Privacy policy
Last updated: 2026-10-05 · Česky
This page describes what personal data the gps42 platform processes, what for, how long we keep it and who receives it. It matches how the system actually works; when that changes, so does this page. If the Czech and English versions differ, the Czech version applies.
1. Controller
The controller of your personal data is Akademion, z.s., company ID (IČO) 22740350, Žďár 7, 472 01 Doksy, Czech Republic. For anything concerning your data, write to info@gps42.com. We have not appointed a data protection officer.
2. What we process, why, and on what legal basis
Legal bases refer to Article 6(1) GDPR: contract (b: we could not provide the service without the data, including steps before entering a contract), legal obligation (c), legitimate interest (f) and consent (a: you can withdraw it at any time).
| Data | Purpose | Legal basis |
|---|---|---|
| Email, time of registration, last login and consent | Login: we send a sign-in link to it, there are no passwords. Payment receipts and messages about orders. | contract |
| A record of every sign-in link request, including the email address | Protecting sign-in against abuse and investigating incidents. | legitimate interest |
| Display name, handle and the team name entered when starting a game | Shown in the app; the event organiser sees the team name on their map. | contract |
| Location during a game (see below) | Checking that you are at a station, and an overview for the event organiser. | consent (live location), contract (station check) |
| Game progress: start and end, completed stations, answers to tasks | Running the game and its results. | contract |
| Task photos (see below) | Completing a task that asks for a photo, and reviewing it. | contract |
| Ratings and reviews of games | Shown with the game. | contract |
| Orders, payments and receipts: buyer email, number and bank code of the paying account, amount, date, variable symbol, payment message | Selling paid games, matching payments from the Fio bank statement, issuing receipts, settling with creators. | contract; legal obligation (accounting) |
| In-app messages and contact form messages | Communicating with you (orders, game approval, questions). | contract; legitimate interest |
| Administrator notes on an account | Handling support and breaches of the terms. | legitimate interest |
| Creator content: games, places and media uploaded while mapping (field-capture) | Creating, approving and publishing games. A game submitted for approval is pre-assessed automatically by Google Gemini; the game content is sent, not player data. | contract |
| Enquiries from the website: name, email and, depending on the form, company, phone and message | Answering the enquiry and joining the beta programme. | contract (steps before entering it) |
| Error reports (see Sentry) | Finding and fixing bugs. | legitimate interest |
| Anonymous statistics: events such as starting or finishing a game, with a random browser identifier not linked to an account | Measuring how games are played. | legitimate interest |
We do not sell data and do not use it for ad targeting.
Location
A game cannot start without consent to share your location. While a game runs, your current location is sent to the server and the event organiser can see it. Only the latest position is kept, never a track, and it is deleted when the game ends: when you end it, when the organiser does, or when the system ends an abandoned game as expired.
You also send your location when completing a station, so we can check you are there. For ordinary stations only the result (completed / not completed) is stored, not the coordinates. In geocaching games, the coordinates and accuracy are stored with each event (entering a zone, unlocking). These records cannot be changed and we currently do not delete them.
Photos
If a game asks for a photo, we store the original and smaller copies. When the photo is uploaded we strip its metadata (EXIF, XMP), including the GPS position where it was taken, the time and device details; only the rotation flag is kept. The image itself is not altered.
If the game's author chose manual photo review, a link to the small copy (valid for 10 minutes) and the station name are sent to a platform administrator in Telegram, who approves or rejects the photo. Your name and email are not sent to Telegram.
3. Who receives the data
We use these services. Each receives only the data its part needs.
| Service | Purpose | Where |
|---|---|---|
| Google Cloud (Cloud Run, Cloud SQL, Cloud Storage) | Running the app, database, storage of photos and media | EU (Belgium) |
| Firebase Hosting (Google) | Delivering the website and app to your browser | global server network |
| Resend | Sending emails: sign-in links, receipts, notifications | USA |
| Fio banka | Receiving bank transfers and the statement we match payments against | Czech Republic |
| Sentry | Error reports. The server sends no cookies, IP addresses, request contents or sign-in tokens. On an error the web app also sends a short screen recording of the moments before it; all text is masked and images and media are hidden. | EU (Germany) |
| Telegram | Manual photo review (see above) | outside the EU |
| Google Gemini | Pre-assessing games submitted for approval (game content only) | outside the EU |
| Google Apps Script | Keeping track of website enquiries | outside the EU |
| Map tiles: OpenStreetMap and CARTO (default map), Mapbox (when a game or your settings use it) | Your browser downloads the map directly from them, so they see your IP address and the area shown | EU and USA |
Where data leaves the EU, this is based on a European Commission adequacy decision (EU–US Data Privacy Framework) or standard contractual clauses.
4. How long we keep data
| Data | Period |
|---|---|
| Live location during a game | until the game ends |
Sign-in (__session cookie) | 14 days from last activity |
| Sign-in links | valid 15 minutes, deleted once used |
| Your account and its data | until the account is deleted (see below) |
| Receipts, orders and payments | as long as the law requires |
| Everything else (game progress, geocaching location events, photos, messages, audit records, enquiries) | no period set yet; today we do not delete them |
5. Your rights
- Access: find out what data we hold about you and get a copy.
- Rectification of inaccurate data. You can change your handle in your profile; write to us about anything else.
- Erasure where we no longer need the data or process it unlawfully (see Account deletion).
- Restriction of processing, for example while we handle your objection.
- Portability: the data you gave us, in a machine-readable format.
- Objection to processing based on legitimate interest.
- Withdrawing consent to location sharing: end the game. Playing without location is not possible.
Send requests to info@gps42.com from the address you sign in with. We handle them manually within 30 days. You can complain to the Czech Office for Personal Data Protection (uoou.gov.cz).
6. Account deletion
Ask for deletion in the app, in your profile, with “Request account deletion”, or email info@gps42.com from the address you sign in with, subject “Account deletion”. We handle it manually within 30 days of receipt. If you have an order in progress, or are a creator awaiting a payout, we complete that first.
What happens: we replace the email on the account with a placeholder, delete the last login and consent times, end all sessions and sign-in links and remove all permissions. The account can no longer be signed into. If you later register with the same email, a new, empty account is created.
What stays: display name and handle, game history including stored geocaching locations, uploaded photos, ratings and reviews, in-app messages, orders and payments, and earlier audit records of sign-in requests that contain your email. Media uploaded while mapping (field-capture) are removed if your request explicitly asks for it.
7. Cookies and browser storage
We set only two cookies, both strictly necessary:
-
__session: sign-in. Set after you sign in, not readable by scripts on the page, valid 14 days from last activity. -
gps42.theme: your light or dark theme choice, valid one year. Set only when you switch the theme yourself.
The app also keeps in browser storage (localStorage) your games in progress and guest game token, your language, preferred map and a random identifier for anonymous statistics. Clearing the site data in your browser removes them. We use no advertising or tracking cookies and no third-party analytics, which is why there is no cookie banner.
8. Changes
When we change how we handle data, we update this page and the date at the top. We will tell you about significant changes by email in advance.