Privacy Policy
Last updated: July 2026
We collect the least we need, keep it the shortest we can, and never sell your data. This summarises what we hold and your rights (EU GDPR).
What we collect
Account details (email, name, language, password hash); gameplay data (scores, clues, interrogation transcripts); live GPS position only while you're in an active event; and payment references (cards are handled by Stripe, never by us).
Why, and for how long
To run the game and your account. GPS is kept for the event plus 30 days, then anonymised into heatmaps; an interrogation transcript keeps its text but stops carrying your name after 90 days; the address of a guest an organizer invites is removed 180 days after the evening; a message sent through the contact page after 730 days. Event photos only with your explicit opt-in consent, revocable at any time.
Your rights
From your account you can export your data, delete your account (game history is kept pseudonymously, e.g. “Player #4213”), and manage photo and marketing consent. Contact us for anything else.
Who we share with
Only the processors we need, Stripe for payments, our cloud host for infrastructure, under data-protection agreements. No third-party advertising trackers, ever.
Contact
Questions or requests about your data? Reach us via the contact page.
Data nobody uses
If nothing of yours has been used for 365 days we remove it: an account is anonymised, an untouched draft scenario is deleted. We email you 30 days before the date, and again a week before it. Signing in resets the clock, and so does the button in that email. Anything still in use is never touched: a licence in force, a scenario other people are playing, an evening in your diary you are hosting or attending, or money we still owe you. Your account page shows exactly what is scheduled and when.