Privacy

What we keep about organisers

An email address, a password that is only ever stored as an argon2id hash, and the hunts you build. The email address identifies your account and lets us send the messages the service needs: verification, password reset, and the player invitations you trigger yourself.

What we keep about players

A nickname, a team, what has been found, and, while the hunt is running, the position that makes the radar work. Optionally an email address, if the organiser used one to send an invitation. There is no player account and no password: nothing is kept in order to recognise someone at a later hunt.

Location

Location is asked for before anything is collected, and refusing it does not lock a player out of the game, because captures are scored by scanning a code rather than by standing in the right place. Positions are used to compute the radar and are never shown to other players. They are excluded from our server logs.

How long we keep it

Player records and positions are deleted when the hunt is archived. Data from test launches is deleted after thirty days. Single-use tokens, such as invitation links and password resets, are stored only as a hash and expire on their own. These purges run automatically on a schedule; they are not a promise to do it by hand.

Cookies

By default, only the ones the service cannot work without: a session cookie for a signed-in organiser, a session cookie for a player during a hunt, and a note of your language in your browser’s local storage. Your answer to the audience measurement banner is kept in that same local storage for six months, then asked again. The Google Analytics cookies exist only if you accepted the measurement, and never before. No advertising cookie.

Audience measurement

With your agreement, Google Analytics counts the pages viewed on this site and the clicks that lead to the sign-up form, so that we understand what comes before someone signs up. Nothing is loaded and nothing is sent to Google until you have accepted it in the banner; a refusal, or a refusal signal sent by your browser (Global Privacy Control, Do Not Track), is honoured without a banner. Advertising features and personalisation are switched off, and the contact form is never read by the measurement. You can withdraw your agreement at any time from the box at the top of this page.

Who else sees anything

Map tiles come from the OpenStreetMap servers, which means your browser talks to them directly and they see your IP address, as with any map on the web. Our servers and database are hosted at OVH. Emails leave through an outgoing mail provider. If you accepted audience measurement, Google Ireland Limited processes the measurement data on behalf of Questrove, including on servers outside the European Union under the standard contractual clauses. Nobody else receives anything, and none of your data is sold or used for advertising.

Children

Hunts are often played by children, and the design accounts for it: a player has no account, no password and no lasting profile, and everything about them disappears with the hunt. The organiser remains responsible for supervising minors taking part, and for deciding whether to give us their email address at all, which is optional.

Your rights

As an organiser you can export everything we hold about you, and delete your account, from the organiser workspace, with no request to file and no waiting. Neither password hashes nor token hashes are included in the export, because handing them over would create a risk rather than answer a question. For anything else, including a player asking about their own data, write to the address below.

contact@questrove.com

Security

Passwords are hashed with argon2id. Sessions use short-lived tokens that rotate. Object coordinates never leave the server in anything sent to a player, and a test walks every player-facing response looking for exactly that. We do not claim to be unbreakable; we claim to have decided these things on purpose.