Privacy for families
Privacy policy
The app is designed for children, so it collects as little as possible. A grown-up should help with accounts, camera permission and privacy choices.
Last updated 30 August 2026
We do not keep original treasure photos. A face-blurred copy is kept for up to seven days only when a grown-up may ask us to correct a referee mistake. We do not collect location, contacts or advertising IDs. Community has mutual exact-username friendships, leaderboards and invitation-only shared games, but no chat, shared photos or public personal details.
Who holds the information
Lightning Developments Limited, Tauranga, New Zealand, operates Sophie's Treasure Hunt and is the agency responsible for the information described here.
Questions, access requests or complaints can be sent through the support page.
What we collect and why
Private account
A chosen username, password-managed sign-in, and a grown-up recovery email let the account work across devices and be recovered. The recovery email is encrypted separately and is not shown to other players.
Game progress
Challenge, score, completion, skip and entitlement records keep the hunt fair, restore progress and prevent duplicate awards. Unsigned play can remain on the device.
One treasure photo
With camera permission, the app creates one temporary photo. Automated face detection is used only to locate and blur faces before the visual referee receives the image. No face template or identity is created. The original and prepared copies are deleted from app cache after every result, cancellation, timeout or failure. If the referee says close, unclear or wrong, its face-blurred copy may be held privately for up to seven days so a grown-up can correct the result.
Optional grown-up email
Family adventure news and an optional monthly leaderboard summary have separate switches that are off by default. A request is recorded only after the grown-up chooses it. Recovery email is not treated as marketing consent, and each optional message includes an unsubscribe route.
Service security
Our hosting services necessarily receive network details such as an IP address. Authenticated family-level monthly usage counts and short-term request limits protect the service from abuse and unexpected costs. They are not used for advertising, profiling or precise-location features.
Private Community
Usernames and server-awarded points appear on the New Zealand leaderboard. Accepted friends are highlighted. Shared games store invitations, common target IDs and coarse completion counts so friends can play the same sequence without exposing photos, chat or location.
What is optional
The camera is optional. Without camera permission, a player can go back or use a skip. Family-news and leaderboard-summary email choices are also optional and off by default. A private player account is required so progress, scores, friendships and shared games stay attached to the correct player.
If required account information is not provided, we cannot create or recover that account. We do not ask a child for a personal email address; the recovery address belongs to a helping grown-up.
What we deliberately do not collect
- No location permission, route history, address book, microphone or advertising identifier.
- No retained original hunt photos, photo library, face templates, face recognition or identity inference.
- No third-party behavioural analytics, advertising, attribution or child profiling.
- No child-to-child messages, precise activity times, public email addresses or personal child details.
Who processes information for us
Supabase provides private authentication, database and short-lived private storage services in its Sydney region. Vercel provides the first-party app API, face-blurring process and photo-checking gateway. Google's Gemini service receives the blurred image and performs the constrained visual check. RevenueCat processes purchase and entitlement information using a private family billing identifier. Resend delivers grown-up password-recovery email and only separately consented family messages.
These providers process information only for the service purpose. We review their child-directed suitability, contracts, regions, logging and retention settings before release and when a provider changes.
How long information is kept
- Original treasure photos and app-cache copies: deleted immediately after the outcome.
- Face-blurred referee-review copies: deleted when the grown-up resolves the review or automatically after no more than seven days.
- Recovery links: single use and expire after 30 minutes.
- Account, progress and recovery contact: until corrected or the account is deleted.
- Friendships and shared-game progress: until removed, blocked, the game ends, or the account is deleted.
- Monthly photo-check counters and moderation flags: kept with the family account for security, fair-use enforcement and support.
- Short request-limit records: held briefly in application memory.
- Service backups: allowed to age out under the provider's protected backup cycle and not used except for disaster recovery.
Access, correction and deletion
A grown-up can export account data, correct the username or recovery email, and permanently delete the account from the grown-up area. A public deletion route is also available on the account deletion page.
New Zealand privacy law may also give you rights to ask for access or correction and to complain to the Office of the Privacy Commissioner.
Safety and changes
Camera instructions ask players to leave people, names and screens out of frame. Detected faces are blurred before the visual referee receives the image. If privacy preparation fails, the image is not sent and the app asks for another photo.
We will show the updated date here when this policy changes. A material change to child data use requires a fresh safety and privacy review before release.