Privacy for families
Privacy policy
The app is designed for children, so it collects as little as possible. A grown-up should help with accounts, camera permission and privacy choices.
Last updated 1 September 2026
We do not retain treasure photos in Sophie’s app or backend. A submitted image is sent transiently through Vercel AI Gateway to the selected model provider for the visual check, then discarded by our app and backend. Provider processing and security records are governed by their current policies and contracts, so we do not claim that every provider retains nothing. We do not collect location, contacts or advertising IDs. Community has mutual exact-username friendships, leaderboards and invitation-only shared games, but no chat, shared photos or public personal details.
Who holds the information
Lightning Developments Limited, Tauranga, New Zealand, operates Sophie's Treasure Hunt and is the agency responsible for the information described here.
Questions, access requests or complaints can be sent through the support page.
What we collect and why
Private account
A chosen username, password-managed sign-in, and a grown-up recovery email let the account work across devices and be recovered. The recovery email is encrypted separately and is not shown to other players.
Game progress
Challenge, score, completion, skip and entitlement records keep the hunt fair, restore progress and prevent duplicate awards. Unsigned play can remain on the device.
One treasure photo
With camera permission, the app creates one temporary photo and shows it locally so the player can Retake or Check my find. After Check my find, the bounded image is sent transiently through Vercel AI Gateway to the selected model provider. The checker may receive a photo containing people, but it is instructed to ignore people, not identify anyone, not analyze faces and not infer attributes. The app removes temporary copies when each check ends and clears abandoned camera files on the next launch. An operating-system interruption can delay cleanup; no review copy or photo album is created. The backend discards the image after processing.
Optional grown-up email
Family adventure news and an optional monthly leaderboard summary have separate switches that are off by default. A request is recorded only after the grown-up chooses it. Recovery email is not treated as marketing consent, and each optional message includes an unsubscribe route.
Service security
Our hosting services necessarily receive network details such as an IP address. Authenticated family-level monthly usage counts and short-term request limits protect the service from abuse and unexpected costs. They are not used for advertising, profiling or precise-location features.
Private Community
Usernames and server-awarded points appear on the New Zealand leaderboard. Accepted friends are highlighted. Shared games store invitations, common target IDs and coarse completion counts so friends can play the same sequence without exposing photos, chat or location.
Product interactions
We record first-party category and treasure views, choices, starts, completion, skips, photo capture/submit actions, recognition outcome categories, retries and abandonment so we can improve the game. Events include app/runtime version, difficulty, Free or Max entitlement, Surprise Me, a random hunt ID and timestamp. Only the existing pseudonymous account ID is attached on our server. Up to 50 device-only health events record app opens, screen failures and coarse photo-check timing. These contain no error messages or account identity and can be viewed by a grown-up for support. We do not put photos, photo URLs, prompts, AI response text, names, email, location, advertising IDs, faces or personal content in analytics.
What is optional
The camera is optional. Without camera permission, a player can go back or use a skip. Family-news and leaderboard-summary email choices are also optional and off by default. A private player account is required so progress, scores, friendships and shared games stay attached to the correct player.
If required account information is not provided, we cannot create or recover that account. We do not ask a child for a personal email address; the recovery address belongs to a helping grown-up.
What we deliberately do not collect
- No location permission, route history, address book, microphone or advertising identifier.
- No retained hunt photos, photo library, face templates, face recognition, face analysis or identity inference.
- No third-party behavioural analytics, advertising, attribution or child profiling.
- No child-to-child messages, public email addresses or personal child details.
Who processes information for us
Supabase provides private authentication and database services in its Sydney region. Vercel provides the first-party app API and AI Gateway. The Gateway sends the temporary image to the selected Google-hosted or Vertex-hosted Gemini model for the constrained visual check and may use the documented fallback model/provider route when one is unavailable. RevenueCat processes purchase and entitlement information using a private family billing identifier. Resend delivers grown-up password-recovery email and only separately consented family messages.
Sophie’s app and backend do not retain submitted images. Vercel and model providers process the request under their current service, security, abuse-prevention, logging and retention terms. We request routing that disallows prompt training, review provider policies before release and when routing changes, and do not promise that providers keep no operational records.
How long information is kept
- Photo-check request IDs and reviewed outcome codes contain no images. Completed receipts are removed by daily cleanup after seven days; account deletion removes them immediately.
- Treasure photos: temporary app copies are removed after a check or cancellation; abandoned camera files are cleared on the next launch if the app was interrupted. Backend image data is discarded after processing. No Sophie review copy is retained.
- Recovery links: single use and expire after 30 minutes.
- Account, progress and recovery contact: until corrected or the account is deleted.
- Friendships and shared-game progress: until removed, blocked, the game ends, or the account is deleted.
- Monthly photo-check counters and moderation flags: kept with the family account for security, fair-use enforcement and support.
- Product-interaction events: kept with the pseudonymous account until account deletion; owner reports are aggregate and exclude marked test profiles.
- Short request-limit records: held briefly in application memory.
- Service backups: allowed to age out under the provider's protected backup cycle and not used except for disaster recovery.
Access, correction and deletion
A grown-up can export account data, correct the username or recovery email, and permanently delete the account from the grown-up area. A public deletion route is also available on the account deletion page.
New Zealand privacy law may also give you rights to ask for access or correction and to complain to the Office of the Privacy Commissioner.
Safety and changes
Photos may contain people, but the referee is constrained to judge only the treasure and to ignore people without identifying them, analyzing faces or inferring attributes. Players should still avoid readable names, screens, house numbers and vehicle plates. If image preparation fails, the image is not sent and the app asks for another photo.
We will show the updated date here when this policy changes. A material change to child data use requires a fresh safety and privacy review before release.