This Notice explains what CarHunt GO processes, why, who receives it, how long it is kept and the controls available to you. It is a notice, not a blanket consent checkbox. Optional choices are requested separately for their specific purposes.
1. Data and purposes
| Processing | Purpose | Legal basis |
|---|---|---|
| Account, authentication and core game state | provide the Service and requested account features | contract or steps requested before contract |
| User Catch and privacy-sanitised source | recognise the vehicle and create the requested card | contract for the submitting user; the separate AI product grant remains a feature gate |
| Incidental faces, plates and background | transient sanitisation and safe operation | legitimate interests in providing the requested camera-to-card service while reducing effects on others |
| App integrity, security, liveness, duplicate and fraud checks | protect users, the Service and game economy | legitimate interests; legal obligation where applicable |
| Optional Catch location | provide requested city/coarse-area context | consent where relied upon |
| Public profile and per-card Share | perform the user's explicit publication request | contract/request and legitimate interests in safe publication |
| Product analytics | optional product measurement | consent |
| Scrubbed diagnostics | reliability and security | legitimate interests |
| Payments and subscriptions | purchase, entitlement, accounting, refund, chargeback and fraud handling | contract, legal obligation and legitimate interests as applicable |
| Support, complaints and legal evidence | answer requests, moderate content and establish or defend rights | legitimate interests and legal obligation as applicable |
The AI product grant is not consent on behalf of a person incidentally visible in a Catch. Our separate legitimate-interests assessment records why transient sanitisation of that incidental material is necessary and proportionate.
2. Account, eligibility and gameplay
We process an account identifier, authentication records, nickname, selected home country/city, owned cards, collections, game resources, matches, versioned results and security records. Supabase provides authentication, database and private storage; Railway hosts the first-party Recognition/API service; Cloudflare provides application delivery, R2 storage and publication delivery.
Protected Catch operations also use the separate integrity_security purpose. Web sends a single-use risk token to Cloudflare Turnstile verification; iOS uses Apple App Attest; Android uses Google Play Integrity. These providers process the browser, app, device and request-integrity signals described in the exact recipient manifest. Provider proofs are verified transiently and are not stored by CarHunt GO. They never receive a Catch photo through this purpose.
The Service is for adults aged 18 or over. We store an 18+ age-band result, policy version, method and server time, not an exact birth date by default.
3. Photos and AI processing
ai_frame_processing is off by default. Before a camera frame leaves the device, the app shows the current disclosure and recipients and asks for the specific product grant. Camera operating-system permission follows that grant. A short-lived server capability is derived from current durable evidence.
For an authorised Catch, selected camera bytes reach the first-party API. Before external AI transfer, the pipeline removes EXIF, detects and blurs faces and number plates, encodes a privacy-sanitised metadata-free WebP and fails closed if required privacy detectors are unavailable. Google Gemini receives that WebP plus a vehicle-identification prompt. OpenAI Images receives the same WebP as the first artwork reference, together with vehicle descriptors, the card-art prompt and non-player style references. OpenAI does not receive the unsanitised player frame. There is no Anthropic or fal.ai recognition fallback.
Blur reduces identifiability but no detector is perfect; distinctive vehicles, missed faces or plates and background details may remain. We do not recognise people, use the frame for surveillance or persist exact location. The resulting collectible artwork may contain inaccurate visual details. When you publish a card, CarHunt GO creates labelled public page, image, OG and Story derivatives. Provider provenance metadata is preserved where the provider supplies it and the current pipeline can retain it; we do not promise that such metadata is always present.
Raw frames remain transient unless bounded private retry/quarantine is strictly required. A sanitised source may remain in private temporary media only while a Catch, review or artwork operation is unfinished. Generated cards remain if AI processing is later withdrawn. Withdrawal stops admission of new frames, prevents new capabilities, cancels uncommitted queued work and schedules temporary-media deletion; completed provider transmissions cannot be recalled.
4. Location
location_context is off by default and separate from AI. If requested, exact coordinates may exist briefly inside the device/first-party projection boundary solely to determine an allowed city or coarse area. Exact coordinates are not persisted, logged, sent to analytics or placed in a third-party client URL. Durable data is limited to approved city identifiers and coarse geohash where needed for game integrity. Withdrawal stops new reads and clears transient location state. Catch works without location.
5. Public profile, social and Share
Accounts are private by default. Player-profile visibility, anonymous Web visibility, public Garage, selected-city display, Rankings, followers and invite permissions are distinct controls. Withdrawal is enforced on the next server read and advances a privacy revision used by caches. Blocks, deletion and moderation override visibility choices.
Each Share is a separate affirmative action tied to the exact card variant, owner, disclosure, token, version and derivative hash. It does not make the profile or Garage public. Anyone with the link may view or reshare it while active. You can revoke one or all publications. Revoked, moderated, deleted or transferred cards fail closed; page, image, OG and Story variants are deleted or version-invalidated and public-cache purge is a bounded secondary action.
Reports use the existing Helpdesk/privacy process. We store the exact publication, category, explanation, case state, decision/reason, appeal and actions taken. Contact details are minimised and protected. Urgent privacy disablement may occur before a final decision.
6. Analytics, diagnostics and push
product_analytics and push_alerts are separate, off-by-default choices. PostHog EU receives optional low-cardinality pseudonymous events when enabled. Sentry may receive scrubbed technical diagnostics under our reliability and security interests. Photos, exact coordinates, email, bearer tokens and free-text personal data are excluded from those event contracts. Push withdrawal unsubscribes and deletes the endpoint.
Integrity receipts contain only a SHA-256 digest, operation/account-generation binding, exact deployment audience, authority type and expiry. Modern Apple proofs may also supply a provider-authenticated validation category and bundle version. A bounded older-iOS lane still verifies App Attest cryptography and is restricted by an exact server build list and UTC deadline; it does not treat a client platform header or build label as authority.
7. Purchases and subscriptions
The separate commerce integrations may provide CarHunt GO with the billing channel (Stripe, Apple or Google), offer/product identifier, order or transaction reference, subscription state and expiry/renewal status, refund/revocation or chargeback state, and price/currency/tax summary where the provider supplies it. We use this information to fulfil the purchase, maintain server-authoritative entitlement, reconcile provider events, provide support, prevent fraud and meet accounting or legal obligations.
Stripe processes Web payment details. Apple processes iOS In-App Purchases. Google processes Android Play Billing purchases. CarHunt GO does not receive or store full payment-card credentials. These recipients form a separate payment_processing purpose and do not change the recipient/data/purpose of ai_frame_processing.
This legal release does not itself enable a payment integration. Each payment recipient becomes active only when its separately implemented channel is used; the completed integration and store declarations must be rechecked against the data fields above before public sale.
Payment and entitlement records are retained for the account or subscription lifetime and then for the applicable accounting, tax, dispute and fraud period. Support or withdrawal records follow the case retention period. Provider-side records follow the provider's own legal role and terms.
8. Recipients and international transfers
The versioned recipient-manifest.json lists current recipients, roles, purposes, data and general region. It includes Supabase, Railway, Cloudflare, Google Gemini, OpenAI Images, Sentry, Cloudflare Turnstile, Apple App Attest, Google Play Integrity and—only when enabled—PostHog and platform push, plus the applicable identity and payment providers.
Where a processor transfers data outside the EEA, the operator relies on the applicable data-processing terms, Standard Contractual Clauses, adequacy decision or other valid mechanism. Google Gemini and OpenAI Images process the privacy-sanitised WebP under their applicable API/business terms and DPA. Their retention and abuse-monitoring controls are separate from CarHunt GO deletion. A recipient or purpose expansion produces a new scoped record; an older receipt does not silently authorise it.
9. Retention
- raw frames: request lifetime; necessary private quarantine has a hard 72-hour ceiling and earlier terminal cleanup;
- sanitised temporary media: unfinished operation only, cleanup target under 36 hours after eligibility;
- external AI copies/logs: applicable paid API contract, DPA, abuse-monitoring and eligible project settings;
- exact coordinates: never persisted;
- account/gameplay data: account lifetime, subject to deletion and narrow legal exceptions;
- recognition/security audit: 90 days unless a bounded incident hold applies;
- raw Turnstile, App Attest and Play Integrity proofs: verification-request lifetime only and never persisted by CarHunt GO;
- audience-bound integrity receipt: at most 10 minutes; verified device metadata: until device retirement or account deletion;
- optional analytics: 90 days and stopped/reset on withdrawal;
- scrubbed diagnostics: 30 days unless a bounded security hold applies;
- active publications: until revoke, deletion/transfer or moderation; cache invalidation target no more than 60 seconds;
- payment/accounting records: applicable statutory, chargeback and limitation period, reviewed and erased when no longer required;
- Terms/purpose evidence: bounded legal-defence need, reviewed at six years;
- support/complaint records: case lifetime plus documented limitation period.
No category is retained indefinitely by default. A legal hold records scope, owner, reason and expiry and does not retain unrelated media.
10. Your controls and rights
Settings provides purpose controls, active Shares, export and account deletion. Deletion removes or anonymises the account, public projections, publications, social state and temporary media through an idempotent coordinator. Deleting an account may not cancel an Apple or Google subscription; the deletion screen directs an active store subscriber to the original store while still permitting account deletion.
Depending on applicable law, you may request access, correction, erasure, restriction, portability, or object, and may withdraw consent where processing is based on consent. Withdrawal does not affect earlier lawful processing. Contact legal@carhuntgo.com. We aim to respond within one month. You may complain to the Cyprus Commissioner for Personal Data Protection or another competent authority.
11. Known-underage cases
An under-18 declaration cannot proceed. A credible report opens a minimised Helpdesk/privacy case and may disable sessions, uploads and publications during review. A confirmed case uses the existing account-deletion flow, subject only to narrow legal-evidence retention. We do not offer parental consent and do not request documents or biometric verification by default.
12. Automated processing and security
Automated vehicle identification, provider-backed app integrity, quality/liveness checks, duplicate detection and abuse signals can reject or hold a Catch or restrict abusive behaviour. They affect gameplay, not legal or similarly significant interests. Ask for review at legal@carhuntgo.com.
Access is protected through authentication, row-level security, exact-purpose server functions, private storage and encryption in transit. No system is perfectly secure; report vulnerabilities responsibly to the contact above.
13. Changes
This Notice is versioned and hashed. A Notice update is disclosed and recorded, not represented as blanket consent. A changed purpose or recipient set may require a new grant only for that affected purpose. Material Terms changes are handled separately through exact Terms reacceptance.