Privacy policy
What we store
- Nickname and district you choose when you join. Both are shown on the public leaderboard.
- Your score, landmarks visited and recent pickups, so points count once and items respawn fairly.
- A random player token, kept in your browser's local storage and stored on our server only as a one-way hash. It lets you continue on the same device without an account.
- If you create an account (optional): your username, email address and password. The password is stored only as a salted one-way hash, never as the password itself. We also keep when you verified the email, how many times and when you last signed in, and the IP addresses you signed up and last signed in from, which are cleared 30 days after you last sign in. The email is used only to send you sign-in and password-reset codes.
- If you choose Google sign-in: we receive your Google account identifier, verified email address and profile name to create or resume your game account. We do not request Gmail, Drive or YouTube access. Your public nickname is set from the part of your address before the @ — never the whole address, which is not shown to other players. You can change the nickname at any time in Settings. A short-lived security cookie verifies the sign-in attempt.
- One welcome email when an account is first created. It is not a mailing list, there is nothing to unsubscribe from, and we do not send anything else except the sign-in and password-reset codes you ask for.
- Waiting room: a random per-tab ticket and a hashed network address reserve your place. Inactive reservations expire after 75 seconds; abandoned waiting tickets expire after two minutes and are removed on the next queue request.
- Your IP address, kept for 30 days after you last play so we can deal with cheating, spam and abuse, and then cleared automatically. A separate daily-rotating hash of it is used to rate limit new players.
- Feedback text, if you choose to send it.
- Chat messages you send, with your nickname and district, for up to 30 minutes so other players can read them. After that they are deleted from our server.
- Anything you send through the feedback, help or advertising forms. These ask for an email address so we can reply, and offer a phone number if you would rather we called; the phone number is never required.
- Your star rating, if you give one, with the comment, the email address you leave with it and a phone number if you choose to add one. Closing the rating card without rating asks for nothing at all.
- A notification address, if you turn notifications on: the address your browser gives us to reach it, and two keys that let only your browser read what we send. It is not tied to your name or your email, it is deleted the moment you switch notifications off or remove the game, and we never use it for advertising.
- Where you are standing in the game, while you are playing, so other players can see you nearby and on the in-game map, and can walk over to you. Settings → "Show me on the map" → "My team only" takes you off everyone's map except your treasure-hunt team's. It is overwritten every couple of seconds and is not a real-world location.
You can play without an account. We never ask for your real name or your location. A phone number is always optional. An email address is asked for only where we would otherwise have no way to answer you: creating an account, sending feedback, or leaving a rating. Please do not put personal details in your nickname or feedback.
Your browser
The game saves your settings, position and token in your browser's local storage. Clearing site data removes them; your points stay with the district you played for.
Visits, devices and approximate location
Each time you start the game we note, against your player: your IP address (cleared after 30 days), the approximate city, state and country that address belongs to (worked out on our own server with the DB-IP Lite database; nothing is sent to anyone for this), whether you use a phone, tablet or computer, its operating system and browser, your screen size, and the site or shared link that brought you. We use this to see where the game is played and to keep the server healthy. We cannot see, and do not collect, your precise location or your device's hardware (MAC) address.
Keeping chat friendly
Chat and conversation messages are checked against a list of abusive words in English, Tamil, Malayalam and other languages. A message that uses one is not shown and is kept for moderation. The first time you get a warning; after that your play is suspended for 15 minutes, then 30, and longer each time. Strikes are forgotten after 30 days.
Analytics
We use Google Analytics to count visits and see which parts of the game people use: pages loaded, the district chosen, places visited, ratings given and which app the game was shared to. It uses cookies and receives your IP address, which Google shortens before storing. Nicknames, email addresses and chat are never sent to it. You can block it with Google's opt-out add-on.
Advertising
This site shows ads from Google AdSense. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this and other websites. Google's use of advertising cookies enables it and its partners to serve ads based on your visits to this site and other sites on the internet.
You can opt out of personalised advertising in Google Ads Settings, or learn more at aboutads.info and in how Google uses information from sites that use its services.
Talking to other players
You can send public chat messages, and you can ask another player nearby for a conversation — either written, or out loud with your microphone. Nothing starts without both people agreeing to it.
Voice goes directly between the two browsers using WebRTC. We never receive, listen to, record or store any audio. Our server only passes the short technical messages the two browsers need to find each other, and deletes them within a minute. Your microphone is only switched on after your browser asks you and you allow it, and you can mute or leave at any time.
Chat and voice are not moderated in real time. Messages are filtered against a word list and rate limited, and we can ban a nickname if it is reported. Please do not share personal details, and tell us through the feedback form if somebody behaves badly.
Notifications
Notifications are off unless you ask for them, and you are only asked once, after you have played for a while. Saying yes lets us send you a handful of messages a month about new places and the month's district winner — never advertising, and never anything from anyone else. Switch them off in Settings or in your browser at any time and the address we send to is deleted. The messages are encrypted for your browser alone: the push service that carries them cannot read them.
Children
The game can be played without an account and asks for no personal details, but it does have chat and voice with strangers. An account needs an email address. Children should play with a parent's permission, should not use their real name as a nickname, and should not share anything personal in chat or out loud.
Moderation
The game's owner can see who is playing, what was said in public chat, and the messages sent through the forms, and can warn, suspend, ban or delete a player. If you are deleted, your scores, chat and messages go with you. Voice is never recorded, so there is nothing to review afterwards.
Retention and removal
Game records are kept while the game runs. To ask us to remove or rename a player or delete an account, contact NestMedia with the nickname and district, or the account username, through nestmedia.in/contact.
Credits
Map data © OpenStreetMap contributors, available under the Open Database License. Tamil landmark names follow Tamil Wikipedia. Font: Baloo Thambi 2, SIL Open Font License.