Privacy Policy

1. Who we are

Huntaz (huntaz.app) is a multiplayer treasure-hunting game operated by HEMATIM GLOBAL LTD, a company registered in England and Wales with company number 16956296, whose registered office is at 14 Museum Place, Cardiff, CF10 3BH, United Kingdom. HEMATIM GLOBAL LTD is the data controller for the personal information described in this policy (“we”, “us”).

This policy explains what Huntaz collects when you use the website and game, why, and the rights you have under UK data protection law, including the UK GDPR. Read it together with our Terms of Service. For any privacy question or request, contact support@huntaz.app.

2. Information we collect

Your account

• Your display name, email address and password. Passwords are stored only as a one-way hash, never in readable form.
• Whether and when you confirmed your email address, when you created your account, and a public player ID used in profile links.
• A “remember me” token, if you choose to stay signed in, and short-lived tokens for password resets and email confirmation.

Your profile and social activity

• Your avatar, the cosmetic items you own and wear, and your Hunter Level progress.
• The players you follow and block.

Gameplay, scores and teams

• The hunts you register for and play, your teams and team memberships, and the hunts you create.
• Your results: Huntaz Points, survival and elimination, times, rankings, completions and the chests your team found.
• To work out which chests are near you, the game sends our servers the Street View panorama you are standing on, and sometimes nearby ones. This check does not store the route you walk.
• Fair-play records: every chest search is recorded with your account, an identifier derived from your browser session and your general device type (iOS, Android or desktop), but not your IP address or full browser details. Patterns that look automated can be flagged for an administrator to review.
• Technical events from the Street View viewer during multiplayer hunts (for example, that a panorama failed to load), so we can fix problems. These never include your position.

Messages, reports and voice

• Team chat messages and, where available, private messages between players.
• Reports you submit about hunts or messages, including the details you give, and any feedback you send us.
• Team voice is carried live by our voice provider, LiveKit. Huntaz does not record voice conversations. To connect you, LiveKit receives your display name and a player identifier.

Huntaz Coins, prizes and purchases

• Your Huntaz Coin balance and a record of every change to it: rewards, prizes, Huntaz Shop purchases, prizes you put up for hunts and corrections.
• Prize reservations, winners and how prizes were shared.
• For some sensitive actions, such as administrator changes to balances, we record the IP address and browser details of the person who made the change.

Huntaz Pro and payments

• If you subscribe, payment is handled by Stripe. Huntaz never receives or stores your card details.
• We send Stripe your name, email address and Huntaz account ID, so it can create your customer record.
• We keep the identifiers Stripe gives us (customer, checkout and subscription), your plan, price and currency, the subscription status and its dates, and a log of billing events.

Email and notifications

• Your notification preferences, including your choice about optional game updates, tips and offers by email. These are on unless you turn them off, and turning them off always wins.
• A history of changes to that choice: the wording you saw, its version, when you changed it and where (settings, an unsubscribe link). When you change it yourself, we also record your IP address and browser details.
• In-app notifications, the emails we send (recipient, type, status and delivery events from our email provider), and when you click a link in a notification.

Site visits and technical data

• Visit statistics: a count of visits per browser session, linked to your account when you are signed in. The visit identifier is derived from your session, does not recognise you in later sessions, and is stored without your IP address or browser details.
• Sessions: while you are signed in, your session is stored on our server. Depending on the server configuration, a session record can include your IP address and browser details.
• Like most websites, our servers keep technical logs of requests and errors, which can include IP addresses.

3. Google Maps and Street View

Huntaz includes Google Maps features and content. Use of Google Maps features and content is subject to the then-current versions of the Google Maps/Google Earth Additional Terms of Service and the Google Privacy Policy.

• Street View is shown through Google’s own viewer (the Google Maps JavaScript API). When a page shows Street View, your browser connects directly to Google. Google receives information such as your IP address and browser details, and handles it under its own privacy policy.
• Huntaz does not download, copy or store Street View photographs, image tiles or screenshots. The imagery always comes from Google while you play.
• To build hunts, Huntaz stores references to Street View locations: panorama identifiers, positions, and measurements of how locations connect, used to place chests. This is information about places, not about you.
• Google does not sponsor, endorse or operate Huntaz.

4. How we use information

• To create and secure your account, sign you in and confirm your email address.
• To run hunts: build and run teams, check chest searches, calculate points and results, show leaderboards and pay prizes.
• To keep the game fair and safe: detect cheating, review reports, and act on abuse.
• To provide Huntaz Pro, manage your subscription and keep billing records.
• To send account, security and billing emails, and optional game emails you have not turned off.
• To understand how Huntaz is used, through visit counts and aggregate statistics, and to fix problems.

Huntaz does not sell your personal information and does not show third-party advertising.

Our legal bases

Under the UK GDPR, we rely on these legal bases:

• Contract: to provide your account, the game, hunts, teams, Huntaz Coins and prizes, and Huntaz Pro, as described in the Terms of Service.
• Legitimate interests: to keep Huntaz fair and secure, prevent cheating, fraud and abuse, review reports, understand how Huntaz is used and fix problems, and send optional game emails, which you can turn off at any time. We balance these interests against your rights.
• Legal obligation: to keep billing and accounting records and respond to lawful requests.
• Consent: where we ask for it. You can withdraw consent at any time, without affecting what happened before.

5. What other players can see

• Your display name, avatar and Hunter Level, in rosters, live standings, results and leaderboards.
• Where public profiles are enabled: your profile page, which anyone can open, including your display name, avatar, level and follower counts.
• Your team chat messages, seen by your team, and private messages, seen by the player you are talking to.
• The title, description and prize of hunts you create.

6. Cookies and browser storage

• Huntaz uses cookies that are needed for the site to work: a session cookie that keeps you signed in, a security cookie that protects forms against cross-site request forgery, and a “remember me” cookie if you ask to stay signed in.
• Your browser also stores small game preferences on your device, such as sound settings and whether you have seen a hint.
• Huntaz does not set advertising or third-party analytics cookies.
• Google Maps, which shows Street View, and our font provider are loaded from their own servers, and their own policies apply.

7. Service providers

Huntaz uses these providers to run the service. Each receives only what it needs for its task:

• Hetzner: hosts our servers and database. Our server is in Germany.
• Google (Google Maps Platform): Street View in your browser, and location and city lookups from our servers. Our servers send Google places and coordinates, never your personal information.
• Stripe: Huntaz Pro payments and subscriptions.
• SendGrid (Twilio): email delivery, when email sending is turned on. It receives your email address and the content of the email.
• LiveKit: team voice, where available.
• Bunny Fonts: the website’s typeface, loaded by your browser.
• OpenAI: if AI-written hunt text is turned on, it receives hunt content, such as themes and puzzle wording, but never your personal information.

We may also disclose information when the law requires it, or to protect players, Huntaz or others from fraud or abuse.

8. How long we keep information

• Visit statistics: deleted automatically after 400 days.
• Password reset and email confirmation links: expire after a short time, and a new one replaces the old.
• Chest-search and Street View diagnostic logs: kept as daily files and rotated after 14 days, where the server is configured to rotate them.
• Account, gameplay, results, Huntaz Coin and prize records, messages and billing records: kept while your account exists. Game history, prizes and billing records are also kept after hunts end, because other players’ results and financial records depend on them. We have not yet set fixed deletion periods for these records.
• Notifications and email records: kept until deleted. No automatic deletion period is set.
• Consent history and email unsubscribes: kept, so your choice can always be shown and respected.
• Backups: copies of the database are kept on our servers for recovery. No automatic deletion schedule is set for them yet.

We keep information only as long as we need it for the purposes in this policy, including security, fraud prevention, accounting and legal obligations. When we set fixed retention periods, we will add them to this policy.

9. Your choices and requests

• Your profile: update your display name, email address and password from your profile.
• Emails: turn optional emails off in Notification Settings, or with the unsubscribe link in any optional email. Account, security and billing emails are still sent.
• Other players: block a player, and report hunts or messages.
• Huntaz Pro: manage or cancel your subscription from Manage Subscription.
• Deleting your account: you can ask to delete your account from your profile. If nothing has to be kept, the account is deleted together with your profile, avatar, follows, blocks and private conversations, and a confirmation is sent to your email address. Visit statistics and reports you made are kept, no longer linked to your account. If your account has game history, Huntaz Coin or prize records, Huntaz Pro billing records, or a team that other players belong to, it cannot be deleted this way, and we tell you why on the page and by email.
• Deletion requests by email: if your account cannot be deleted from your profile, email support@huntaz.app. Our team handles these requests; they are not automated. We will delete or anonymise your personal information where appropriate, and keep only the records we legitimately need for security, fraud prevention, accounting or legal obligations.

Your rights

Under UK data protection law, you have the right to:

• access the personal information we hold about you and get a copy of it;
• have inaccurate information corrected;
• have your information deleted, where the law allows;
• restrict or object to how we use it, including objecting at any time to direct marketing;
• receive information you gave us in a portable format, where that right applies;
• withdraw consent, where we rely on consent.

To make a request, email support@huntaz.app from the address on your account, or tell us how we can confirm it is you. We may need to check your identity before acting. We will respond within one month, or tell you within that month if the law allows us more time for a complex request. Making a request is free in most cases.

If you are unhappy with how we handle your information, please contact us first. You also have the right to complain to the UK Information Commissioner’s Office (ico.org.uk), or to the data protection authority where you live.

10. Security

• Passwords are hashed. The site uses HTTPS. Forms are protected against cross-site request forgery, and sign-in and gameplay requests are rate-limited.
• Payment details are handled by Stripe, not by Huntaz. Service keys stay on our servers and are never sent to your browser, except the Google Maps browser key, which Google restricts to Huntaz’s websites.
• Administrator tools need an administrator account, and sensitive changes, such as to balances and billing, are logged.
• No system is perfectly secure. If you think your account has been compromised, change your password and contact us.

11. Children

• Huntaz is not for children under 13. Players must be at least 13 years old.
• Players aged 13 to 17 need the consent of a parent or legal guardian to use Huntaz.
• If you believe a child under 13 has created an account, or that a player aged 13 to 17 is using Huntaz without consent, contact support@huntaz.app so we can look into it and, where appropriate, close the account and delete its information.

12. International transfers

Our servers and database are hosted by Hetzner in Germany, which the UK recognises as providing adequate protection for personal information. Some providers, such as Google, Stripe, SendGrid, LiveKit and OpenAI, may process information in other countries, including the United States. Where personal information is transferred outside the UK, we rely on safeguards recognised under UK data protection law, such as adequacy regulations or contractual protections offered by those providers.

13. Changes to this policy

• We will update this policy when Huntaz’s practices change, and publish each updated version on this page with the date it takes effect.
• If we make a significant change, we will tell you by email, and with an in-app notification where appropriate.

14. Contact

Privacy questions and requests: support@huntaz.app.

HEMATIM GLOBAL LTD, 14 Museum Place, Cardiff, CF10 3BH, United Kingdom. Company number 16956296, registered in England and Wales.