Privacy Policy

Roadblocked (“we”, “us”, or the “Service”) is a platform for creating and running real-time group scavenger hunts. This Privacy Policy explains what personal data we process and why. Roadblocked can be self-hosted: if you use an instance operated by another organization, that organization is the data controller and this policy serves as a template it may adapt. For the instance at roadblocked.com, the data controller (register holder) is Elias Kurki. Questions about this policy can be sent to elias.kurki@hotmail.com.

Data we process

• Administrator accounts. Your email address and a securely hashed password.
• Games and groups. Game titles, tasks, group names, and the magic-link tokens you create.
• Submissions. Photos, videos, and text answers that players upload to complete tasks.
• Location data. While the play page is open during an active game, the Service reads your device’s GPS position and updates it periodically so that organizers can see, on a live map, where groups are moving. Your position is also recorded when you make a submission, to verify that you were on site for location-based tasks. This location data is linked only to an anonymous group and a randomly generated device identifier — it is never connected to your name or any other personal identifier, and no attempt is made to identify who is carrying the device. Tracking requires your browser’s location permission and stops as soon as you close the play page.
• Cookies. A session cookie for signed-in administrators, and a signed token cookie (“rb_group”) that identifies a player’s group after a magic link is opened. These cookies are strictly necessary for the Service to function.
• Technical and usage data. We may log page views, request paths, HTTP response codes, timestamps, and similar diagnostic information to operate, secure, and improve the Service.

How we use data

• To provide and operate games, including grading, geofencing, and leaderboards.
• To show organizers a live map of where groups are moving during an active game.
• To authenticate administrators and identify player groups.
• To maintain security, prevent abuse, and diagnose problems.
• To produce aggregate statistics about how games are used.

Legal basis (GDPR)

Where the EU General Data Protection Regulation applies, we process personal data on the basis of performance of a contract and our legitimate interest in providing the Service you request. Access to your device’s location relies on your consent: your browser asks for permission before any GPS data is read, and you may decline.

Maps and third parties

The player map is rendered using OpenStreetMap. When your device loads map tiles, your IP address is sent to the OpenStreetMap tile servers, subject to the OpenStreetMap Foundation’s privacy policy. Apart from map tiles, a self-hosted instance does not send your data to third-party services by default.

Data retention

Personal data is retained for as long as the related game and account exist, or as required by law, and is deleted or anonymized when it is no longer needed. Location history and submissions are deleted together with the group or game they belong to. Administrators can delete games, groups, and submissions.

Your rights

Subject to applicable law, you have the right to access, correct, erase, restrict, or object to the processing of your personal data, and the right to data portability and to withdraw consent. You may also lodge a complaint with a supervisory authority — in Finland, the Office of the Data Protection Ombudsman. To exercise your rights, contact elias.kurki@hotmail.com.

Children

Scavenger hunts are often run for schools and youth groups. Where players are minors, games should be organized and supervised by a responsible adult — such as a teacher, group leader, or guardian — who is responsible for obtaining any consents required by law.

Security

Passwords are stored only as salted hashes, and administrative functions require authentication. We apply reasonable technical and organizational measures to protect personal data, though no method of transmission or storage is completely secure.

Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date above reflects the most recent version.