Deutsch · English

HUNTR

Privacy policy

For the HUNTR app (iOS and Android) and the game server at this address. Last updated: 19 October 2026

1. Controller

Niklas Burkhard Kronig
Annakirchstraße 78
41063 Mönchengladbach
niklas@kronig-lab.de

2. In short

• No account, no email address, no phone number.
• Your location is only sent while a game is running. Outside of games nothing is collected.
• No ads, no analytics or tracking services, no selling or sharing of data for advertising.
• Game data is deleted automatically after 30 days, and you can delete your data in the app at any time.

3. What data we process

Device identifier

On first launch the app creates a random device ID and a secret. The server stores the ID, a hash of the secret (never the secret itself) and when the ID was created and last used. This links your stats and history to your device. On its own it does not identify you as a person.

Profile

Player name, emoji, colour and the app language. You choose them yourself; you do not need to use your real name. Other players in the same game see your profile.

Location data

While you take part in a running game, the app regularly sends your position to the server, also when the app is in the background or the phone is locked. The game needs this: pings, catching, the play zone and warnings only work this way. Sending stops when the game ends or when you leave it.

Who sees what depends on the rules the host sets: the server only reveals runner positions to other players as a ping or reveal, optionally blurred. Teammates and spectators (with an adjustable delay) may see more positions. After the game, all participants can open a replay with the paths of all players.

To prevent cheating, the server checks whether positions are plausible (for example impossible speeds, or a location the system reports as simulated). Anything suspicious is flagged in the game for the host and spectators.

Game content

Game settings, play area, events (for example pings, catches, abilities), in-game chat messages and the result. Your stats, achievements and game history are built from the results.

Push notifications

If you allow notifications, the server receives a push token for your device and sends you alerts during a game (for example "Ping in 30 seconds" or "Hunter nearby"). The texts may contain player names or announcements from the host.

Technical data

Your IP address is processed with every connection. The game server only keeps it in memory to limit abuse through too many requests and does not log individual requests. The reverse proxy in front of it writes access logs (IP address, time, requested address) and filters attacks; this data is used for security only and deleted regularly.

Camera

The camera is only used to scan QR codes (invites and catch codes). Images are neither stored nor sent, only the content of the scanned code.

On your device

Your profile, settings, saved play areas and the credentials for the server stay on your device (the credentials in the system's secure storage). They are removed when you uninstall the app.

4. Recipients and services

• Game server: run by the controller themselves; no hosting provider is involved.
• Other players: see your profile, events and positions within the game rules (see above).
• Expo (650 Industries, Inc., USA): forwards push notifications to Apple or Google and processes the push token and notification text for this. Transfers to the USA are based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).
• Apple Push Notification service (Apple) and Firebase Cloud Messaging (Google): deliver notifications to iPhone and Android. Apple and Google are certified under the EU-U.S. Data Privacy Framework.
• OpenFreeMap (openfreemap.org): serves map tiles and fonts. Your IP address and the visible map area are sent to OpenFreeMap, but not your game position.
• App Store / Google Play: downloads and updates go through Apple or Google; their privacy policies apply.

We do not share data beyond this unless required by law.

If you enter a different server in the app, its operator is responsible for the data processed there.

5. Legal bases

• Art. 6(1)(b) GDPR: providing the game you use (device identifier, profile, location during games, game content, stats).
• Art. 6(1)(a) GDPR: your consent through the system prompts for background location, notifications and camera. You can withdraw it at any time in the system settings.
• Art. 6(1)(f) GDPR: our legitimate interest in secure and fair operation (rate limiting, access logs, cheat detection).

6. Retention

• Finished games with paths, events, chat and results: 30 days after the game ends, then deleted automatically.
• Lobbies that never started: after 24 hours without activity.
• Push tokens: belong to a game and are deleted with it.
• Device identifier: until you delete your data in the app.

7. Deleting your data

In the app under Settings → Privacy → Delete my data you immediately remove your device identifier, stats, achievements and history, and leave running games. Games you took part in are deleted together with the other players' data when the retention period ends. If you want earlier deletion, send us an email.

8. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future. Just write to the email address above.

You can also lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

9. Security

All connections between app and server are encrypted with TLS. Device secrets are only stored as a hash. The server runs with restricted privileges in an isolated container.

10. Changes

When the app or the processing changes, we update this policy. The version published here applies.