Privacy Policy

1. Data Controller

Gamopolis GmbH
Karl-Marx-Str. 2, 14612 Falkensee, Germany
Managing Director: Margret Gran
E-Mail: info@gamopolis.com

2. Data Processing Principles

We process personal data only in accordance with the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG). The legal bases are in particular:

• Consent of the user (Art. 6(1)(a) GDPR)
• Performance of a contract (Art. 6(1)(b) GDPR)
• Legal obligation (Art. 6(1)(c) GDPR)
• Legitimate interests (Art. 6(1)(f) GDPR)

3. Data Collection When Visiting the Website

When you access our website, the server automatically stores so-called server log files. These contain:

• Accessed URLs and pages
• Date and time of access
• IP address (anonymised after 7 days)
• Browser type and operating system
• Referrer URL
• Volume of data transferred

The data is used exclusively for statistical analyses and security purposes and is not merged with other data sources. When a campaign-page visitor opens the App Store or Google Play, we also record the destination store, landing page and any UTM campaign parameters; Google click IDs are not stored. Legal basis: Art. 6(1)(f) GDPR.

We do not use cookies on this website.

3.1 New course notifications

If you voluntarily sign up for course notifications, we store your email address and, optionally, your preferred city and radius. The subscription only becomes active after confirmation by email (double opt-in). We use this information solely to notify you about matching new public courses. The legal basis is your consent under Art. 6(1)(a) GDPR. You can unsubscribe at any time using the personal link in every message; your subscription data will then be deleted. Unconfirmed subscriptions are deleted after 7 days.

3.2 Company team-event inquiries

When you use the company team-event inquiry form, we process the company name, contact person, email address, event location, date or period, participant count and, optionally, telephone number, occasion and message. We use this information solely to review and answer your inquiry and, where applicable, to take pre-contractual steps. The legal bases are your consent under Art. 6(1)(a) GDPR and, where applicable, pre-contractual measures under Art. 6(1)(b) GDPR. The information is transmitted through our protected email mailbox and is not used for marketing.

4. myOutdoorEscape App

4.1 No User Account

The app does not require registration or a user account. Access is exclusively via alphanumeric codes (course code, game code).

4.2 GPS Location Data

The app only requests the device's location during active use ("While in Use"). Location data is:

• not stored on our servers
• used exclusively locally on the device for GPS navigation
• automatically deleted when the app is uninstalled

Legal basis: Consent via the operating system's system prompt (Art. 6(1)(a) GDPR).

4.3 Course Data and Private Courses

In normal play mode, downloaded and played course data remains local on the device. If you enable a private course for sharing, its package is uploaded to our server and made available via a private link or game code. Unfinished games do not expire; package and code are deleted seven days after game completion.

4.4 Game Sync (Team Mode)

In team mode, the following data is transmitted to and stored on our servers to synchronise game progress:

• Automatically generated player code (no real name required)
• Current game progress (station index, score, hints, and search-image assignments)
• Game status (Lobby / Running / Finished)
• Timestamp of last activity

The data is assigned to an 8-digit random game code (no connection to personal data). It is automatically deleted no later than 7 days after the end of the game. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

4.5 In-App Purchases

In-app purchases for ticket packs are processed via the respective app store providers (Google Play / Apple App Store). Payment data is processed exclusively by Google or Apple and is subject to their privacy policies.

4.6 Community Courses

When you voluntarily upload a course to our servers (community submission), the following is stored: course name, GPS starting point, course file and metadata. When sharing privately, the package is provided through a private link. Unfinished games do not expire; package and code are deleted seven days after game completion.

4.7 Camera

The app uses the device's camera to take photos for puzzles (search images, photo tasks). Photos are stored locally on the device and only transmitted as part of the course package when you deliberately upload the course.

5. Data Sharing with Third Parties

Personal data is only shared with third parties:

• to process in-app purchases (Google / Apple)
• when we are legally obliged to do so

We do not use analytics, advertising or tracking SDKs in the app.

6. Data Deletion and Retention Periods

• Game progress (team mode): 7 days after game completion; unfinished games remain available
• Course drafts: 4 weeks after last upload
• Private course links: 7 days after game completion; no automatic expiry beforehand
• Rate limit files: 1 hour after the time window expires
• Transaction hashes (IAP): up to 2 years (replay protection)
• Server log files: anonymised after 7 days
• Course notifications: until unsubscribed; unconfirmed subscriptions for 7 days
• Company inquiries: until the inquiry is completed; statutory retention obligations remain unaffected

7. Your Rights as a Data Subject

You have the following rights under the GDPR:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

To exercise your rights, please contact: info@gamopolis.com

Competent supervisory authority: State Commissioner for Data Protection and the Right of Access to Information Brandenburg, Stahnsdorfer Damm 77, 14532 Kleinmachnow.

8. Changes to this Privacy Policy

We reserve the right to update this privacy policy to keep it in line with current legal requirements. We recommend checking this page regularly.