Privacy Policy

1. Who we are

ScentSavvy Quest is operated by ScentSavvyDogs. For any privacy question, request or complaint, email info@scentsavvydogs.com.

2. What we collect

We only collect what we need to run the game and keep your progress. Specifically:

• Email address — for the magic-link sign-in and for service messages. We don’t use passwords for player accounts.
• Dog profile — dog name, breed (optional), sex (optional), handler nickname (optional), and a dog photo (optional) you upload from your device, which we store on your behalf. Photos are resized and stripped of embedded metadata — including any GPS location — in your browser before they are uploaded.
• Quest activity — the difficulty you chose, attempt number, whether a hint was used, elapsed time, the result (correct or not), points earned, whether you gave up, and the map coordinate you tapped to log a find.
• Favourite parks — the parks you follow on your profile.
• Account timestamps — when the account was created and last logged in.
• QR scan analytics — for each scan of a park QR we record an event (scan, quest start, successful submission). Visitors are identified only by a one-way SHA-256 hash of IP · user agent · date · server secret, re-salted every day, so the hash cannot identify you and cannot be used to track you across days.
• Session cookies — see “Cookies and storage” below.

3. What we do not collect

We’ve built ScentSavvy Quest to minimise data collection. As of the “last updated” date above:

• We do not continuously track your live GPS location. If you allow the browser to share your location, the live position is shown to you as a blue dot on your own device and is never sent to our servers or stored.
• We do not sell personal information to anyone, for any purpose, ever.
• We do not use third-party advertising trackers (no Google Analytics, no Facebook Pixel, no session replay tools, no behavioural advertising).
• We do not load images from third-party websites. The dog photo you upload is the only image you provide; we resize and store it ourselves and show it only back to you, never on a public page.

4. Why we collect it

We use the information we collect to:

• create and authenticate your account (email);
• run quests, validate finds, calculate points, evaluate badges, and keep your progress across devices (dog profile, quest activity);
• show you parks near you and let you follow parks (favourite parks, optional one-off location lookup);
• detect abuse and prevent cheating, e.g. invalid finds, GPS spoofing, brute-force probes (quest activity, QR analytics, rate limit logs);
• provide support when you contact us (email, support messages);
• comply with legal obligations, including responding to lawful requests.

5. Legal bases for processing (GDPR)

If you are in the EU or UK, we rely on the following lawful bases under the GDPR / UK GDPR:

• Consent — creating an account, enabling optional GPS in your browser, and adding optional content like uploading a dog photo.
• Performance of a contract — running quests you have started, validating finds, calculating points.
• Legitimate interests — security, fraud prevention, abuse detection, and basic service analytics. You can object to processing based on legitimate interests at any time.
• Legal obligation — responding to lawful requests from regulators or courts.

We do not make automated decisions that produce legal or similarly significant effects on you.

6. Location data — exactly what happens

Location is the most sensitive thing the app touches, so here’s the full picture of each location flow:

• Live GPS while you are running a quest. Optional. If you allow it, your browser shows a blue dot on the map so you can see where you are. The position is read by your browser and rendered on your device. It is never sent to our servers and never stored. You can deny or revoke permission at any time in your browser settings.
• “Find parks near me” button. Optional. If you tap it, your browser shares your current coordinates with us as a one-off query (e.g., ?lat=...&lng=...) so we can rank public parks by distance. We do not store this coordinate — it lives only in the HTTP request and the response.
• Map tap when you log a find. When you tap the map to submit a find, the latitude and longitude of the tap are sent to our server to validate the find and are stored against your submission record. This is a point you chose to record, not your real-time GPS location.

7. Children

You must be at least 16 to create your own account. Children under 16 may only use the app under the supervision of a parent or guardian who creates and manages the account on their behalf and accepts these policies for them.

Parents and guardians can email info@scentsavvydogs.com at any time to ask us to access or delete information held about a child in their care.

8. Cookies and storage

The app sets the smallest set of cookies needed to keep you signed in and remember a couple of preferences. None are used for advertising or cross-site tracking.

• ssq_p — signed participant session cookie, 30 days, HTTP-only, SameSite=Lax, Secure in production.
• ssq_a — signed admin session cookie, 8 hours, HTTP-only, SameSite=Lax, Secure in production. Only set for admin users.
• ssq_last_park — remembers the last park you opened so the quest tab returns there, 30 days.
• ssq-theme — stored in your browser’s localStorage to remember your dark/light preference. Never sent to our servers.

9. Third parties and overseas processing

We use a small number of service providers to run the app. Each only receives the information needed to provide their service to us.

• Hosting and serverless platform (e.g. Vercel, United States) — runs the app, handles requests, stores short-term operational logs.
• Database (Neon, hosted in AWS Asia Pacific (Singapore)) — stores your account, dogs (including any dog photo you upload), submissions, and related game data.
• Transactional email (e.g. Resend, United States) — sends your sign-in links and account emails.
• Map tiles — map imagery is loaded from a tile provider. Tile requests are anonymous; we do not pass your account information to the tile provider.
• Payment processor — not currently used.

Because these providers are based in or operate from countries including the United States and Singapore, your information may be processed outside Australia and outside your home country. We rely on the providers’ security and contractual commitments to protect your data overseas.

10. Security

The practical safeguards we use include:

• magic-link authentication for players (no passwords to leak) and argon2id password hashing for admins;
• session cookies signed as JWTs with separate secrets and audiences for player vs admin sessions; HTTP-only, SameSite=Lax, Secure in production;
• single-use SHA-256 token hashes for magic links, admin invites, and admin password resets, with short expiries (15 minutes, 7 days, 60 minutes respectively);
• rate limiting on authentication and park-resolve endpoints to slow credential stuffing and abuse;
• HTTPS everywhere in production;
• server-only loading of secrets and least-privilege admin roles (owner / park admin / viewer);
• an admin audit log for changes to parks, quests, and users.

No system is perfectly secure. If you discover a security issue, please report it privately to info@scentsavvydogs.com.

11. Data retention

We keep your account, dog profiles (including any photo you upload), and quest history for as long as your account is active so the points, streaks and badges keep working. When you delete a dog, its photo is deleted with it. If you ask us to delete your account, we will delete or de-identify your personal information within 30 days of confirming your request, except where we need to keep limited information for legal, security, fraud prevention, or genuine dispute purposes.

QR scan analytics rows are kept in aggregate form and are not linked to identifiable individuals.

12. Your rights

You have the right to ask us to:

• access a copy of the personal information we hold about you;
• correct it if it’s wrong or out of date;
• delete it (subject to the limits in “Data retention” above);
• export your data in a portable format — for submissions we can provide a CSV export;
• restrict or object to certain processing;
• withdraw consent where we rely on consent (this doesn’t affect lawful processing already done).

To exercise any right, email info@scentsavvydogs.com. We may need to verify your identity before acting on a request. We’ll respond within a reasonable time and at most within 30 days.

13. For EU and UK users (GDPR / UK GDPR)

ScentSavvyDogs is the data controller for the personal information we collect through the app. You have all the rights listed above plus the right to lodge a complaint with your local supervisory authority — for example, the Information Commissioner’s Office (ICO) in the UK, or your national data protection authority in the EU.

14. For California users (CCPA / CPRA)

In the past 12 months we have collected the categories of personal information described in “What we collect” above (identifiers, internet/network activity, geolocation that you provide, a dog photo you choose to upload, and inferences drawn from quest play). We collect these for the purposes described in “Why we collect it”.

We do not sell personal information and do not share personal information for cross-context behavioural advertising as those terms are defined under the CCPA / CPRA. We do not offer financial incentives for personal information.

California residents have the right to know, the right to delete, the right to correct, the right to limit use of sensitive personal information, the right to opt out of sale or sharing (not applicable, as we do neither), and the right to non-discrimination. To exercise any of these, email us at info@scentsavvydogs.com. An authorised agent can submit a request on your behalf with proof of authorisation.

15. Other jurisdictions

Where local law in your country or region grants you stronger privacy rights than this policy, those local rights apply.

16. Data breach

We will investigate any suspected breach of personal information, and where the breach is likely to cause serious harm or where we are otherwise required by law to do so, we will notify affected users and the relevant regulator (for example, the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme, or the equivalent authority in your country).

17. Changes to this policy

We may update this policy from time to time. We’ll change the “Last updated” date at the top, and for material changes we’ll signpost the change in-app.

18. Contact

Privacy questions, requests, or complaints — email info@scentsavvydogs.com.