Privacy Policy — Hive n' Seek

Effective Date: April 17, 2026  |  Last Updated: April 17, 2026

This Privacy Policy describes how the Hive n' Seek mobile application ("the App", "we", "our", "us") handles information you provide or that is automatically collected when you use the App. Hive n' Seek is a real-time, multiplayer hide-and-seek game for iOS that uses Apple's Nearby Interaction (ultra-wideband) framework and GPS to measure distance between players.

By installing or using the App you agree to the practices described below. If you do not agree, please stop using the App and delete it from your device.

1. Information We Collect

1.1 Information You Provide

• Display name (nickname) — a short text label, up to 12 characters, that you choose in the App. It is shown to other players in the same game room.
• Avatar selection — a numeric index identifying one of the in-app avatar images you select.
• Room code — an 8-digit code you enter to join a friend's game. The host does not enter anything; the App generates the code automatically.

We do not ask for, and do not collect, your real name, email address, phone number, date of birth, address, or any other contact information.

1.2 Information Generated by the App

• Device player ID — a random UUID generated the first time you open the App and stored locally on your device. It is included with every request to our backend so that game rooms and scores can be associated with the correct player during a session. It is not Apple's IDFA or IDFV and it contains no device-identifying information. It is reset if you delete and reinstall the App.

1.3 Information Collected While You Play

• Precise location (GPS) — when you are the "hider" in a round, your device obtains one precise location at the start of the round, and when you are a "seeker" the App reads your location continuously so the distance to the hider can be estimated when the two of you are out of ultra-wideband range. Location is broadcast only to players in the same game room through a short-lived real-time channel and is not written to any database. The channel closes as soon as the round ends.
• Nearby Interaction discovery tokens — cryptographic tokens generated by Apple's Nearby Interaction framework. They are exchanged through our backend so that two phones can perform ultra-wideband ranging with each other. These tokens are valid for a single session only and cannot be used to identify you outside the App.
• Ultra-wideband distance and direction — measured on-device using Apple's Nearby Interaction APIs. These values are used for in-game UI only and are not transmitted to our servers.
• Game events — each round records events such as game started, time up, queen found, new round, and session ended, along with the room ID, round number, and the player ID of the actor where relevant.
• Round scores — when a round ends, the App records the time it took to find the hider (or the time the hider remained hidden), the round number, the player ID, and the display name that was used.
• Online presence — a flag indicating whether you are currently connected to a room, so disconnections and host transfers can be handled gracefully.
• IP address — processed server-side for rate limiting and abuse prevention.

We do not access or collect: camera, microphone, photos, contacts, calendar, reminders, health or fitness data, Bluetooth (beyond Apple's Nearby Interaction framework), motion data, HomeKit, SiriKit, speech recognition, or any advertising identifier.

2. How We Use the Information

We use the data listed above solely to operate the game:

• Match you with other players who enter the same room code.
• Display your nickname and avatar to other players in the same room.
• Measure distance between you and other players using ultra-wideband or, when out of ultra-wideband range, GPS.
• Run the countdown, hiding, and seeking phases of each round in sync across every player's device.
• Record scores and display the round-end leaderboard.
• Handle reconnections and host transfer when a player's network drops.

We do not use your data for advertising, profiling, behavioral analytics, recommendations, or any automated decision making.

3. Third-Party Services

The App communicates with a single backend provider:

Supabase (operated by Supabase, Inc.) — provides the database, real-time channels, and edge functions used by the App. The information described in Section 1.2 and 1.3 (except raw GPS coordinates, which are ephemeral) is transmitted to and stored on Supabase infrastructure. Supabase's privacy practices are described in their own policy: https://supabase.com/privacy.

Rate limiting is implemented using both Upstash Redis and a Postgres-based fallback mechanism. Both systems temporarily store IP-address-derived identifiers and request counts in short-lived buckets (typically per-minute) to prevent abuse such as excessive room join attempts. Data is automatically expired or periodically deleted and is not used for profiling, analytics, or advertising. Upstash's privacy practices are described here: https://upstash.com/privacy.

The App does not use any of the following: advertising networks, analytics SDKs, crash-reporting services, social-network SDKs, payment processors, or content-delivery networks that collect personal data.

4. Where Data Is Processed

Supabase operates servers in multiple regions, which may include the United States and the European Union. By using the App you acknowledge that your information may be transferred to, stored in, and processed in countries other than your country of residence, and that those countries may have data-protection rules different from your own.

5. Data Retention and Deletion

• Local device data — the onboarding flag, player ID, nickname, and avatar index are stored in iOS UserDefaults on your device. They are removed automatically when you delete the App.
• Real-time GPS broadcasts — never written to any database. Coordinates are transmitted only on a short-lived real-time channel while a round is active, delivered to the other players in the same room, and discarded the moment the round ends.
• Server-side game data — rooms, players, game events, round scores, Nearby Interaction session tokens and online-presence flags are deleted within 2 hours of the end of the game.

IP addresses and IP-derived identifiers (used for rate limiting) are temporarily stored in Redis and Postgres rate limiting systems for abuse prevention and are automatically expired or periodically deleted.

We do not build or retain any long-term user profile tied to you.

6. Your Choices and Rights

• Location permission — you can deny or revoke the location permission at any time in iOS Settings → Privacy & Security → Location Services → Hive n' Seek. Without location access, distance estimation works only within ultra-wideband range (typically a few meters).
• Nearby Interaction permission — can be revoked in iOS Settings → Privacy & Security → Nearby Interactions → Hive n' Seek. Without it, the App cannot measure distance between devices and gameplay is not possible.
• Delete your local data — delete the App from your device.
• Delete your server-side data — contact us as described in Section 8.

Depending on where you live (e.g., the European Economic Area, United Kingdom, California, Brazil), you may have additional rights to access, correct, port, restrict, or object to processing of your personal data. You can exercise these rights by contacting us.

7. Children's Privacy

Hive n' Seek is a general-audience game. We do not knowingly collect personal information from children under the age of 13 (or the applicable age of digital consent in your jurisdiction). The App does not request any personal information at sign-up — there is no email, no account, and no password. The only user-entered text is a short nickname, which the player chooses. If you believe a child has provided identifying information through a nickname and you would like it removed, please contact us and we will delete it.

8. Contact

If you have questions about this policy, want to request deletion of your server-side data, or want to exercise any of the rights listed in Section 6, contact us at:

Email (any of the following reaches the team):

• moraromeropaula@gmail.com
• albertoes02@outlook.com
• yoliscantumacias@gmail.com
• support@salcedoorozco.com

9. Security

All traffic between the App and Supabase is encrypted in transit using TLS (HTTPS for the database REST API, WSS for real-time channels). Nearby Interaction tokens are serialized using Apple's secure coding. The App does not store credentials or passwords and does not accept user-generated content beyond a short display name.

IP addresses may be processed by backend rate limiting systems for abuse prevention.

No method of electronic transmission or storage is completely secure. While we take reasonable measures to protect the information described in this policy, we cannot guarantee absolute security.

10. Changes to This Policy

We may update this policy to reflect changes in the App, in our backend provider, or in applicable law. The "Last Updated" date at the top of this document will reflect the most recent revision. Material changes will be communicated through an in-app notice the next time you open the App. Continued use of the App after changes take effect constitutes acceptance of the revised policy.

Appendix A — App Store Privacy Details (Nutrition Label)

This mapping follows the official Apple taxonomy documented at https://developer.apple.com/app-store/app-privacy-details/. Every data type collected by Hive n' Seek is used only for the purpose App Functionality. No data is used for tracking, and no data is shared with third parties for advertising, analytics, or marketing.

Under Apple's definition, data is considered Linked to You when it is associated with the user's identity via account, device, or "other details" — including a persistent, device-generated user or account ID. The per-install random player UUID used by Hive n' Seek therefore causes every data type listed below to be declared as Linked to You.

Under Apple's definition of Tracking — "linking data collected from your app about a particular end-user or device with Third-Party Data for targeted advertising or advertising measurement purposes, or sharing data collected from your app about a particular end-user or device with a data broker" — Hive n' Seek does not engage in tracking.

A.1 Summary answer per App Store Connect question

• Does your app collect data from this app? Yes.
• Do you or your third-party partners use data from this app to track users? No.

A.2 Data Types — declared under Apple's taxonomy

The Data Types below are declared as collected, Linked to You, and used only for App Functionality. All others in Apple's taxonomy are not collected by Hive n' Seek.

A.3 Data Types NOT collected

Hive n' Seek does not collect any of the following Apple Data Types:

• Contact Info: Name, Email Address, Phone Number, Physical Address, Other User Contact Info.
• Health & Fitness: Health, Fitness.
• Financial Info: Payment Info, Credit Info, Other Financial Info.
• Location: Coarse Location (we collect Precise Location only).
• Sensitive Info.
• Contacts.
• User Content: Emails or Text Messages, Photos or Videos, Audio Data, Customer Support, Other User Content.
• Browsing History: Browsing History, Search History.
• Identifiers: Device ID (we do not access IDFA or IDFV).
• Purchases: Purchase History.
• Usage Data: Advertising Data, Other Usage Data.
• Diagnostics: Crash Data, Performance Data, Other Diagnostic Data.
• Surroundings: Environment Scanning.
• Body: Hands, Head.
• Other Data Types.

A.4 App Store Connect questionnaire — short answers

• Privacy Choices URL: Not applicable (optional). Deletion requests can be sent to the contact address in Section 8.
• Data Used to Track You: None.
• Data Linked to You: User ID, Precise Location, Gameplay Content, Product Interaction.
• Data Not Linked to You: None.

Appendix B — Privacy Manifest and Required Reason APIs

As of May 1, 2024 Apple requires third-party SDKs bundled with the app and, in some cases, the app itself to include a Privacy Manifest file (PrivacyInfo.xcprivacy) describing the Data Types collected and the reason for calling any Required Reason APIs (for example, UserDefaults and file-timestamp APIs).

For the App Store submission of Hive n' Seek:

1. The app accesses UserDefaults to store the onboarding flag, player ID, nickname, and avatar index — a Required Reason API. The reason code to declare is CA92.1 ("Access info from same app, per documentation").
2. The Supabase Swift SDK is responsible for shipping its own Privacy Manifest. Verify that the version pinned in Package.resolved includes a PrivacyInfo.xcprivacy at the SDK root; if not, upgrade to a version that does before submitting.
3. The NSLocationWhenInUseUsageDescription and NSNearbyInteractionUsageDescription strings in Info.plist already cover the user-facing prompts for location and Nearby Interaction.