Privacy policy

What we collect

Account data: your email address, organization name and a securely hashed password (or, for Google sign-in, your verified Google email).

Lead data: the email address you submit to receive the team-day checklist.

Gameplay data: team name, progress, scores, photo/selfie submissions you upload, and — while playing in the browser — your device location, used only to check geofenced stops.

Push tokens if you enable notifications, and basic, privacy-friendly usage statistics (self-hosted analytics, no cross-site tracking).

Payment data: when paying for a business hunt, card details are processed by Stripe; we only store the order, amount and status.

Why and on what basis

To provide the service and your account (performance of a contract).

To send transactional email such as verification and password resets (legitimate interest / contract).

To secure the service against abuse — rate limiting and CAPTCHA (legitimate interest).

To send the checklist you requested (consent).

To follow up about our service after you request the checklist, for example by email or phone (legitimate interest). You can object to this at any time.

Service providers

Resend (transactional email), Stripe (payments), Cloudflare (hosting, CDN and DNS), Apple (App Store and push notifications), Google (optional sign-in), Sentry (error monitoring; personal data is scrubbed from error reports), and OpenStreetMap/Apple Maps (geocoding). These parties process data on our behalf or as independent controllers for their part; some are located outside the EU, in which case appropriate safeguards (e.g. EU Standard Contractual Clauses) apply.

Retention

We keep account and hunt data for as long as your account exists. Lead data (the checklist email address) is kept for up to 24 months from your last contact, after which it is deleted automatically. Verification and reset tokens expire within 24 hours and 1 hour respectively. You can ask us to delete your account and associated data at any time.

Your rights

You have the right to access, rectify, erase, restrict and port your data, and to object to processing. Email us at [email protected] to exercise these. You may also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).