Privacy & Data Protection

Effective date: April 21, 2026

Our Principles

chasify was designed around the principle of data minimisation. We have deliberately built the service to operate with the least amount of personal data necessary:

  • No tracking scripts and no tracking cookies
  • No scripts that analyze your behavior outside the game.
  • No email address required - authentication uses Passkeys only
  • No names, postal addresses, or phone numbers collected
  • No advertising, no behavioral profiling
  • No third-party content delivery networks

Your data belongs to you. You have full access to everything stored about you and can delete your account at any time.

Data we collect

We collect only what is necessary to provide the service:

  • Passkey credential (public key + credential ID) - to authenticate you and maintain a secure session
  • GPS coordinates, altitude, and GPS accuracy - to render the live game map and determine game events such as captures and zones
  • Session token (HTTP-only cookie) - to keep you authenticated during an active session
  • Battery level - to display device status to you and your teammates during a game
  • Game session data - to enable replay functionality and player statistics
  • Server logs (IP address, timestamp, HTTP status, User-Agent) - for security monitoring, abuse prevention, and debugging

Real-time location tracking

Location data is only processed while a game session is active and you have explicitly started tracking via the chasify Tracker. We do not track your location outside of active game sessions.

Game session data & replays

Game sessions - including movement history, captured events, and statistics - are stored persistently to enable replay functionality and player statistics. This data is retained indefinitely unless the game host or the individual participant deletes it. You can delete your own participation data from within the game settings at any time.

Cookies & Authentication

We use cookies exclusively for technical purposes that are strictly necessary to operate the service. None of our cookies are used for tracking, analytics, or advertising. The cookies we set are:

  • Session cookie - maintains your authenticated session. HTTP-only and host-only, meaning it cannot be read by JavaScript or third parties. Expires on logout.

No cookie consent banner is shown because we do not set any non-essential cookies.

Third-Party Services

OpenStreetMap & Leafleat.js

For map display, chasify uses Leaflet.js with map tiles provided by the OpenStreetMap Foundation (OSMF). When the map is displayed, your browser or app connects directly to OSMF servers to load map tiles. This means your IP address and the requested tile coordinates are transmitted to OSMF as part of a standard HTTP request. We have no control over this connection or the processing of your data by OSMF.

The service is operated by the Open Street Map Foundation (OSMF), 132 Maney Hill Road, Sutton Coldfield, West Midlands, B72 1JU, United Kingdom. For more information on how OSMF handles this data, see the OSMF Privacy Policy.

Data Retention

  • Passkey credentials & account data: retained until you delete your account
  • Game session data (movement history, events, statistics): retained indefinitely for replay and statistics purposes - can be deleted by the game host or by you as a participant at any time
  • Server logs: automatically deleted after 14 days
  • Backup copies: after account or session deletion, residual data may remain in encrypted backups for up to 30 days before being purged in the next scheduled rotation

Your Rights

Revocation of your consent to data processing

Many data processing operations are only possible with your express consent. You can revoke your consent at any time by deleting your account. Furthermore, you can have your data corrected or changed at any time.

Right to lodge a complaint with the competent supervisory authority

In the event of violations of the GDPR, those affected have the right to lodge a complaint with Supervisory authority, in particular in the member state of their habitual residence, their place of work or the location of the alleged violation. The right to lodge a complaint exists without prejudice to anything else administrative or judicial remedies.

Revocation of your consent to data processing

Many data processing operations are only possible with your express consent. You can revoke your consent at any time by deleting your account.