Privacy Policy

1. Scope and who we are

EventQuestor is a no-install web application that lets a host create and run a scavenger hunt and lets players join from a mobile browser. This policy applies to two groups of people:

• Hosts — people who create an account, generate experiences, and run hunts.
• Players — people who join a hunt using a link or QR code provided by a host.

When a host runs a hunt, the host also acts as an organizer of that event and decides who is invited. Hosts are responsible for their own conduct and for any personal information they collect from players outside of the Service.

2. Information we collect

We collect the following categories of personal information, using category names consistent with the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Identifiers. Host email address, account identifier, player display name, optional team name, and IP address.
• Customer records. Account and billing details associated with a paid plan. Card numbers are entered directly with our payment processor and are not stored by EventQuestor.
• Commercial information. Plans purchased, transaction history, and entitlements.
• Internet and network activity. Pages viewed, features used, approximate device and browser information, and diagnostic logs.
• Geolocation data. For GPS missions, coordinates that a player chooses to share from their browser. Players choose whether to grant location access.
• Audio, visual, and similar information. Photos and text answers that players submit as mission proof.
• Inferences. Limited usage signals we derive to understand whether the product is working and to recommend a suitable plan.

We do not intentionally collect Social Security numbers, precise government identifiers, financial account credentials, health data, or other special categories of sensitive personal information. Please do not submit that information through the Service.

3. Sources of information

We obtain personal information from these sources:

• Directly from hosts when they create and use an account.
• Directly from players when they join and play a hunt.
• Automatically from devices and browsers through logs and analytics tools.
• From our service providers, such as our payment processor and infrastructure vendors.

4. How we use information

We use personal information for these business purposes:

• Create and operate host accounts and run live hunts.
• Generate scavenger hunt missions, score submissions, and display leaderboards.
• Process payments and manage plans and entitlements.
• Provide customer support and respond to requests and inquiries.
• Monitor, debug, secure, and improve the Service, and prevent fraud and abuse.
• Send service and transactional messages, including sign-in emails.
• Comply with legal obligations and enforce our Terms of Service.

5. How we disclose information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising as those terms are defined under California law. We disclose personal information only as described below.

Service providers. We share information with vendors that process data on our behalf under contracts that limit their use of the information. These currently include:

• Supabase — authentication, database, and file storage.
• Resend — delivery of sign-in and service emails.
• Anthropic, OpenAI, and OpenRouter — AI generation and content moderation of hunt missions.
• Google Places — location search for missions.
• Stripe — payment processing for paid plans.
• Sentry — error monitoring and diagnostics.
• PostHog and Vercel Analytics — product and usage analytics.
• Vercel — application hosting and content delivery.
• Cloudflare Turnstile — abuse and bot prevention at sign-in.

Other hosts and players. Within a hunt, a player display name, score, and host-approved submissions may be visible to the host and, where the host enables it, to other players.

Legal and safety. We may disclose information to comply with law, respond to lawful requests, enforce our agreements, or protect the rights, safety, and property of EventQuestor, our users, or the public.

Business transfers. If EventQuestor is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction, subject to this policy.

6. Cookies, analytics, and tracking signals

We use cookies and similar technologies that are necessary to keep you signed in, secure the Service, and remember basic preferences. We also use the analytics providers listed above to understand how the Service is used. We do not use these tools for targeted advertising.

Do Not Track and Global Privacy Control. Because we do not sell or share personal information for advertising, an opt-out preference signal such as Global Privacy Control does not change our practices. Where a recognized opt-out preference signal applies to a future practice, we will honor it as required by law.

7. Children and the Free pilot age policy

A host account may only be created by an adult who is at least 18 years old. Players, however, may include children, since hosts sometimes run hunts for family events, schools, camps, and youth groups.

EventQuestor does not knowingly collect personal information directly from a child under 13 without consent. When a hunt includes players under 13, the host is responsible for obtaining verifiable parental or guardian consent before those children participate, and for limiting the personal information children provide. We ask hosts to use first names or nicknames for child players and to avoid collecting photos or precise locations of children where it is not necessary.

We collect only the limited information needed to run the hunt for a child player, such as a display name, scores, and submissions the child chooses to enter, and we use that information only to operate the hunt. We do not condition a child participation on providing more information than is reasonably necessary, and we do not use child information for advertising.

A parent or guardian may review, request deletion of, or refuse further collection of their child personal information by contacting the host who ran the hunt or by contacting us using the details in Section 14. If we learn that we have collected personal information from a child under 13 in a manner inconsistent with the Children Online Privacy Protection Act (COPPA), we will delete it.

8. Data retention

We keep personal information for as long as it is needed to provide the Service, and afterward only as needed to meet legal, accounting, security, and dispute-resolution obligations. Hunt content and submissions are generally retained while the host account and the related experience exist. When a retention period ends, we delete or de-identify the information.

9. Data security

We use administrative, technical, and organizational safeguards designed to protect personal information, including encryption in transit, access controls, and reputable infrastructure providers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please protect your sign-in credentials and notify us promptly of any suspected unauthorized access.

10. Your US privacy rights

Depending on your state of residence, you may have some or all of the following rights regarding your personal information:

• The right to know and access the personal information we hold about you.
• The right to correct inaccurate personal information.
• The right to delete personal information.
• The right to a portable copy of certain personal information.
• The right to opt out of the sale or sharing of personal information and of targeted advertising. As noted above, we do not engage in these activities.
• The right to limit the use of sensitive personal information.
• The right not to receive discriminatory treatment for exercising your rights.
• The right to appeal a decision we make about your request, where your state law provides for an appeal.

California residents have these rights under the CCPA as amended by the CPRA. In the prior 12 months, we collected the categories of personal information listed in Section 2, disclosed identifiers, internet activity, geolocation, and audio-visual information to service providers for the business purposes in Section 4, and did not sell or share personal information.

Residents of Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy laws have the access, correction, deletion, portability, opt-out, and appeal rights described above, to the extent those laws apply.

11. How to exercise your rights

To make a privacy request, email us at info@eventquestor.com with the nature of your request. For information tied to a specific hunt, you may also contact the host who invited you, since the host controls that event.

We will take reasonable steps to verify your identity before acting on a request, typically by confirming control of the email address associated with the information. An authorized agent may submit a request on your behalf with proof of authorization. We will respond within the timeframes required by applicable law, generally within 45 days, and will tell you if we need more time.

12. Where your data is processed

EventQuestor is operated from the United States, and personal information is processed and stored in the United States. If you access the Service from outside the United States, you understand that your information will be processed in the United States, where data-protection laws may differ from those in your location.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date at the top of this page and, where appropriate, provide additional notice. Your continued use of the Service after an update means you accept the revised policy.

14. How to contact us

For privacy questions, requests, or complaints, contact us at:

EventQuestor, operated by [Legal Entity Name]
Email: info@eventquestor.com
Mailing address: [Mailing Address]