Privacy Policy

Placivago is operated by CleverOwl Solutions Ltd, a company registered in England and Wales (Company No. 16973711; VAT No. GB519492465). We operate the website placivago.com and the Placivago mobile apps for iOS and Android. For the purposes of the UK GDPR and the Data Protection Act 2018, CleverOwl Solutions Ltd is the data controller for personal data collected through Placivago. Contact: privacy@placivago.com

We collect the following categories of personal data: Player details: When you start playing, we ask for your name and email address so we can save your scores and track your progress. If you tick the optional consent box, we also use your email to send occasional updates and new challenges. You can withdraw this consent at any time by contacting us or using the unsubscribe link in our emails. Account information: When you create an account, we collect your email address, chosen username, and (if using email/password authentication) a hashed password. We do not store your password in plain text. OAuth information: If you sign in using Google or Apple, we receive a unique identifier and your email address from those providers. Game data: We record the scores, round data, and coordinates of your guesses to provide your game history and statistics. We do not link Street View coordinates to your identity in a way that could identify your physical location. Usage data: We collect standard server logs including IP address, browser type, and pages visited. This is used for security monitoring and to detect abuse. Anonymous play: You can play the free Daily Expedition without an account. To do this we set a randomly generated device identifier in a secure, httpOnly cookie, so we can enforce one play per day and show your position on the leaderboard. This identifier is not linked to your name or email unless you create an account. Bot protection: Our sign-up, sign-in, and password-reset forms are protected by Cloudflare Turnstile, which analyses signals such as your IP address and browser characteristics to tell humans apart from automated abuse. Waitlist and contact form: If you join a waiting list or send us a message through our contact form, we store the email address, and any message, that you provide so we can reply or notify you. Payment data: On our website, subscription payments are processed by Stripe; we store only a Stripe customer identifier and never your card details. In our iOS and Android apps, subscriptions are purchased through the Apple App Store or Google Play and managed on our side through RevenueCat, which gives us a subscriber identifier and your current subscription status. Apple or Google handles the payment and your card details under their own privacy policies; we never see or store them.

We use your personal data to: - Provide and maintain the Placivago service - Process subscription payments - Send transactional emails (account confirmation, password reset) - Detect and prevent abuse of our API rate limits - Generate aggregate, anonymised statistics about game activity We do not sell your personal data to third parties. The free tier of Placivago may be supported by advertising (see "Advertising" below); Placivago Pro, and your free trial, are ad-free. We do not use the game data you generate (your scores, guesses, or history) to target advertising.

We process your personal data under the following legal bases: Contract performance: Processing necessary to provide the service you signed up for. Legitimate interests: Security monitoring, fraud prevention, and improving our service. Legal obligation: Retaining financial records as required by UK law. Consent: Where you have specifically opted in (e.g. marketing communications, if applicable).

We retain account data for as long as your account is active. Game data (scores, rounds) is retained indefinitely to provide your history. You can delete your account and its associated data yourself at any time: open the Account screen in the app or on the website and choose "Delete account", or contact privacy@placivago.com. Deleting your account permanently removes your profile, your authentication record and your personal game history; anonymous, aggregated statistics that cannot identify you may be retained. Server logs are retained for 90 days.

We use the following third-party service providers (sub-processors), which may process your data on our behalf: Google Maps Platform: To provide Street View panoramas and the interactive guess map. Google's privacy policy applies to their services. Google and Apple (sign-in): If you choose to sign in with Google or Apple, they process your authentication. Supabase: Our database and authentication provider. Our data is hosted in Supabase's London (eu-west-2) region on Amazon Web Services. Stripe: For subscription payment processing on the website. Stripe is PCI-DSS compliant. RevenueCat: To manage subscriptions and entitlements for our iOS and Android apps. RevenueCat receives a subscriber identifier and your subscription status so we can unlock Pro on the correct account. Apple App Store and Google Play: When you subscribe inside our mobile apps, Apple or Google processes the payment and your card details under their own privacy policies, and confirms to us (through RevenueCat) that your subscription is active. Resend: To send transactional emails, such as account confirmation and password resets, from hello@placivago.com. Cloudflare: For DNS, content delivery, and bot protection (Cloudflare Turnstile) on our sign-up, sign-in, and password-reset forms. Vercel: Our hosting provider. Your requests are processed through Vercel's infrastructure. Where your data is processed: We aim to keep personal data within the UK and European Economic Area. Some of our providers (for example Stripe, RevenueCat and Cloudflare) may process data in other countries, including the United States. Where data is transferred outside the UK/EEA, it is protected by appropriate safeguards such as the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or an adequacy decision.

Under UK GDPR, you have the right to: - Access your personal data - Correct inaccurate data - Request deletion of your data - Object to or restrict processing - Data portability - Lodge a complaint with the Information Commissioner's Office (ICO) To exercise any of these rights, contact us at privacy@placivago.com.

Placivago uses only strictly necessary cookies and local storage. These include: authentication cookies (session tokens) so you can stay signed in; a secure, httpOnly device-identifier cookie that lets you play the free Daily Expedition without an account; and a cookie set by Cloudflare Turnstile to protect our sign-up, sign-in, and password-reset forms from automated abuse. When you first visit, a cookie banner lets you accept all cookies or continue with only the essential ones, and we store your choice locally so we do not ask again on every visit. We do not currently use advertising or cross-site tracking cookies. If we introduce third-party advertising on the free tier in future (see "Advertising" below), any advertising cookies will be non-essential and will be set only with your consent through the cookie banner; Placivago Pro remains ad-free. You may disable cookies in your browser settings, but this will prevent you from logging in and playing.

Placivago is free to play, and the free tier may be supported by advertising. Advertisements are shown only to users on the free tier (for example, a banner on our home page) and never to Placivago Pro subscribers or to users during their free trial. This applies to both our website and our mobile apps. We may sell and serve advertising ourselves, or use third-party advertising partners or networks that fill the advertising space automatically. Where a third-party network serves ads, it may set cookies or use similar technologies to display and measure advertisements, and in some cases to personalise them. These are not strictly necessary cookies, so where the law requires it we will ask for your consent through our cookie banner before they are set, and you can decline non-essential cookies and continue to play. We do not share the game data you generate (your scores, guesses, or history) with advertisers, and we do not use it to target advertising. If we enable third-party advertising, we will update the "Third-party services" and "Cookies" sections above to name the providers involved and will update our app store privacy disclosures accordingly. We are not responsible for the content of third-party advertisements.

We take reasonable technical and organisational measures to protect your data, including encryption in transit (TLS/HTTPS), hashed passwords, access controls, and hosting with reputable providers. No method of transmission or storage is ever completely secure, so we cannot guarantee absolute security. If we become aware of a personal data breach that is likely to affect your rights, we will notify the Information Commissioner's Office, and affected users where required, without undue delay and within the timeframes set by UK GDPR.

Placivago is intended for users aged 16 and over. We do not knowingly collect data from children under 16. If you believe a child under 16 has provided us with personal data, please contact privacy@placivago.com.

We may update this Privacy Policy from time to time. We will notify you of significant changes by email (if you have an account) or by posting a notice on the website. Continued use of the service after such notification constitutes acceptance of the updated policy.