This notice explains how John Pelletier ("we", "us") collects and uses personal data when you use Scavangeler. We act as the data controller for the information described here.
Data we collect
- Account data — email address, password hash, display name.
- Hunt content — clues, reference photos, animated charm images, GPS coordinates, prize text.
- Player check-ins — nickname, the photos players upload to verify spots, GPS coordinates at the moment of check-in, timestamps.
- Usage data — pages viewed, actions taken, device and browser identifiers, IP address, error logs.
- Support messages — anything you send us when asking for help.
How we use it
- To create and operate your account (contract performance).
- To run hunts you create or join (contract performance).
- To verify player check-ins by comparing reference photos and check-in photos using Google Gemini (legitimate interests — providing the core product feature).
- To prevent fraud and abuse (legitimate interests).
- To improve the product (legitimate interests).
- To meet legal and tax obligations (legal obligation).
Who we share it with
- Paddle — our Merchant of Record. Paddle independently processes payments, taxes, and invoicing. See Paddle's privacy notice.
- Supabase — our database, authentication, and storage provider.
- Google Gemini — receives reference photos and player check-in photos for visual similarity scoring.
- Google Maps — receives coordinates to render maps in the editor.
- Professional advisers (legal, accounting) and authorities where required by law.
International transfers
Some of our providers are based outside the UK/EEA. Where required, transfers rely on Standard Contractual Clauses or adequacy decisions.
Retention
We keep account data while your account is active and for a short period afterwards for accounting and dispute purposes, then delete or anonymise it. Player check-in photos are kept for the lifetime of the hunt; deleting a hunt deletes its content. You can delete your entire account from the account menu at any time.
Your rights
Depending on your country you have rights to access, correct, delete, restrict, port, or object to processing of your personal data, and to withdraw consent. You can act on most of these directly through the account menu, or contact us. You may also lodge a complaint with your local supervisory authority.
Security
We use industry-standard encryption in transit, access controls, and audit logging. No system is perfectly secure; please use a strong, unique password.
Cookies
We use only the essential cookies required to keep you signed in. We don't use advertising or third-party analytics cookies.
Contact
Privacy questions: contact us through the support link on our site.