Privacy Policy
This policy covers the marketing site, demo sandboxes, private dealer previews, business outreach, and the QuickBooks connection held for client websites.
Summary
- There is no third-party analytics, no tracking pixel, no advertising cookie and no cross-site tracking on this site. First-party counters measure site visits and demo use. They store no IP address or visitor identity. A staff-only cookie keeps recognized admin browsers out of these counts.
- There is no account to create and nothing to sign up for.
- The quote form goes to an inbox. It is not stored in a database and it is never sold, shared or added to a mailing list.
- The demo keeps what you type for 24 hours and then deletes it, on a schedule, whether you return or not.
- For a business whose website Bighorn Byte runs, a QuickBooks connection holds the authorization itself and nothing out of your books. There is no copy of an invoice, a customer or an amount anywhere in this service.
- The only third parties involved are the ones named below: Cloudflare, Anthropic, NHTSA, Intuit, Google Maps on the contact page, and the host.
The quote form
The form asks for your name, your business, where you are, an email address or a phone number, what you sell, what you are running now, and what is not working. It also records which page you opened it from. Every field is optional except those marked required on the form itself.
The message is emailed to contact@bighornbyte.com through Cloudflare’s email sending service. It is not written to a database and there is no CRM behind it. It stays in that mailbox until it is deleted.
Your IP address is used for one purpose: holding a single sender to three submissions a minute. It is kept in memory on the server handling the request, for sixty seconds. It is never written to disk and never attached to your message.
The form carries one hidden field that a person never sees. A submission that arrives with it filled in is treated as automated. A Cloudflare Turnstile check runs on the form as well, described under Bot checks below.
The visitor counter
Marketing pages run a small first-party script that reports page views and contact actions. The demo has a separate counter for opens, estimated sessions and sections viewed. It is Bighorn Byte’s own code on its own server. There is no Google Analytics, no Meta pixel and no third party of any kind involved, and nothing it records is shared with or sold to anybody.
It sends the path you opened, the site that linked you here if there was one, whether this is a new visit, and, if you tap a phone number or an email address, or successfully send a quote request, which of those it was. The server adds two things from the request itself: the hour of day, and whether the browser looks like a phone, a tablet or a desktop. All of it becomes a counter. Nothing is stored per person, and no record carries your name, your address or your visit.
Your IP address is used to hold one sender to a burst of twenty requests, and is then discarded. It is not written down. The counter sets no cookie for ordinary visitors. It keeps three values in your browser’s own storage instead: hb_last, when you were last here, so a return after thirty minutes counts as a new visit; and hb_src and hb_fs1, which record what linked you here, so a referral is still attributable after the first page. The first source is reused for up to 90 days. These values support the aggregate counters and do not identify a person. Clearing this site’s data removes them.
Demo usage adds bb_demo_usage_last, a timestamp in the same browser storage. A return after thirty minutes starts another estimated demo session. The lot chooser counts as part of the demo; embedded previews and companion phone upload pages do not. Only section names are reported, never sandbox identifiers, item identifiers, upload tokens or what you type. Sample phone and email taps are not contact actions. Older aggregate daily counters are pruned when monthly reports are published; saved monthly website reports may remain longer.
After a Bighorn Byte staff member signs in, a one-year exclusion cookie remembers that browser across sign-out. Existing signed-in browsers receive it when they next use the admin or send a visitor counter request. It applies across this domain and its www address. It grants no access and contains no staff identity. Activity recorded before the browser is recognized is not removed.
Google Search Console is read for this domain, which reports which searches showed the site and how often it was clicked. Google reports that in aggregate. It names nobody.
The demo
The demo at /demo is a private sandbox: a working copy of the dealer admin, filled with sample inventory. A private dealer preview can instead use reviewed public business details and listings. Nothing done in either touches a real dealership.
While it exists, the sandbox stores what you change: the units, prices, descriptions and settings you edit, held as one record against a random identifier. That identifier is what the cookie carries, and it is the only credential the sandbox has. Every sandbox is deleted 24 hours after it is created. The clock is never extended, including by resetting it, and an hourly sweep removes the expired ones.
Photographs taken through the phone upload feature are stored under that sandbox’s own prefix and are deleted within two days by a storage lifecycle rule, separately from the sandbox itself.
Three things in the demo call Anthropic’s API. The button that writes a listing description sends the text on that unit. The add-item wizard’s generate step sends that unit’s typed details and its photographs, including any you uploaded yourself, and the model reads them to write the listing. The announcement designer sends its prompt and the sample dealership’s brand description. Each result returns to your sandbox. Nothing else in the demo sends anything to a model.
Typing a VIN into the demo sends that VIN to NHTSA’s public vPIC decoder, a United States government service, which answers with the year, make and model it describes. Nothing about you or your sandbox is sent with it.
Do not type real personal information into the demo. It is a sandbox for trying an admin, not a place to keep anything.
Private dealer previews and business outreach
We keep business records used for individual sales conversations: public dealership details, locations, business contact information, research sources, notes, messages, and follow-up tasks. Public website content may be processed by a configured AI provider or a supported local AI client to prepare a reviewed demonstration. Captured evidence is stored privately; selected, normalized photographs and logos are stored separately for the preview.
Private preview links expire after 90 days or when revoked. The saved preview and its source records are retained separately from a visitor’s 24-hour sandbox. Opening a preview can record that its site or admin was viewed, and saving a change records an edit observation. These observations belong to the link, not to an identified person. They store no IP address or user-agent string. Staff review is excluded.
A first-party cookie named bb_preview_visit_<link identifier> lasts 24 hours and prevents repeat observations from the same browser on the same day. It is scoped to that preview. Forwarding a preview link does not tell us who received it.
Outreach email passes through our configured mailbox provider. Relevant replies and Sent-folder copies may be kept in the sales record. Unrelated messages in a shared mailbox are skipped; unmatched messages are retained only when the mailbox is configured for that purpose. Attachments stay in the mailbox and are not copied into the sales record. Email acceptance by a mail server is recorded separately from delivery, and our outreach emails contain no tracking pixel.
Reply stop or use the opt-out link in an outreach email to block future outreach to that address. We retain a minimal do-not-contact record so a later import does not start those messages again. Contact us to request review, correction, or deletion of other business records.
Bot checks
Two Cloudflare Turnstile widgets run on this site. Turnstile is a privacy-preserving alternative to a CAPTCHA. One guards entry to the demo, and is not drawn again while your pass is valid or once a sandbox exists. The other sits on the quote form, which appears on the home page, on /contact and in the quote panel that opens from the corner of the page.
The quote form’s check never rejects a submission. It records a verdict that travels with the email, and a message that fails the check is sent exactly as one that passes. Its script loads when you first interact with the form rather than when the page loads, so a page nobody types into makes no request to Cloudflare.
To decide whether you are a person, Cloudflare processes your client IP address, your TLS fingerprint, your User-Agent header and the site key for the widget. Cloudflare states that Turnstile does not access, store or transmit your form entries or other page inputs, and that it cannot directly identify an individual from those signals. Their Turnstile Privacy Addendum covers what they do with it. That addendum directs questions about Turnstile data to the website operator, which for this site is Bighorn Byte.
QuickBooks connections
This section applies to businesses whose website Bighorn Byte builds and hosts. It does not apply to anybody browsing this site.
Bighorn Byte holds your QuickBooks authorization centrally and hands your own website a short-lived key each time it needs one, so that your website can post sales to your books. Your website communicates with QuickBooks directly. Bighorn Byte is the keyholder, not a copy of your accounting.
What is stored against your connection is the identifier QuickBooks uses for your company, the access and refresh tokens Intuit issued, when each expires, and which permissions you granted. The company identifier and both tokens are encrypted before they are written down, with a key that is not kept in the database, and each ciphertext is bound to your company and to its own field so it cannot be moved to another record. What is left unencrypted is a one-way fingerprint of the company identifier, which is what a lookup matches on.
No accounting data is stored here at all. No invoice, no customer, no amount, no line item. The endpoint your website calls to get a key reads no request body, so there is no field through which any of it could arrive. The only permission requested from Intuit is the standard accounting scope, and Bighorn Byte does not use it to read your books.
There is a record of the connection itself: when it was made, refreshed, verified or ended, which of your sites asked for a key and how often, and the reason an attempt failed when one did. It is kept so that a problem can be explained later. Where the site that started the connection reports who pressed the button, that name is stored on the attempt.
You can disconnect at any time from inside QuickBooks, under Apps. It takes effect immediately and does not go through Bighorn Byte. When a connection ends, whichever party ended it, both tokens are deleted from the database. The record that the connection existed stays, without the keys, so the history remains explainable. To have that history removed as well, email contact@bighornbyte.com.
Nothing about your QuickBooks connection is sold, shared with advertisers, or used for anything other than running the website you are paying for. The connection record lives in a Postgres database in the United States, separate from the one behind the public demo, and is reachable by nobody outside Bighorn Byte.
Bighorn Byte does not handle any of this on Intuit’s behalf. Intuit and Bighorn Byte each decide independently what to do with what they hold, and this policy covers only the Bighorn Byte side. What Intuit does with your QuickBooks company is governed by Intuit’s own terms and privacy policy.
The contact page map
The contact page embeds a Google Map showing Sheridan. Loading it requests content from Google, which means Google receives your IP address and may set its own cookies in your browser under its own terms. It is on that one page. The address, the phone number and the email are written out in text on the same page.
Cookies
Demo cookies are limited to /demo; a private preview uses scoped versions of the same cookies and the 24-hour observation cookie described above. Staff sign-in and analytics exclusion use site-wide cookies. None is an advertising cookie, and ordinary marketing visitors receive none from the visitor counter.
| Cookie | What it does | Lasts |
|---|---|---|
| bb_demo_sandbox | Identifies your demo sandbox. | 24 hours |
| bb_demo_pass | Records that you passed the bot check. | 24 hours |
| bb_demo_tour | Records that you took or declined the guided walkthrough. | 1 year |
| bb_demo_pages | Records which per-screen guides you have seen. | 1 year |
| bb_demo_trade | Records which sample lot you chose, so you are not asked again. | 1 year |
| session_id | Keeps Bighorn Byte staff signed in to the admin. | 7 days |
| bb_analytics_exclude | Excludes a recognized staff browser from visitor and demo counts, including after sign-out. It contains no identity and grants no access. | 1 year |
Browser storage also keeps how far through a walkthrough you were,bb_demo_seen, which records which screens of the demo you have opened, and the counter values described above. Walkthrough progress stays on your device. The counters send the limited activity and attribution information described above. Clearing this site’s data removes these values.
Hosting and server logs
The site runs on Deno Deploy with Cloudflare in front of it. Both keep the ordinary request logs any web host keeps, which include IP addresses, for operating the service and defending it from abuse. Nothing is built on top of those logs and they are not used to profile visitors.
What never happens
Your information is not sold. It is not shared with advertisers, ad networks or data brokers. It is not used to build a profile of you across other websites, and asking for a quote does not subscribe you to bulk marketing. Individual business outreach and its opt-out controls are described above.
Your choices
Email contact@bighornbyte.com to request a copy of what is held about you, or to have it deleted. This can include emails and business outreach records. A minimal opt-out record is kept to prevent further outreach. No reason is required and none will be asked for.
A demo sandbox deletes itself within 24 hours with no action from you. Clearing this site’s cookies ends it immediately.
Children
This is a business-to-business site for dealerships. It is not directed at children and it does not knowingly collect anything from them.
Changes
This page changes when what the site does changes, and the date below moves with it. There is no archive of previous versions. To know what it said on a given day, ask.
Last updated September 5, 2026.
Contact
Bighorn Byte LLC, Sheridan, Wyoming. contact@bighornbyte.com or (307) 285-3500.