← Back

Privacy Policy

Last updated · 2026-04-30 · v1.0 · DRAFT

1. Who we are

The COMBINI×HUNTER mobile application and website combinixhunter.com (the "Service") are operated by an independent publisher. The Service is a worldwide geocollection game centered on convenience stores. Contact: combinihunter@gmail.com.

This Privacy Policy explains what personal data we process, why, how, and your rights. It applies to all users globally and complies with the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and equivalent regimes.

2. Data we collect

Account data

Field	Purpose	Legal basis (GDPR)
Email address	Account creation, password reset, security notifications	Contract performance
Username	Public identifier inside the game	Contract performance
Hashed password	Authentication	Contract performance
Avatar (optional)	Public profile	Consent

Gameplay data

Field	Purpose	Legal basis (GDPR)
Capture photos	Game functionality, anti-cheat verification	Contract performance
GPS coordinates at capture	Anti-cheat: confirm physical presence at the store	Contract performance
Capture timestamp	Score & streak calculation	Contract performance
Score, badges, stamps	Game progression	Contract performance
Comments, follows, likes	Social features	Contract performance

Technical data

Field	Purpose	Legal basis (GDPR)
Device identifiers	Push notifications, anti-fraud	Legitimate interest
Crash logs (Sentry)	Stability and bug fixes	Legitimate interest
App interaction events	Anonymized product analytics	Legitimate interest

3. What we do NOT collect

• Continuous background location. GPS is captured only at the moment you press the capture button.
• Contacts, calendar, messages, browsing history.
• Health, fitness, financial, biometric data.
• Race, ethnicity, political opinions, religion, sexual orientation.
• We do not use third-party advertising trackers.

4. Photo metadata

Photos uploaded for store captures are processed server-side. EXIF metadata containing personal information (device model, software version, original GPS) is stripped before storage. Only the verified capture coordinates and timestamp are retained.

5. How we share data

• Public: your username, avatar, public capture photos, scores and country flags are visible to other users in the leaderboard, live feed, and your public profile.
• Service providers: Supabase (hosting + database, EU region), Cloudflare R2 (photo storage), Sentry (crash reporting), Apple Push Notifications, Google Firebase Cloud Messaging. Each provider is bound by a Data Processing Agreement.
• Legal: we may disclose data when required by law, valid court order, or to defend our rights.
• We never sell your personal data.

6. International transfers

Data may be transferred to processors located outside the EEA. We rely on Standard Contractual Clauses (Commission Decision 2021/914) and equivalent safeguards.

7. Retention

• Account data: until you delete your account, then 30 days for backups.
• Gameplay data: same as account data.
• Crash logs: 90 days.
• Moderation flags: kept for the duration of the dispute, then anonymized.
• Backups: rolling 30 days, then permanently deleted.

8. Your rights

Under GDPR, CCPA and equivalent laws, you have the right to:

• Access: request a copy of your personal data.
• Rectification: correct inaccurate data.
• Erasure ("right to be forgotten"): delete your account and personal data.
• Restriction: limit how we process your data.
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interest.
• Withdraw consent: at any time, where processing is based on consent.
• Lodge a complaint: with your local Data Protection Authority (in France: CNIL).

To exercise any right, email combinihunter@gmail.com or use the in-app option Profile → Account → Delete my account.

9. Children

The Service is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe a child has provided us with personal data, contact us and we will delete it.

10. Security

We use HTTPS/TLS in transit, hashed passwords (bcrypt), Row-Level Security on all database tables, and least-privilege access for our team. Despite our efforts, no system is 100% secure; report any vulnerability to combinihunter@gmail.com.

11. Changes to this policy

We may update this Privacy Policy. Material changes will be announced in the app and on combinixhunter.com at least 7 days before they take effect.

12. Contact

For any privacy question: combinihunter@gmail.com.