Privacy policy
Hide & Sleuth is a scavenger-hunt app in which organizers run hunts for the young people in their care. This page says what we store, why, for how long, and how to get it removed. It is written to be read, not skimmed past.
Who we are
Hide & Sleuth is made by Haystack Studios LLC. Questions and requests go to support@haystackstudios.games.
What we store, and who it belongs to
- Organizers (the adults who set up a hunt) have accounts: an email address, an optional display name, and sign-in sessions. There are no passwords — a one-time code is emailed each time you sign in.
- Sleuths (the people playing) have no accounts and give us no email address or phone number. A hunt stores the first name they type (or the organizer types for them), which team they are on, which suspects they unmasked and when, and the selfie taken for each unmask.
- Suspects (the adults in disguise) are set up by the organizer: a name, a photo the organizer uploads, and the pass phrase that proves a find.
The organizer decides what goes into their hunt and is responsible for having permission to collect it — including a parent’s or guardian’s consent for a minor’s first name and photo. We never collect anything from a child directly, and we never ask a sleuth for contact details.
Where a find happened. When a sleuth unmasks a suspect, the app records the phone’s location at that moment — if the sleuth has allowed location access — so the organizer can see where finds happened. It is captured once per find, never in the background, is visible only to that hunt’s organizers and in their export, and is deleted with the selfies (see Retention).
Who can see the photos
Before the organizer reveals a hunt, a selfie is visible only to the team that took it and to that hunt’s organizers. After the reveal, the gallery for that hunt is public to anyone with the hunt’s link, until the photos are removed (see Retention). The leaderboard and wanted board show team names, first names and suspect photos while a hunt is announced.
Retention
- Selfies are deleted automatically 30 days after the hunt ends or is revealed, whichever is later. Organizers can export them before then. The finds themselves (who unmasked whom, and the points) stay with the hunt.
- A hunt, with everything in it, is deleted when the organizer deletes it.
- An organizer account is deleted when the organizer asks (in the app or the console). Organizations where they were the only member are deleted with every hunt inside.
- Sign-in codes expire in 10 minutes; sessions in 30 days.
Children
The app is made for organized groups — a youth group, a class, a troop, a camp — where an adult organizer runs the hunt and obtains the consents their organization requires. We do not knowingly hold a child’s information outside a hunt an adult set up, we show no advertising, and the sleuth app contains no analytics or tracking software. If you believe a child’s information reached us without consent, email support@haystackstudios.games and we will remove it.
Where the data lives
We use a small number of providers to run the service, each only for the purpose listed: Vercel (hosting and photo storage), Neon (the database), Resend (the sign-in emails), and Firebase Cloud Messaging (push notifications to the apps, with analytics collection turned off). Servers are in the United States.
Your rights
Organizers can see and change their account, export a hunt as a ZIP, and delete hunts and their account from the console or the app. Anyone — a parent, a sleuth, a suspect — can email support@haystackstudios.games to ask what we hold about them or their child and have it removed; we answer within 30 days.
Changes
If this changes in a way that matters, the effective date above moves.