Privacy Policy

Draft template. Have this reviewed by a lawyer before publishing. The wording below covers the technical reality of what the platform stores and processes; tailor the legal framing (Sweden, GDPR / CCPA / etc.) for your audience.

Who we are

This service ("we", "us", "the service") is operated by Zonventure AB. Questions about this policy? Email hello@zonventure.com.

What we collect

We collect only what's needed to run the adventure platform:

• Account data for arrangers: email, organization name, hashed password, IP and user-agent at login. Used for authentication and security audit.
• Player data: a slot name (chosen by the arranger), and during an event the player's GPS location and answer text. Used to display progress on the live board and verify location gates.
• Operational logs: login successes/failures, IPs, access timestamps. Used to detect abuse and investigate issues.
• Email-verification and password-reset tokens, one-shot, expire in 24 hours (email verification) or 1 hour (password reset), deleted on use.

What we DON'T collect

• No analytics or advertising trackers.
• No payment-card numbers — payment is processed by Stripe; we receive only their non-sensitive event metadata.
• No location data from arrangers, only from players who opt into geolocation when prompted by the play page.

How long we keep it

• Account data: until you delete the account. Deletion has a 7-day grace window during which you can cancel by logging back in; after that the data is permanently removed.
• Player location pings & answers: deleted with the event, or after the platform's location-retention window (30 days post-event), whichever comes first.
• Party adventures booked for children: the whole party adventure — teams, player names, answers and photos — is deleted 14 days after it ends, or when a booked one lapses unplayed. The payment record is kept for bookkeeping, without the booker's email.
• Party adventures made without an account: an unpaid draft is deleted 30 days after it was last changed. A paid one — its cards, teams, player names and answers, and the email it was saved to — is deleted when its 14 days of play are over, or when it lapses unplayed, unless its buyer keeps it in an account of their own. The payment record is kept for bookkeeping, without the email. Email links expire after an hour; a sign-in on a browser after 30 days.
• Postal addresses for letters we post to you: the name and address are deleted 90 days after the letter is posted, or after a gift box redemption is turned down or cancelled. The order is kept for bookkeeping.
• Audit logs: kept for 90 days.
• Verification / reset tokens: 24 hours (verification) or 1 hour (reset), or until used.

Your rights

• Access — you can download your data at any time from Settings → "Download my data" (a JSON file).
• Erasure — Settings → "Delete account" wipes your account and (if you're the last member) your organization. Players can wipe their per-event data via the "Forget me" menu inside /play.
• Rectification — change your email or password from Settings.
• Portability — the export is a structured, machine-readable JSON document.
• Objection / restriction — contact us at hello@zonventure.com.

Sub-processors

We rely on a small set of vendors to run the service. We'll update this list and notify active accounts before adding new sub-processors that touch personal data:

• Hosting, database, and storage: DigitalOcean.
• Transactional email (verification, password reset, receipts): Google.
• Map tiles on the live board, recaps and in-game maps: OpenFreeMap (tiles.openfreemap.org). Your browser fetches the tiles directly from this provider, which therefore sees your IP address.
• Payments (when enabled): Stripe Inc. and its sub-processors — see stripe.com/legal/privacy.

Cookies we use

We use only first-party cookies that are strictly necessary for the service to function. No analytics, no advertising, no third-party trackers. Specifically:

• zv_session & zv_slot — your login session for the arranger and player surfaces. HttpOnly so client JavaScript can't read them, expires when the session ends.
• zv_csrf — anti-CSRF token used to confirm that mutating requests come from this site. Not HttpOnly because the page's own JS must read it to echo it back.

Because all three cookies are strictly necessary for a service you explicitly requested (article 5(3) ePrivacy Directive exemption), we don't display a consent banner. We will if and when we ever introduce non-essential cookies; this section will be updated at the same time.

We also use the browser's localStorage for UI preferences (theme, language, "don't show this banner again" dismissals). No personal data, no third parties.

Children

Most players are adults in arranged team activities (corporate team-builds, public city walks, etc.) and the platform's defaults assume that audience.

Players under 13 are supported via an explicit COPPA path the arranger acknowledges before scheduling: the arranger attests that the activity is run by their school / camp / parent organisation and that they have the parental consent required by the Children's Online Privacy Protection Act for any U.S.-based minor participants. Independently of that flag, arrangers are responsible for ensuring minors don't participate without appropriate parental consent in their jurisdiction (see Terms).

Changes

We'll publish changes to this page and bump the "Last updated" date. Material changes (new sub-processors, expanded data collection) will additionally be emailed to active accounts.

Contact

General: hello@zonventure.com
Data-protection enquiries: hello@zonventure.com