Privacy Policy

Last updated: October 29, 2026 · Effective: October 29, 2026

1. Introduction & Overview

Welcome to ShadowHunt ("Application", "App", "Platform", "Service", "we", "us", or "our"), operated and maintained from Pune, Maharashtra, India. ShadowHunt is a real-world, multiplayer social deduction manhunt mobile application.

We respect your privacy and are committed to protecting your personal data. This Privacy Policy outlines how we collect, store, process, transfer, disclose, and safeguard personal information when you download, register, access, or interact with ShadowHunt.

This Privacy Policy is published in strict compliance with:

1. The Digital Personal Data Protection Act, 2023 (DPDPA);
2. The Information Technology Act, 2000 (as amended);
3. The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules);
4. The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021; and
5. Other applicable laws, rules, and regulatory directives of the Republic of India.

By downloading, installing, accessing, or using ShadowHunt, you unequivocally consent to the collection, processing, and handling of your information as detailed in this policy. If you do not agree with any part of this policy, you must immediately uninstall and cease using the Application.

2. Information We Collect

ShadowHunt requires certain data categories to provide real-world social deduction gameplay, matchmaking, radar tracking, and game balance.

A. Information you voluntarily provide

• Account & profile data: display name, username, email address, profile avatar, and credentials when you authenticate via Google Sign-In or other Supabase authentication providers.
• Communications: feedback, customer support inquiries, bug submissions, or correspondence sent to [email protected].

B. Real-time geolocation data (critical gameplay data)

• Precise location (GPS & compass): to facilitate gameplay (e.g., proximity alerts, manhunt boundaries, hunter-runner radar, and game zones), the App collects precise real-time geographic coordinates (latitude, longitude, altitude, bearing, heading, speed) while active or operating in game sessions.
• Background location (if enabled): when actively participating in an ongoing game room, location tracking may operate in background mode to calculate distance, capture zones, and proximity to other players. Location processing stops when you exit or terminate the game session.

C. Sensor, hardware & wireless signal data

• Bluetooth Low Energy (BLE) & peripheral data: signals broadcast or scanned (RSSI signal strength, device peripheral identifiers) to verify physical proximity among players without exposing exact GPS positions.
• Near Field Communication (NFC): interacting with optional physical NFC game tags or checkpoints during live game matches.
• Sensors: accelerometer, gyroscope, and magnetometer (compass) readings to determine player heading and movement dynamics.

D. Device & technical log data

• Device identifiers: hardware model, OS version (Android / iOS), unique device identifiers (UUID), IP address, network carrier, and locale.
• App performance & crash logs: crash metrics, latency, memory consumption, and database query telemetry.

3. Legal Basis & Purpose of Processing (DPDPA 2023)

Under the Digital Personal Data Protection Act, 2023 (DPDPA) and Indian law, we process personal data under the lawful grounds of Consent and Legitimate Uses:

Purpose of processing	Data categories used	Lawful basis
Account creation & authentication	Email, name, auth tokens	User consent / contractual necessity
Real-time gameplay & radar	GPS coordinates, compass, BLE signals, NFC	User consent / real-time gameplay delivery
Player matchmaking & lobby management	Username, player ID, room ID, game stats	Legitimate operational gameplay interest
Anti-cheat, fair play & abuse prevention	Hardware UUID, location velocity checks, logs	Legitimate interest & legal compliance
Security, crash reporting & performance	Device specs, crash logs, diagnostics	Legitimate technical maintenance
Grievance redressal & support	Email communications, ticket history	Compliance with Indian statutory laws

We do not sell, rent, monetize, or broker your personal information or real-time location data to third-party data brokers or advertisers.

4. Sharing & Disclosure of Information

We share data only under strictly limited circumstances:

1. With other players (in-game dynamics): during active game rooms, your display name, avatar, and relative proximity indicators (such as ping range, compass direction, or boundary alerts depending on your role) will be made visible to other room participants as dictated by the game rules. Your raw personal identifiers (e.g., email address) are never broadcast to other players.
2. Third-party infrastructure & service providers: Supabase Inc. (cloud database, realtime websockets, authentication, backend infrastructure); map tile providers (e.g., OpenStreetMap / Stadia / Mapbox); Google Identity Services (secure federated sign-in). All service providers are bound by strict data protection agreements and confidentiality obligations.
3. Legal compliance & law enforcement: we may disclose your information if required under Indian law, court summons, warrants, or orders from competent law enforcement agencies, cyber cells, or statutory bodies having legal jurisdiction.
4. Safety & protection: where necessary to investigate or prevent illegal acts, threats to personal safety, violations of public order, or breaches of our Terms of Service.

5. Data Retention & Security Measures

1. Retention periods: ephemeral gameplay data — real-time location coordinates, BLE proximity pings, and transient game state variables — are purged or converted into anonymized post-match aggregate statistics shortly after game conclusion. Account information is maintained as long as your account remains active or until you request account deletion.
2. Reasonable security practices (Rule 8, SPDI Rules 2011): we implement industry-standard encryption (TLS/HTTPS in transit, AES-256 at rest). Strict access control, token-based authentication, and Row-Level Security (RLS) policies are enforced across all database queries. However, no method of transmission over the Internet or electronic storage is 100% impenetrable — we cannot warrant absolute, breach-proof security.

6. Your Rights as a Data Principal (DPDPA 2023)

• Right to access & summary: request a summary of personal data being processed about you and identities of data fiduciaries/processors.
• Right to correction & erasure: request rectification of inaccurate data, completion of incomplete data, or complete erasure when no longer necessary for the purpose it was gathered.
• Right of grievance redressal: access our grievance redressal mechanism for complaints about our data handling practices.
• Right to nominate: nominate another individual to exercise your rights in the event of death or incapacity.
• Withdrawal of consent: withdraw location or Bluetooth permissions at any time via your device settings, or request account deletion. Withdrawing essential permissions will make it impossible to participate in active game rounds.

To exercise any of these rights, email us at [email protected] with the subject line "Data Principal Rights Request".

7. Protection of Minors & Age Restriction

ShadowHunt involves physical real-world navigation and is intended for individuals who are at least 18 years of age (or the age of majority in your jurisdiction). In accordance with Section 9 of the DPDPA 2023:

• We do not knowingly collect, track, or process personal data of children under 18 without verifiable parental consent.
• We do not engage in behavioral monitoring, targeted tracking, or profiling directed at minors.
• If we become aware that an account belongs to a minor without parental authorization, we will immediately terminate the account and purge all associated personal records.

8. Grievance Officer & Redressal Mechanism

Pursuant to Rule 5(9) of the SPDI Rules, 2011, Rule 3(2) of the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the DPDPA 2023:

• Designation: Grievance Officer — ShadowHunt
• Operational base: Pune, Maharashtra, India
• Official grievance email: [email protected]
• Response timelines: complaints acknowledged within 24–48 hours, resolved within 15 business days.

9. Amendments & Notifications

We reserve the right to revise this Privacy Policy to reflect statutory amendments, regulatory guidelines, or gameplay evolutions. When updated, the "Last updated" date above will be revised. Continued use of ShadowHunt following any modification constitutes deemed acceptance of the revised policy.

10. Contact Us

For questions, legal notices, privacy concerns, or data requests:

ShadowHunt Operations
Pune, Maharashtra, India
Email: [email protected]

---

Terms & Conditions →