Draft — not yet valid, under review

Privacy policy

DRAFT — this is a working draft for legal review, not legal advice. As long as bracketed placeholders such as [REVIEW] remain in the text, this policy is not valid and must not be published. The German version (Datenschutzerklärung) is the legally controlling one under German law; this is a courtesy translation.

This notice describes what WannaHunt (wannahunt.app) actually processes, for what purpose, on what legal basis, and for how long — matched to the app's real feature set, not a generic template.

1. Controller

[VOLLER NAME] [STRASSE HAUSNUMMER] [PLZ ORT] Germany Email: [E-MAIL] Phone (optional): [TELEFON OPTIONAL]

2. What this is about

WannaHunt lets adults ("organizers") build a scavenger hunt for kids with QR-code stations on a map; kids play it on a phone with no account of their own and no last name asked. A hunt can be played entirely offline (on-device only, no server) or through our server.

3. Hosting, processors and other recipients

We use the following services to run the app. For each: purpose, location, legal basis.

Cloudflare (Workers, R2 object storage) — hosts the application and stores challenge photos. Cloudflare is a global CDN; data centres outside the EU are possible. Purpose: technical operation of the app. Legal basis: Art. 6(1)(b) GDPR (contract performance towards the organizer) and/or Art. 6(1)(f) GDPR (legitimate interest in running the app). [REVIEW: confirm a data processing agreement (DPA) is in place with Cloudflare; confirm R2 region settings]
Neon (managed Postgres database, EU/Frankfurt region) — stores all application data (hunts, teams, progress, organizer accounts). Location: EU (Frankfurt). Legal basis: Art. 6(1)(b) and (f) GDPR. [REVIEW: confirm DPA with Neon]
Anthropic (USA) — AI photo review, in two separate cases: (a) an optional, off-by-default feature (`AVATAR_AI`) that, only on a deployment where it has been explicitly switched on, and only for a Premium organizer with AI budget remaining, sends a selfie taken while setting up a crew to Anthropic once, to derive three coarse avatar traits (expression, glasses on/off, ring colour); the photo itself is never stored, only held in server memory for the length of that one request. By default this feature is off and no selfie is ever taken, asked for, or sent anywhere — a child picks or randomises one of twelve fixed cartoon avatars instead, with no AI involved. (b) a challenge photo may also be sent to Anthropic once, to check whether it matches the challenge; this path is unaffected by the `AVATAR_AI` setting. Location: USA (third country). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in automated pre-review, with human oversight, see section 9); the transfer to the US relies on EU Standard Contractual Clauses (SCCs). [REVIEW: confirm the current SCC set with Anthropic is in force; consider whether separate parental consent is needed, see section 5; confirm whether `AVATAR_AI` is actually enabled on this deployment]
Google (sign-in/OAuth, USA/global) — organizers can sign in with a Google account instead of a magic link (Microsoft and Apple are built the same way, but may not be enabled). We receive a verified email address and a provider account ID (subject), nothing else. Legal basis: Art. 6(1)(b) GDPR (contract performance, account sign-in). Transfer to the US, where applicable, relies on Standard Contractual Clauses. [REVIEW: confirm which of the three providers are actually enabled via environment variable]
OpenStreetMap Foundation (map tiles, UK) — the organizer's map editor and the live map load map tiles directly from the user's device to OpenStreetMap's tile servers, which necessarily transmits the device's IP address (technically required, as with any map service). Legal basis: Art. 6(1)(f) GDPR.
Nominatim (geocoding/address search) — reached only through a proxy on our own server; the user's device never connects to Nominatim directly, only our server forwards the search request. Legal basis: Art. 6(1)(f) GDPR.
Google Maps — only loaded if a Google Maps API key is configured server-side, as an alternative to OpenStreetMap; if unset, Google Maps is never loaded. [REVIEW: is a key currently set? If so, add IP transfer to Google, as for OpenStreetMap]
Stripe (Hunt Pass payment processing) — built into the code but not yet live; no active Stripe account exists. Once enabled: payment details are processed directly by Stripe, never stored by us. [REVIEW once live: add location/SCCs, legal basis Art. 6(1)(b) GDPR]
Resend (transactional email for magic-link sign-in) — built into the code but not yet live. [REVIEW once live: add location, legal basis Art. 6(1)(b) GDPR]
Cloudflare Turnstile (bot protection on sign-in forms) — built into the code, currently disabled. [REVIEW once enabled: add legal basis Art. 6(1)(f) GDPR]

4. Categories of data processed

Organizer account: email address; when signing in via Google/Microsoft/Apple, also a provider account ID.
Team/gameplay data: a team name and colour chosen by the crew; optionally a child's first name or nickname — a last name is never asked for.
Avatar choice: by default, one of twelve fixed cartoon animals, plus a ring colour, accessory and expression — picked or randomised by the child on the phone, no photo involved, nothing sent to any third party.
Avatar traits (optional, off by default): only where `AVATAR_AI` has been switched on, coarse traits derived by AI from a selfie (expression, glasses on/off, ring colour); the avatar's animal is still picked at random, not from the photo. The selfie itself is never stored (see section 3).
Challenge photos: photos a crew uploads for a challenge, stored in object storage, associated with the team and hunt, never with a child's name.
GPS positions: a team's location during a live hunt, for the organizer's live map.
Server logs: technical access data (including IP address, timestamp, requested path) generated by the hosting infrastructure. [REVIEW: confirm exact retention period at Cloudflare]

5. Children and special processing (Art. 8 GDPR)

WannaHunt never asks a child for a last name, a date of birth, or an account of their own.
A hunt is created and owned by an adult (the organizer), who is responsible for allowing children to take part and, where appropriate, informing their parents/guardians.
By default, no selfie step exists in the app at all — a child picks or randomises a fixed cartoon avatar instead. Only on a deployment where the optional `AVATAR_AI` feature has been explicitly switched on does a "Take a selfie" option appear; even then, the photo is never stored, never logged, and leaves the server's memory again after a single request (section 3).
[REVIEW] Whether Art. 8 GDPR and/or national law requires a separate, documented parental consent for AI processing of a child's selfie, independent of the "legitimate interest" legal basis — this is the single most important review point in this draft.

6. Cookies and local storage

We use only strictly necessary cookies and local storage (`localStorage`) — no tracking or marketing cookies, no ad network, no third-party analytics. As a result, no cookie-consent banner is required under § 25(2) TTDSG / Art. 6(1)(f) GDPR.

Cookies used (all set server-side):

`qq_organizer` — session cookie for a signed-in organizer. httpOnly, 30 days, strictly necessary.
`qq_team` — session cookie for a playing crew/child during a hunt. httpOnly, 7 days, strictly necessary.
`qq_oidc` — short-lived state cookie during a Google/Microsoft/Apple sign-in, prevents cross-site request forgery. httpOnly, 10 minutes, strictly necessary.
`qq_lang` — chosen language (English/German). 365 days, strictly necessary, not httpOnly (set by the language toggle).

Local storage used (`localStorage`, never leaves the device, never sent to our server):

`questquest:last-map-center` — last map view in the organizer's map tool, a convenience for this device only.
`questquest:dismissed-broadcasts` — which announcements a crew has already seen/dismissed.
`qq.hunts.local` — hunts created in offline mode on this phone, plus play progress; exists only on this device.
`qq.offline.drafts` — drafts of offline hunts not yet finished; exists only on this device.

7. Storage periods

Organizer account: until deleted by the organizer or on request.
Challenge photos: automatically deleted `hunts.photo_retention_days` days after the hunt ends (default: 7 days, configurable by the organizer); an organizer can delete every photo for a hunt immediately at any time.
GPS positions: deleted immediately when a hunt ends; a daily sweep also removes any remaining positions for long-ended hunts.
Selfies: never taken by default; on a deployment where the optional `AVATAR_AI` feature is switched on, never stored either way (see section 3).
Avatar choice/traits: for as long as the player row exists (generally, for as long as the hunt or account exists).
Server logs: [REVIEW, see section 4].

8. Your rights as a data subject

You have the right to:

access the data held about you (Art. 15 GDPR),
rectification of inaccurate data (Art. 16 GDPR),
erasure (Art. 17 GDPR),
restriction of processing (Art. 18 GDPR),
data portability (Art. 20 GDPR),
object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR),
withdraw a given consent with effect for the future (Art. 7(3) GDPR).

You also have the right to lodge a complaint with a data protection supervisory authority. This is normally the authority for the German federal state (Bundesland) where the controller is based — [REVIEW: confirm the controller's Bundesland]. Placeholder, pending confirmation:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI) Königstraße 10a, 70173 Stuttgart, Germany [REVIEW — replace with the correct supervisory authority for the operator's actual place of residence/business]

9. Automated decision-making

The only automated check is the AI-based pre-review of challenge photos (section 3). This check does not make a decision with legal or similarly significant effect on a user within the meaning of Art. 22 GDPR: whenever the organizer is not a Premium customer, the daily AI budget is used up, or the AI is unsure, the photo automatically goes to the organizer's manual review queue, and the organizer makes the final call. There is always a human in the loop before any decision visible to a child.

10. Changes to this policy

This policy will be updated as the app changes, in particular once new third-party services (Stripe, Resend, Turnstile) go live. [REVIEW: add a version/last-updated date once final]