Privacy Policy

This site (the Summer Meet-Up Road Trip challenge board) is operated by KFLO Entertainment, Inc. ("KFLOE," "we," "us"), the publisher of Tediddle.

Mailing address: 801 W. Main St, Peoria, IL 61606

Questions about this policy or your data? Email help@tediddle.com.

• Your email address, when you sign in via magic link.
• An optional display name, if you set one.
• Challenges you submit and votes you cast.
• For challenges with a specific spot: the place name, latitude and longitude, and the Google Place ID for the location you picked. We store the Google Place ID so we can deep-link the spot during the live event.
• Technical data our service providers log to keep the site working. Your IP address is hashed before it's stored — we use the hash for rate limiting and abuse prevention; we don't keep the raw IP.

• Authenticate your sign-in.
• Show your submissions and votes on the site.
• Send occasional marketing emails about Tediddle products, road-trip updates, and xlightshows.io events and merchandise. You can unsubscribe anytime via the link in any email, or by emailing help@tediddle.com.

We don't sell, rent, or trade your data. We don't share your email with any third party except the service providers below, which process data on our behalf to run the site.

• Hosting, CDN, and bot protection — Cloudflare (including Cloudflare Turnstile for CAPTCHA on submission).
• Account database and sign-in — Supabase.
• Magic-link and notification email delivery — Resend.
• Place search and map data for the challenge map — Google Places.
• Aggregate visitor counts — Cloudflare Web Analytics. First-party, no cookies, no individual tracking.

We only use cookies that are essential to running the site. No advertising, retargeting, or cross-site tracking cookies. The site's analytics (Cloudflare Web Analytics) doesn't use cookies at all.

• Supabase auth cookies (sb-*-auth-token) — keep you signed in across page loads.
• Cloudflare Turnstile cookies (__cf_bm, cf_clearance) — bot detection when you submit forms.

• Account and submission data is kept while your account is active. We honor deletion requests within 30 days.
• Server logs (hashed IP, request metadata) are auto-purged after 90 days.
• Approved challenges are part of the site's public record. We retain them per the license you grant in the Terms of Service — see the "User-submitted content" section there.

We use industry-standard practices to protect your data: TLS for everything in transit, at-rest encryption via our database provider, scoped credentials for every integration, and CAPTCHA + rate limiting on the submission and sign-in endpoints.

No system is fully secure. If we ever experience a breach that materially affects your data, we'll notify you without undue delay and tell you what we know and what we're doing about it.

Regardless of where you live, you can exercise the following at any time by emailing help@tediddle.com:

• Access — request a copy of the data we hold about you.
• Deletion — request that we delete your account and associated data.
• Correction — fix anything inaccurate.
• Marketing opt-out — unsubscribe from marketing emails (you'll still receive transactional messages, like sign-in links).

For California residents: we don't sell or share your personal information for cross-context behavioral advertising, and we don't use sensitive personal information to infer characteristics about you.

This site is not directed at children under 16. We don't knowingly collect data from anyone under 16. If you believe a child has signed up, email help@tediddle.com and we'll delete the account.

We may update this policy from time to time. The effective date at the top always reflects the current version; material changes will be announced on the site.