How WannaHunt protects your photos

WannaHunt is built for kids playing outdoors, so we keep what we collect about them to the bare minimum, and we get rid of it on a schedule. This page explains exactly what happens to the two kinds of photo the app ever touches: the selfie for an avatar, and a photo submitted for a challenge.

Crew avatars

By default, a kid never takes a photo to get an avatar. They pick one of twelve cartoon animals themselves (or tap "Surprise me!" for a random one), then can tweak its ring colour, accessory and expression on the same screen. Nothing about that choice — not a photo, not anything else — is ever sent to Anthropic or to any other service. This is the only avatar path in WannaHunt today.

### Optional: selfie → avatar traits (off by default)

The app also contains a selfie-reading feature, built and tested but turned off by default (the `AVATAR_AI` setting) — an organizer's own deploy would have to switch it on. Since it is not on for anyone by default, everything below only ever happens on a deploy where it has been explicitly enabled:

• The photo is resized on the phone itself, to at most 512 pixels on its longest side, before it goes anywhere.
• If the hunt organizer has Premium and the AI budget for the day is not used up, that one small image is sent to Anthropic for a single request: "read this child's mood, glasses and outfit colour." The AI is only allowed to answer with a closed list of three choices — an expression (one of five), glasses on or off, and one cheerful colour for the ring around the avatar. Since an avatar is now one of twelve cartoon animals, the AI is no longer asked about hair, skin tone or eye colour at all: those fields are gone from the request entirely, and the animal itself is picked at random, not from the photo. There is no field in that answer for a name, an age, a location, or any description of the child — the AI literally has nowhere to put one. Nothing here is biometric identification — the model is never asked to recognise or match a face, only to read three coarse, closed-list signals off one image, once.
• The photo itself is never written to disk or to object storage, anywhere, by this app. It exists only in the server's memory for the length of that one request, and is discarded the moment the request finishes (whether it succeeds, is refused, or errors out).
• Only the trait choices above — not the photo — are saved, on the player's row, so the cartoon avatar can be redrawn on every screen.
• If a selfie is skipped, the organizer is on the free plan, the AI budget is spent, or anything about the request goes wrong, the app never sends the photo anywhere: it just picks a random, equally playful set of traits instead, and says so ("Here's a surprise avatar!").
• Nothing about a selfie — not its bytes, not a description of it — is ever written to a server log.

Challenge photos

Some challenges ask a team to take a photo of something they found.

• The photo is resized on the phone (to at most 1024 pixels) before it leaves the phone.
• It is stored in the hunt's own object storage bucket, associated only with the team and the hunt — never with a child's name, because WannaHunt never asks for one.
• If the organizer is on Premium and has AI budget left, the same photo may be sent to Anthropic once, to check whether it matches the challenge. The AI is instructed never to comment on, describe, or identify a person in the photo beyond what the task needs, and to say "unsure" rather than guess when it cannot tell.
• Every hunt has a photo retention window (7 days after the hunt ends, by default, and configurable by the organizer), after which challenge photos are deleted automatically. An organizer can also delete every photo for a hunt immediately, at any time.

What we never do

• We never ask a kid for a last name — only an optional first name or nickname.
• We never ask for, or take, a photo to build an avatar. By default that path does not exist in the app at all.
• We never send a child's photo to any service other than Anthropic, and only for the one request described above — and only on a deploy where the optional selfie feature has been explicitly switched on.
• We never keep a selfie past that one request, under any circumstances.
• We never show an organizer's Premium status, a paywall, or any "unlock" messaging on a kid's screen — the app quietly falls back to a random avatar or the organizer's own review instead.

Not yet built

A generative, photo-realistic avatar (turning a selfie into a rendered image of the child, rather than a cartoon built from a handful of trait choices) is not part of WannaHunt today. If it is ever added, it will sit behind its own explicit, parent-facing consent toggle — separate from, and off by default compared to, everything described above.

Questions about this page, or about a specific hunt's data? Ask the grown-up who organized it — they can see and delete their hunt's photos at any time from the organizer dashboard.