1. Who we are
Cluevo ("we", "us", "our") is an interactive adventure platform operated from Athens, Greece. We are the data controller for information collected through the Cluevo website (cluevo.app) and the Cluevo mobile app. If you have questions about this policy, contact us at privacy@cluevo.app.
2. What data we collect
Account data — name, email, sign-in method (email, Google, or Apple), and profile picture if you set one.
Adventure data — sessions you start, checkpoint submissions, GPS fixes captured at the moment you submit a location checkpoint, photos you upload for a photo checkpoint, hint use, and scores.
Device data — a push notification token, and a minimal fingerprint (OS, app version) used for crash triage.
Website data — pageviews and anonymised CTA clicks via a cookieless analytics tool. See our Cookie Policy for detail. We do not collect payment card details directly.
3. How we use your data
We use your account and adventure data to deliver the adventure you asked to play, keep score, run leaderboards, and (when you opt in) send you push notifications about your session or team. We use aggregated funnel and completion metrics to improve the product. We do not sell your personal data. We do not add you to marketing lists without your explicit consent.
4. Legal basis for processing
We process your data on the basis of performance of a contract (delivering the adventure and its scoring), legitimate interest (fraud detection and product improvement), and, where applicable, your consent (push notifications, marketing). You may withdraw consent at any time from Settings in the mobile app or by emailing privacy@cluevo.app.
5. Data storage and security
All player data is stored within the European Union on Google Firebase (Google Cloud, europe-west4 region — the Netherlands). We apply industry-standard security including TLS 1.2+ in transit and encryption at rest. Access to personal data is restricted to authorised Cluevo personnel using least-privilege access.
6. Data retention
Session and submission data is retained for 24 months from the last activity, then aggregated and anonymised. Photos uploaded to photo checkpoints are deleted 12 months after upload unless a session review references them. You can delete your account at any time from Settings in the mobile app, which removes your Cluevo data and authentication account permanently.
7. Your rights
Under GDPR you have the right to: access your personal data, correct inaccurate data, request erasure, restrict or object to processing, and data portability. To exercise any of these rights, email privacy@cluevo.app. You also have the right to lodge a complaint with the Hellenic Data Protection Authority.
8. Third-party services
We use Firebase (Google LLC) for authentication, storage, cloud functions, and push notifications. Google acts as a data processor on our behalf under Standard Contractual Clauses. We use Expo for push token registration on iOS/Android. We use Plausible for cookieless website analytics — see our Cookie Policy for the full list.
9. Children
Cluevo is not directed at children under 16. If you believe a child has provided us with personal data without a guardian's consent, email privacy@cluevo.app and we will delete it.
10. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be announced on this page and — if you are a registered user — in the mobile app. The "Last updated" date at the top of this page indicates when the policy was last revised.