Privacy notice

The data controller is Harkányi Zoltán, the operator of GeoLoot. You can reach the controller about anything in this notice at harzol@gmail.com.

• Account data. When you sign up or sign in (with an e-mail address or with Google) our sign-in provider processes your e-mail address, your name and your profile picture if the sign-in method supplies them, and a technical account identifier. We store the identifier and the name and picture for your profile.
• Public name. A name you choose for other players to see. If you have not chosen one, others see a neutral name such as "Player 1a2b". Other players never see your e-mail address or your sign-in name.
• Location data. The game works from your phone's location. When you check in, or while a tracking is running, the app sends your coordinates, their accuracy and the time. A tracking can keep recording while the app is in the background; this happens only after you start it, and a notification shows while it runs. From this we derive the places you visited, the distance you covered, the resources and GeoEnergy you earned and your statistics.
• Game data. Your visits, resources, GeoEnergy and GEO balances, processing and construction history, the buildings you built and your share in them, your series progress and your activity history.
• Technical and error data. If the app or the website fails, an error report (for example the app version, the device model and operating system, and what went wrong) can be sent to our error monitoring service. The app does not send personal identifiers with these reports by default. Our hosting provider also keeps short-lived server logs (for example IP addresses and requested addresses) for security and operation.

We do not use advertising or analytics trackers, we do not sell personal data and we do not use your data for advertising.

• To provide the game (account, check-ins, trackings, rewards, construction, your statistics and history): performance of the agreement with you (GDPR Article 6(1)(b)).
• Location access of your device: you allow it in your phone's permission dialog and can withdraw it at any time in the phone settings (Article 6(1)(a)). Without it the app cannot record check-ins or trackings.
• Security, fair play and error monitoring (for example checking that a movement is plausible, finding and fixing faults): our legitimate interest in running a safe and fair game (Article 6(1)(f)).
• Legal obligations and claims: where the law requires it or to handle a legal claim (Article 6(1)(c) and (f)).

• Other players see only what the game shows publicly: your public name and, at a place, the buildings you own there, your development points and your share. They do not see your routes, your visit history or your exact movements.
• Service providers that process data for us (processors):
  • Clerk: sign-in and account management.
  • Google: only if you choose to sign in with Google.
  • Vercel: hosting of the website and the server API.
  • Neon: the database that stores the game data, including location data.
  • Sentry: error monitoring.

These providers may process data on servers outside the European Economic Area. In that case the transfer relies on the safeguards the providers offer, such as the European Commission's standard contractual clauses or the EU-US Data Privacy Framework. We do not give personal data to anyone else unless the law requires it.

We keep your data while your account exists, because the game needs your history (your visits, buildings and balances). When you ask us to delete your account we delete or anonymise your personal data. Where other players' game state depends on it (for example a building several players built together) the building stays and is no longer linked to you. Error reports and server logs are kept for a short time set by the provider.

You can ask us for access to your data, its correction, its deletion, the restriction of its processing and a copy of the data you gave us in a common format, and you can object to processing that is based on our legitimate interest. Where processing is based on your consent you can withdraw it at any time; this does not affect what happened before. Write to harzol@gmail.com and we answer within one month.

You can also complain to the supervisory authority. In Hungary this is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH, naih.hu, 1055 Budapest, Falk Miksa u. 9-11.), or to the authority of your own country, or go to court.

GeoLoot is not meant for children under 16. If you believe a child has given us data, write to us and we delete it.

We update this notice when GeoLoot processes new data or in a new way, for example when a new feature is added, and change the date at the top. Larger changes are announced in the app or on the website.