Privacy Policy

1. What we collect

• Account info — your email address, username, display name and password (hashed; we never store plaintext passwords). If you sign in with Google, we receive your name, email and profile picture from Google. If you sign in with Apple, we receive your name (if you choose to share it) and an email address, which may be a private relay address that Apple forwards to you.
• Quest submissions — photos, captions and timestamps you submit when completing quests.
• Location data — only for City Challenges: your device's GPS position when you submit, used to check you are at the landmark. Location metadata is stripped from every photo we store.
• Profile extras you choose to add — avatar, cover photo, social usernames.
• Technical data — browser/device type, IP address and a session cookie, to keep you signed in and protect accounts from abuse.

2. How we use your data

• To run Puffin Quest — track your progress, puffin, streaks and rewards.
• To power community features — Review Cove approvals and public profiles.
• To check photos — photos are sent to an AI service (Google Gemini) for a safety check and, for City Challenges, to recognise the landmark.
• To send account emails — verification and password reset. No marketing emails.
• To fix bugs and keep the service secure.

3. What we don't do

• We do not sell your personal data.
• We do not run ads or share data with advertising networks.
• We do not track you across other websites or apps.
• We do not keep GPS coordinates beyond what City Challenge verification needs.

4. Photos & quest content

Photos you submit are stored on our servers. They may be seen by other puffineers during Review Cove and, if you choose, on your public profile. You can delete a journal post, or your whole account, at any time.

5. Cookies

We use one essential session cookie to keep you signed in and a language preference. No third-party tracking cookies.

6. Data storage & security

Your data is stored on servers we operate, over HTTPS. Passwords are hashed with industry-standard algorithms, sign-in attempts are rate-limited, and we back up data regularly.

7. Children's privacy

Puffin Quest is designed to be family-friendly. We do not knowingly collect personal information from children under 13 without parental consent. If you believe a child has given us personal information, contact us and we will delete it promptly.

8. Your rights

You can access and correct your data in your profile, export it (Profile → Edit → Download my data), and delete your account and all associated data yourself (Profile → Edit → Delete account). You can stop sharing location by not using City Challenges.

9. Third-party services

We use Google and Apple for optional sign-in, Google for AI photo checks, Gmail to send account emails, and Sentry to report errors. Each has its own privacy policy; we share only the minimum these services need.

10. Changes to this policy

We may update this policy. If we make significant changes, we will tell you in the app. The date at the top shows the latest revision.

11. Contact us

Email: contact@greenuplabs.com · Website: greenuplabs.com · Facebook: greenupinvietnam