Privacy Policy — Treasure Hunt Sarajevo

This Privacy Policy explains how ContAnt ("we", "us", "our"), operator of the Treasure Hunt Sarajevo website and mobile apps (the "Service"), collects, uses, and protects your personal data. We are the data controller for the personal data described here.

We take a privacy-light approach: the game is designed to run without collecting more than it needs. This policy is written to be understandable and to comply with the EU General Data Protection Regulation (GDPR) as well as applicable Bosnian data protection law for all our players.

1. What We Collect

When you book

Your name and surname, email address (if available), telephone number, the date/time you book, and the number of players, so we can create your game and send your codes and a recap.

Payment: in-app purchases are processed by Apple or Google (via our provider RevenueCat). We do not receive or store your card details - we only receive a confirmation that the purchase succeeded and a transaction ID.

If you book through a partner platform (e.g. Viator), we receive the booking details they pass to us (which may include an anonymized contact address); we do not receive your payment details.

Permissions the app requests

• Camera - to take photos you submit to complete the tasks.
• Notifications - to send you game updates and keep you in the loop while you are playing.

The app does not track your GPS location or run background location.

When you play the game

• A device identifier / anonymous account. We sign you in anonymously (no name, email, or password required to play). This creates a random device ID, so your progress and team are remembered.
• Your team name, which you choose.
• Photos you take and submit to complete game tasks. These are uploaded to our servers and reviewed by our game administrators to award points.
• Game progress: task submissions, scores, hints used, and completion times.
• Language preference.
• Push notification token (only if you allow notifications), so we can send you game updates (e.g. when an admin approves your photo).

2. How We Use Your Data

• To run the game - remember your team and progress, review photos, and award points.
• To deliver your booking - create your game, email your codes, and (if you provide an email) send a post-game recap.
• To send notifications you have opted into.
• To provide support during your game.
• To operate, secure, and improve the Service.

Legal bases (GDPR): performance of a contract (providing the game/booking you purchased), your consent (notifications; optional recap email), compliance with our legal obligations, and our legitimate interests (running and securing the Service).

Providing the information from Section 1 - What We Collect (above) is necessary to enter into and perform the contract for the game. If you do not provide the specified information, we may be unable to process your booking.

3. Your Photos

Photos you submit are used to verify task completion and may appear in your end-of-game recap. They are visible to our game administrators for review. They are deleted automatically:

• Rejected photos within 24 hours
• Approved photos within about 7 days of your game
• The recap PDF, if one is generated, within about 7 days

4. Who We Share Data With

We do not sell your personal data. We share it only with service providers that help us run the Service, under contract and only as required by:

• Google Firebase (Google Ireland/LLC) - authentication, database, photo storage, cloud functions, and push delivery (FCM).
• RevenueCat - validating in-app purchases.
• Expo - delivering push notifications.
• Apple / Google - processing in-app purchases through their stores.
• Partners - where you book through them (including Viator/Tripadvisor/AirBNB).
• Email delivery provider - to send your booking confirmation, invite, and recap emails.

We may also disclose data where required by law.

5. International Transfers

Our providers (e.g. Google, RevenueCat, Expo) may process data on servers outside Bosnia and Herzegovina / the EEA, including in the United States. Where they do, appropriate safeguards (such as Standard Contractual Clauses as issued by the Personal Data Protection Agency BiH) are in place.

6. How Long We Keep Data

• Photos: rejected within 24 hours; approved within about 7 days of the game. Recap PDFs within about 7 days.
• Your email address: automatically erased about 10 days after your game. This applies to the address held against your booking, and to our copy of the booking/recap emails we sent you (both are purged by an automated daily job).
• Transaction reference (a store transaction ID, no card data): kept only as long as needed to meet legal/accounting obligations.
• Anonymous game data (scores, team name, progress): keyed to a random device ID, not to you. It is retained for the game and a limited period afterwards, then deleted or anonymized. It contains no contact details once your email has been erased.

7. Children

The Service is not directed to children under 18. We do not knowingly collect personal data from children under that age. Younger participants should play under the supervision of a booking adult.

8. Security

We use industry-standard measures (encryption in transit, access-controlled storage, server-side rules) to protect your data. No method of transmission or storage is 100% secure, but we work to protect your information.

9. Your Rights

Depending on your location, you may have the right to access, correct, delete, restrict, or object to our processing of your personal data, and to data portability.

You also have the right to lodge a complaint with your local data protection authority (in Bosnia and Herzegovina, the Personal Data Protection Agency).

You may also withdraw consent (e.g., turn off notifications) at any time.

If you would like any data removed sooner than our automatic cleanup, just email us at office@wearecontant.com, and we will delete it - from your booking, our sent-email records, and any purchase records - usually within 48 hours of your request.

Because in-app play is anonymous, we may be unable to identify your device data without additional information (such as your game code or booking email).

10. Changes to this policy

We may update this policy from time to time. The "Last updated" date above shows the latest version, and material changes will be reflected here.

11. Contact

Društvo za promociju ContAnt d.o.o. Sarajevo

Hasana Brkića 30

71000 Sarajevo, Bosnia and Herzegovina

Email: office@wearecontant.com