See Google's privacy policy. You can opt out using Google's Google Analytics Opt-out Browser Add-on. Where required by law, including for visitors in the EU or UK, analytics cookies should load only after you consent. Until a measurement ID is set, GA4 is inactive and the gtag script is not loaded.

Admin areas of the site (/admin and paths under it) are excluded from GA4 page-view tracking.

First-party activity log

When you view a page or click a link, the site may record the path, a short label, the time, dwell time, a visitor and session identifier stored in your browser, and — if you are signed in — your user id and email for administrator traffic tools. We use this only to understand what is read and clicked; only site administrators can view it. It does not use third-party ad cookies.

If you are signed in and have contacted a realtor through Treasure Idaho, we may share a short summary of what you browse on the site (for example cities, communities and homes you looked at) with that realtor so they can help you. Anonymous visits are not shared. You can turn this off anytime on your profile under "Share my browsing interests with my agent."

Cookies and browser storage we use

You can block or delete cookies and site data in your browser settings; if you block the sign-in cookies you will not be able to stay signed in.

Approximate city from IP. For "nearest first" lists we may use your saved home city (if signed in), else an approximate city from hosting geo headers, else Boise. Best of Idaho voting uses an offline IP-to-region database from an IP location provider (credited below) on the server to check Idaho eligibility; we fail closed when location is unknown.

Do Not Track / Global Privacy Control. We do not sell personal information or share it for cross-context behavioural advertising. The site does not currently change its behaviour when your browser sends a Do Not Track or Global Privacy Control signal, except that GA4 is inactive until a measurement ID is configured and admin routes are not sent to GA4.

Third-party content. Some pages load maps, video players, fonts or affiliate redirects. When that content loads, those companies receive your IP address and browser details under their own policies. Affiliate networks may set a cookie when you click a shop link so a seller can credit a commission; we do not send your name, email or account details to them with that click.

6. Signing in with Google or LinkedIn

Social sign-in is optional when email and password is also available. If you use social sign-in:

• We ask the provider for basic profile information (typically name, email, email-verified status, profile photo URL and account ID).
• Sign-in goes directly between you, the provider and this site; the site stores the provider account ID and encrypted tokens as needed to keep you signed in.
• We do not read your contacts or post on your behalf.
• You can remove our access in your Google or LinkedIn settings; that does not by itself delete your Treasure Idaho account.

7. What other people can see

• Public: public profile fields you choose to show, public posts and photos, public listing pages, Best of Idaho vote counts and results, gem hunt leaderboards and finds you post, and similar public features.
• Shared with a recipient you chose: lead and availability forms are emailed or shown to the relevant realtor, host, builder or business (and may also be visible to site administrators for spam and support).
• Never shown publicly: your password, raw IP address, private messages' full admin tooling beyond what participants see, and contact details we strip from host-facing public stay pages (hosts are reached through "check availability", not a public email on the page).

Anything you post publicly can be copied or shared by others before you delete it. Please do not post other people's private information.

8. Forms, leads and routing

When you submit a form we store the contents with a hosted database provider and typically queue an email through an email delivery provider:

• Contact / sponsor forms go to site administrators.
• Home and builder "request info" leads go to the builder or listing contact and may be reviewed by administrators.
• Realtor messages go to the claimed realtor (and may be listed in that realtor's private dashboard / CRM-style leads panel).
• Stay date / availability requests go to the host (email and/or host dashboard), with your consent to send your details.
• Open houses are posted by verified realtors for the public map and events board; interest and messages about homes or open houses are handled through realtor contact and lead tools, not as a public guestbook.
• Business and listing claims are reviewed by administrators before a page is handed over.
• Business and Employer CRM show a business or employer only the leads that came through Treasure Idaho to that page (for example inquiries, bookings, check-availability requests, page or job saves, and apply-link opens). Outside contacts they import themselves stay in their private CRM. Member details are not shared with other businesses or employers.
• Site CRM / newsletters are used by administrators for lists you joined or contacts collected through forms; every newsletter we send includes unsubscribe instructions.

We use honeypots, timing checks and per-IP / per-email rate limits to reduce spam. Hashed IPs used for those limits are kept only briefly.

9. Best of Idaho voting

Voting is open only to people in Idaho. We check eligibility on the server using the visitor's trusted network address and an offline IP-to-region database. If we cannot confirm you are in Idaho, the vote is refused. You must be signed in; one vote per category per account per year. Vote counts and results are public. We may use IP address as a secondary anti-fraud guard across accounts. Location checks for voting are not used to track you around the web.

10. Gem hunt location

The daily gem hunt runs from 7:00 a.m. to 5:00 p.m. Boise time (America/Boise). Claiming a stone may use optional device location that you allow in the browser; we do not request precise location on page load without an action from you. Location shared for the hunt or "use my location" may be kept in session storage for that browser session. Sponsored stones and deals follow the same daylight and public-spot rules. See the Terms for safety and assumption of risk.

11. Affiliates, sponsors and payments

Shop and gear links may use affiliate networks so we can earn a commission at no extra cost to you. Sponsored and featured placements (including hunt sponsorships and boosts) are paid or complimentary promotions labelled on the site. When paid subscriptions, boosts or sponsorships are offered, payments are handled by a third-party payment processor; card details are entered on the processor's pages, not stored on Treasure Idaho as full card numbers. Online payment is not live until we enable it; until then boost and sponsorship flows may collect a request without charging you.

12. How long we keep information

13. Security

We use HTTPS, store passwords only as hashes when email sign-in is used, keep sign-in cookies as host-only secure cookies where supported, restrict direct database access to our servers, and rate-limit sensitive forms. No system is perfectly secure. If we learn of a breach that affects your personal information, we will notify you and the authorities as the law requires. Use a unique password and tell us about security issues through the contact form.

14. Your rights and choices

Everyone. You can edit your profile, delete content you control, turn off optional notifications, unsubscribe from emails using the link in the message, and clear cookies and site data in your browser. To close your account, get a copy of your data, or ask us to delete lead records we hold, use the contact form. We will verify your identity before acting.

EEA and UK. You may have rights to access, correct, delete, restrict or object to processing, to data portability, and to withdraw consent. You may complain to your local data protection authority.

California and other US state privacy laws. You may have rights to know, access, correct, delete and not be discriminated against for exercising those rights. We do not sell personal information or share it for cross-context behavioural advertising. Google Analytics, when configured, is disclosed to Google LLC as a service provider for measurement as described in section 5.

We respond to verified requests within the time the law requires (generally 30 days under GDPR and 45 days under the CCPA).

15. International transfers

We are based in the United States. Our database is with a hosted database provider in the United States. Email is sent through an email delivery provider. Sign-in may involve Google or LinkedIn. Our hosting provider and these services may process data in the United States and possibly other countries. If you use the site from outside the US, your information will be transferred to and stored in the US, where data protection laws may differ. For transfers from the EEA, UK or Switzerland we rely on our providers' Standard Contractual Clauses (and the UK Addendum) or their Data Privacy Framework certification where available.

16. Children

The site is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has given us personal information, contact us through the contact form and we will delete it. If you are under the age of majority where you live, use the site only with a parent or guardian's involvement.

17. Contact us

Treasure Idaho, 141 N. Palmetto Ave, Eagle, Idaho 83616, USA. Privacy questions, deletion requests and other requests: use the contact form. We do not publish an email address on this page.

18. Changes to this policy

We will update this policy when our practices change and change the "Last updated" date at the top. If a change is material, we will tell signed-in members on the site or by email before it takes effect where practical.

Credits

IP location data by DB-IP, CC BY 4.0.

See also our Terms and Conditions.