Privacy Policy

Roadblocked (“we”, “us”, or the “Service”) is a platform for creating and running real-time group scavenger hunts. This Privacy Policy explains what personal data we process and why. Roadblocked can be self-hosted: if you use an instance operated by another organization, that organization is the data controller and this policy serves as a template it may adapt. For the instance at roadblocked.com, the data controller (register holder) is Elias Kurki. Questions about this policy can be sent to elias.kurki@hotmail.com.

Data we process

• Administrator accounts. Your email address and a securely hashed password.
• Games and groups. Game titles, tasks, group names, and the magic-link tokens you create.
• Submissions. Photos, videos, and text answers that players upload to complete tasks.
• Location data. While the play page is open during an active game, the Service reads your device’s GPS position and updates it periodically so that organizers can see, on a live map, where groups are moving. Your position is also recorded when you make a submission, to verify that you were on site for location-based tasks. This location data is linked only to an anonymous group and a randomly generated device identifier — it is never connected to your name or any other personal identifier, and no attempt is made to identify who is carrying the device. Tracking requires your browser’s location permission and stops as soon as you close the play page.
• Cookies. A session cookie for signed-in administrators, and a signed token cookie (“rb_group”) that identifies a player’s group after a magic link is opened. These cookies are strictly necessary for the Service to function.
• Technical and usage data. We may log page views, request paths, HTTP response codes, timestamps, and similar diagnostic information to operate, secure, and improve the Service.

How we use data

• To provide and operate games, including grading, geofencing, and leaderboards.
• Where the organizer has switched it on for a task, to have an AI model suggest a grade for the photos and text answers submitted to that task (see below).
• To show organizers a live map of where groups are moving during an active game.
• To authenticate administrators and identify player groups.
• To maintain security, prevent abuse, and diagnose problems.
• To produce aggregate statistics about how games are used.

AI grading suggestions

Organizers can switch on AI checking for individual photo and quiz tasks. For those tasks, each submitted photo or text answer is analyzed by an AI model, which suggests whether the task was completed, with a short reason. Videos are not analyzed. If AI checking is not switched on for a task, its submissions are never analyzed.

• Runs on our own server. The AI model runs on the same server as the Service. Photos and answers are not sent to any external AI provider or other third party, and they are not used to train AI models.
• No identification of people. Photos may show people, but the model only judges whether the photo fits the task. It does not recognize or identify anyone, and no facial or other biometric data is created or stored.
• What is stored. With each analyzed submission we store the AI’s verdict, its confidence, its short reason, timing information, and a technical fingerprint of the photo used to notice when the same picture is submitted more than once. This information is shown only to the game’s organizers and graders, never to players, and it is deleted together with the submission.

Legal basis (GDPR)

Where the EU General Data Protection Regulation applies, we process personal data on the basis of performance of a contract and our legitimate interest in providing the Service you request. Access to your device’s location relies on your consent: your browser asks for permission before any GPS data is read, and you may decline.

Maps and third parties

The player map is rendered using OpenStreetMap. When your device loads map tiles, your IP address is sent to the OpenStreetMap tile servers, subject to the OpenStreetMap Foundation’s privacy policy. Apart from map tiles, a self-hosted instance does not send your data to third-party services by default. This includes AI grading, which runs on the instance’s own server.

Data retention

Personal data is retained for as long as the related game and account exist, or as required by law, and is deleted or anonymized when it is no longer needed. Location history and submissions, including any AI grading results for them, are deleted together with the group or game they belong to. Administrators can delete games, groups, and submissions.

Your rights

Subject to applicable law, you have the right to access, correct, erase, restrict, or object to the processing of your personal data, and the right to data portability and to withdraw consent. You may also lodge a complaint with a supervisory authority — in Finland, the Office of the Data Protection Ombudsman. To exercise your rights, contact elias.kurki@hotmail.com.

Children

Scavenger hunts are often run for schools and youth groups. Where players are minors, games should be organized and supervised by a responsible adult — such as a teacher, group leader, or guardian — who is responsible for obtaining any consents required by law.

Security

Passwords are stored only as salted hashes, and administrative functions require authentication. We apply reasonable technical and organizational measures to protect personal data, though no method of transmission or storage is completely secure.

Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date above reflects the most recent version.