Privacy

We collect the minimum a real-world treasure hunt needs: your account, your hunts, and — at the moments that matter — your location. We never sell your data, never show ads, and strip location metadata from every photo. Location checks exist to verify finds, not to track you.

• Account — your email (for sign-in), handle, display name, and avatar if you set one.
• What you create — hunts, clues, photos, comments, theories. Public content is public.
• Location, at specific moments only — (1) when a skipper activates a hunt, the activation spot becomes that hunt’s secret verification point; (2) when a hunter claims or uses warmer/colder, we read your location to check it against the hunt’s zone; (3) when you tap “Show loot near me” or sort by distance, we read your location once to position the map — used in the moment, never stored. We do not track you in the background, ever. There is no location history feature and location is never read outside these actions.
• Security signals when you claim — the claim check keeps a security log: the location fix you claimed from, its accuracy, your device identifier, and IP address. This log exists to stop cheating (fake GPS, relayed codes, collusion) and to fix verification bugs. It is never shown publicly, never used for advertising, and never sold.
• Photos — every photo you upload (avatar, prize proof, victory photos) has its hidden metadata — including embedded GPS coordinates — stripped on our servers before it is stored. Always, with no exceptions. A photo that can’t be verifiably cleaned is rejected.

No selling your data. No ads, no ad tracking, no data brokers. No background location. No sharing your claim locations with skippers or other hunters — hunters see only “Looted by @you,” never where you stood.

LootSkip runs on: Supabase (database, sign-in, photo storage), Vercel (app hosting), Mapbox (map tiles — your browser requests tiles for the area you view), Cloudflare (network + email routing). When cash prizes launch, Stripe will handle payments and identity checks — we never see card numbers or ID documents. Each processor receives only what its job requires.

Your content stays until you remove it (hunts are soft-removed, never silently erased — winners keep their history). Security logs are kept as long as needed for anti-cheat integrity. Account deletion: a self-serve delete is being built; until it ships, email hello@lootskip.com and we will delete your account and personal data by hand.

Edit your name/handle/avatar anytime. Remove your hunts anytime. Ask us for a copy of your data, or for deletion: hello@lootskip.com. We answer real emails from real humans.

Accounts are 13+ with guardian consent; under-13s hunt only alongside a guardian’s account. See the Minors policy on the Legal page.

If this policy changes materially we’ll note it here with a date. Version: 2026-07-13.interim (added: the “near me / sort by distance” one-shot location read — item 3 above).