Privacy policy
Last updated
Gotcha! keeps only what the game needs to run, deletes it on a schedule, and never sells it. Here is exactly what that means.
Who runs Gotcha!
Gotcha! is run by Two Points Media. In this policy, "we" means Two Points Media. You can reach us about anything here at support@twopointsmedia.com.
What we keep, and for how long
Each kind of data the game keeps, why it's kept, how long it's kept, and who processes it for us:
| Data | Why | Kept | Processed by |
|---|---|---|---|
| Name, email, account ID | Sign-in, showing your name to your game | Until you delete your account | Supabase; Apple or Google if you sign in with them |
| Precise location, during an active game only | Safety rules and checking snaps
If your game uses the hunt clock or hints, your hunter may be told your general area, such as a neighborhood or a building. Never your exact position, and never anyone else. |
30 minutes; deleted when you're out or the game ends | Supabase |
| Snaps, reference selfies, Today's Look | Showing your hunter who to look for; confirming snaps | Until the game ends | Supabase |
| Game records: your name in a game, what happened in it, the results | Running the game and answering questions about it afterwards | 30 days after the game ends | Supabase |
| Push token | Game notifications | Until you sign out or delete your account | Supabase, Firebase Cloud Messaging |
| Crash reports, with a random ID for this installation | Fixing crashes | 90 days | Sentry |
| Face check diagnostics (Android only) | Keeping Google's on-device face detection working | Google's retention | Google (ML Kit) |
Who the processors are
Supabase runs our servers, database and photo storage. Firebase Cloud Messaging delivers game notifications to your phone. Sentry collects crash reports. Apple or Google handle sign-in only if you choose to sign in with them. On Android, Google's ML Kit runs the face checks on your phone and may send Google diagnostics about how its face detection is working, never your photos.
When you delete your account
Your account, snaps, selfies and any positions still held are deleted. In game records, your name is replaced with "Deleted player" straight away, and the rest of the record is kept until 30 days after the game ends, as the table says.
Crash reports
Crash reports carry no personal data: no IP address, account ID, email, location or screenshots. The only identifier in them is a random ID for this installation of the app, which isn't linked to your account.
This website
This website sets no cookies and runs no analytics. Our web host, Vercel, handles requests to it.
Face checks happen on your phone
When you take a snap, the camera checks that a face is in the shot, facing forward and sharp. It never identifies anyone, and no face template or other biometric data is made, stored or sent. Camera and face data are never used for advertising or data mining.
Bystanders are blurred
Faces of people who aren't your target are blurred on your phone before a snap is sent.
Nothing is sold
We don't sell your data or share it for advertising. Gotcha! has no advertising and no tracking.
Your rights
You can see, correct, export and delete your data. Email support@twopointsmedia.com from the address on your account and tell us what you'd like. To delete your account, follow the steps under Delete your account. Deleting your account from inside the app comes with a later release.
Residents of US states with privacy laws have these rights by law, and we give them to everyone. Precise location is sensitive personal information under California law, and we use it only to run the game.
Where Gotcha! is available
Gotcha! is available in the United States only.
Age
Players must be 18 or older. If you think someone under 18 has an account, email us. We'll look into it and delete the account if its owner is under 18.
Changes to this policy
When this policy changes, we post the new version on this page with a new "Last updated" date at the top.
Contact
Two Points Media
support@twopointsmedia.com