Privacy Policy

Draft template. Have this reviewed by a lawyer before publishing. The wording below covers the technical reality of what the platform stores and processes; tailor the legal framing ([set ZV_JURISDICTION], GDPR / CCPA / etc.) for your audience.

Who we are

This service ("we", "us", "the service") is operated by Zonventure AB. Questions about this policy? Email hello@zonventure.com.

What we collect

We collect only what's needed to run the adventure platform:

• Account data for arrangers: email, organization name, hashed password, IP and user-agent at login. Used for authentication and security audit.
• Player data: a slot name (chosen by the arranger), and during an event the player's GPS location and answer text. Used to display progress on the live board and verify location gates.
• Operational logs: login successes/failures, IPs, access timestamps. Used to detect abuse and investigate issues.
• Email-verification and password-reset tokens, one-shot, expire in 1 hour, deleted on use.

What we DON'T collect

• No analytics or advertising trackers.
• No payment-card numbers — payment is processed by Stripe; we receive only their non-sensitive event metadata.
• No location data from arrangers, only from players who opt into geolocation when prompted by the play page.

How long we keep it

• Account data: until you delete the account.
• Player location pings & answers: deleted with the event, or after the platform's location-retention window (30 days post-event by default), whichever comes first.
• Audit logs: kept for 90 days.
• Verification / reset tokens: 1 hour or until used.

Your rights

• Access — you can download your data at any time from Settings → "Download my data" (a JSON file).
• Erasure — Settings → "Delete account" wipes your account and (if you're the last member) your organization. Players can wipe their per-event data via the "Forget me" menu inside /play.
• Rectification — change your email or password from Settings.
• Portability — the export is a structured, machine-readable JSON document.
• Objection / restriction — contact us at hello@zonventure.com.

Sub-processors

We use a small set of vendors to run the service. Update this list when you swap any of them out:

• Hosting / database / storage: [fill in your hosting vendor]
• Transactional email: [fill in your SMTP / email provider]
• Payments (when enabled): Stripe Inc.

Cookies we use

We use only first-party cookies that are strictly necessary for the service to function. No analytics, no advertising, no third-party trackers. Specifically:

• zv_session & zv_slot — your login session for the arranger and player surfaces. HttpOnly so client JavaScript can't read them, expires when the session ends.
• zv_csrf — anti-CSRF token used to confirm that mutating requests come from this site. Not HttpOnly because the page's own JS must read it to echo it back.

Because all three cookies are strictly necessary for a service you explicitly requested (article 5(3) ePrivacy Directive exemption), we don't display a consent banner. We will if and when we ever introduce non-essential cookies; this section will be updated at the same time.

We also use the browser's localStorage for UI preferences (theme, language, "don't show this banner again" dismissals). No personal data, no third parties.

Children

This platform is intended for adults. Players are typically adults in arranged team activities; arrangers are responsible for ensuring minors don't participate without parental consent (see Terms).

Changes

We'll publish changes to this page and bump the "Last updated" date. Material changes (new sub-processors, expanded data collection) will additionally be emailed to active accounts.

Contact

General: hello@zonventure.com
Data-protection enquiries: hello@zonventure.com