Privacy Policy

Account and identity data: your email address, a securely hashed password, display name, username, first and last name, and optionally a short bio and phone number. If you sign in with Google or Apple, we receive the basic profile information those services share (name, email, and a provider account identifier) and the authentication tokens needed to keep you signed in.

Gameplay data: your check-ins (which real-world places you visited and when), quests, badges, XP, level, gems, streaks, treasure-hunt progress, events you create or join, collectibles you create, and stories you post.

Location data: precise GPS coordinates used to power the features described in the Location Data section below.

Photos and content: images you upload (profile avatar, place/story photos, collectible artwork) and any captions, feedback or text you submit.

Purchase data: a record of each in-app purchase (product, amount, currency, store transaction identifier and date). Payment card details are handled by Apple or Google and are never seen or stored by us.

Device and technical data: device platform (iOS/Android), push notification token, time zone, preferred language, app version, and the IP address and user-agent associated with your login session, plus diagnostic and crash data.

We use your information to: create and secure your account; operate the core game (check-ins, badges, quests, leaderboard, events, treasure hunts, collectibles); validate GPS check-ins and award XP, gems and badges; process and verify in-app purchases and maintain your gem balance; show optional rewarded video ads (through Google AdMob) that you can choose to watch to earn gems; moderate uploaded images and text to keep the app safe (particularly important for younger explorers); send transactional emails such as email verification and password resets; send push notifications if you opt in; protect against fraud, abuse and spam and enforce rate limits; and diagnose problems and improve the app.

We do not sell your personal data. The mobile app offers optional rewarded ads through Google AdMob; to deliver, cap and measure those ads, Google processes device and advertising identifiers under its own privacy policy. On iOS we ask through Apple's App Tracking Transparency prompt, and in the EU/EEA/UK we ask for your consent, before showing personalised ads. Aside from this, we do not use your data for advertising and do not share it with advertisers.

Where the EU/UK General Data Protection Regulation applies, we rely on these legal bases:

• Performance of a contract — to provide the app and the features you request.
• Legitimate interests — security, fraud prevention, content moderation, and improving the service.
• Consent — for push notifications, precise and background location, personalised advertising, and other optional features; you can withdraw consent at any time in your device or app settings.
• Legal obligation — to keep purchase and tax records and to respond to lawful requests.

Scouttt is a location-based game, so location is central to how it works. With your permission we access your device GPS to show nearby places, validate check-ins, power treasure-hunt proximity, support business check-ins, and let you create routes and collectibles.

Foreground location is used while you actively explore. Optional background ("Always") location is used only to alert you when you are physically near a hidden treasure piece; you can decline it or turn it off in your system settings at any time without losing core functionality.

When you check in, your coordinates are sent to our server for validation. We store a record that you visited a particular place and the time, plus treasure-hunt progress — we do not keep a continuous trail of your movements.

To turn coordinates into place names, and to look up addresses you search for, we use open geocoding services (OpenStreetMap/Nominatim and Photon); to draw walking/cycling routes we send start and end points to a routing service (OpenRouteService) where available. The pre-sign-in country picker may send approximate coordinates to a geocoding service before you create an account.

Images you upload are stored on Cloudflare R2 object storage and served from immutable public URLs. To keep Scouttt safe, public images (such as collectibles and stories) are automatically screened for nudity and unsafe content by Sightengine, and submitted text is screened by an automated moderation system before it is published. You are responsible for the content you upload: do not upload other people's personal data, copyrighted material you do not own, or anything illegal or harmful.

Gems and any subscriptions are purchased through the Apple App Store or Google Play. Those stores process your payment under their own terms and privacy policies — we never receive or store your payment card details. We receive and verify a store transaction receipt on our server and keep a record of the purchase (product, amount, currency, store transaction identifier and date) to credit your account and prevent duplicate or fraudulent claims.

We share the minimum data necessary with trusted service providers ("sub-processors") who process it on our instructions:

• Neon — PostgreSQL database hosting (EU, Frankfurt).
• Cloudflare — application hosting, R2 image storage, image optimisation, and automated text moderation.
• Sightengine — automated image safety moderation.
• Resend — sending transactional email (verification, password reset).
• Sentry — error and crash monitoring (EU region; configured not to send personal data).
• OpenStreetMap / Nominatim and Photon — geocoding and address search; OpenRouteService — route generation.
• Google AdMob — serving the optional rewarded video ads and preventing ad fraud; Google processes device and advertising identifiers for this under its own privacy policy.
• Apple and Google — sign-in and in-app purchases; Expo — delivery of push notifications.

We do not sell your personal data. Other than serving the optional rewarded ads through Google AdMob described above, we do not share your data with advertisers.

Your data is stored primarily in the European Union (Neon in Frankfurt; Cloudflare). Data in transit is encrypted with TLS, passwords are hashed, access is restricted, all rewards are validated server-side, and rate limiting protects sensitive endpoints. No method of storage or transmission is completely secure, but we work to protect your data using appropriate measures.

We keep your account data for as long as your account is active. When you delete your account (Settings → Manage Account in the app, or Account → Manage on the website), we permanently erase your account and associated records, including sessions, badges, check-ins, stories, votes, quest and treasure progress, and in-app currency records.

Some exceptions: (1) support-related submissions you send us — feedback, bug reports and clip submissions — retain a snapshot of your email, name and username for our records even after account deletion; (2) purchase records may be retained where law (for example tax rules) requires; and (3) images you uploaded may take a little longer to be purged from object storage and are removed on a rolling basis after your account is deleted. Limited copies may also persist briefly in encrypted backups and provider logs before they expire.

Scouttt is intended for users aged 16 and over. We do not knowingly collect personal data from anyone under 16. If we learn that someone under 16 has created an account, we will delete it. If you are a parent or guardian and believe your child has registered, please contact us and we will remove the account.

Your data is processed primarily in the EU. Some providers (such as Apple, Google — including Google AdMob — Cloudflare and Sightengine) may process data outside the European Economic Area. Where they do, transfers are protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses.

Subject to applicable law, you have the right to: access the personal data we hold about you; correct inaccurate data; delete your data ("right to be forgotten"); restrict or object to certain processing; receive a copy of your data in a portable format; and withdraw consent at any time.

You can update your profile and delete your account directly in the app, or contact us to exercise any right. If you are in the EU/EEA you also have the right to lodge a complaint with a supervisory authority — in Cyprus this is the Office of the Commissioner for Personal Data Protection.

We may update this Privacy Policy from time to time. We will post the updated version here and revise the date above. If changes are material, we will notify you within the app.

Scouttt is operated by Stylianos Karydakis, an individual operator based in the Republic of Cyprus, who is the data controller responsible for your personal data. For any privacy question or to exercise your rights, contact us at mrkarydakis@gmail.com.