Privacy Policy

1. Information We Collect

Personal Information

When you use Clue Town, we collect:

• Team names and player names (optional)
• Email addresses (if provided for contact or updates)
• Payment information is handled directly by Stripe — we never see or store your card details

Game Data

• Hunt answers and progress
• Photos and videos uploaded for memory maker challenges
• Game session data (timestamps, scores, time taken)
• Perk redemption history (which offers you've redeemed and when) — when you redeem a perk, the business may see your team name to verify the redemption
• Location data (only when you interact with location-based features)

Technical Data

• Device type and browser information
• IP address (for security and analytics)
• Usage analytics (pages visited, features used)

2. How We Use Your Information

We use your information to:

• Provide and improve the Clue Town experience
• Process payments and issue refunds
• Display your photos in battle galleries (with your permission)
• Generate personalized certificates and awards
• Display team names, scores, and completion times on public leaderboards
• Send important updates about your game or purchased trails
• Analyze usage patterns to improve our service
• Prevent fraud and ensure security

3. Data Storage and Security

Your data is stored securely using Supabase (PostgreSQL database) with industry-standard encryption. We implement:

• Encrypted data transmission (HTTPS/SSL)
• Row-level security policies on all database tables
• Regular security audits and updates
• Secure payment processing via Stripe (no card details touch our servers)

4. Photo and Video Usage

Photos and videos you upload for memory makers:

• Are stored securely and only visible to your team by default
• May be shared in battle galleries if you opt into battle mode
• Are automatically deleted after 5 days to protect your privacy
• Can be downloaded by you at any time from your results page (within the 5-day window)
• Can be deleted by you at any time from your results page
• Will not be used for marketing without explicit permission

5. Cookies and Tracking

We use minimal browser storage (not cookies) to:

• Local storage: Your team ID (so you can resume games)
• Session storage: UI preferences (guidelines viewed, settings) — automatically clears when you close your browser
• Attribution: If you arrive via a link with UTM parameters (e.g., from a partner or ad), we store these to understand which channels bring players — this is first-party only and not shared with third parties

We do not use third-party advertising cookies or tracking pixels.

6. Third-Party Services

We use the following third-party services:

• Vercel: Website hosting and performance analytics. Vercel may collect IP addresses for security and infrastructure. See Vercel's Privacy Policy
• Umami: Self-hosted, privacy-focused analytics — no cookies, no personal data collected
• Supabase: Database and real-time infrastructure (EU/US servers)
• Stripe: Secure payment processing (PCI-DSS compliant)
• Google Maps: For location maps and directions

7. Your Rights (UK GDPR)

Under UK data protection law, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate information
• Erasure: Request deletion of your data
• Portability: Export your game data
• Withdraw Consent: Opt out of marketing communications

To exercise these rights, contact us via the contact form on our homepage. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

8. Data Retention

We retain your game data for 12 months after your last activity. After this period, game data is archived. Transaction records (order references, amounts, dates — not card details) are kept for 7 years for accounting purposes. You can request early deletion of game data at any time.

Certificate and leaderboard data (team name, score, completion time) is retained for as long as the leaderboard feature exists, to enable ongoing competition and sharing. Photos and videos are automatically deleted after 5 days.

9. Children's Privacy

Clue Town is designed for general audiences. We do not knowingly collect personal information from children under 13 without parental consent. If you believe we have collected data from a child, please contact us immediately.

10. Changes to This Policy

We may update this privacy policy from time to time. Significant changes will be notified via email (if provided) or prominently displayed on our website.