Privacy notice

This notice explains how the Street Discovery game (https://streetdiscovery.app) handles data: what data we process, why, for how long and with whom, and how you can use your rights. Effective: November 3, 2026

Who is the controller?

Deli Norbert, a private individual. Contact and data requests: delinorbert2@gmail.com

What data do we process, and why?

• Account data: your e-mail address, how you sign in (Google or e-mail and password) and when the account was created and last used. If you sign in with Google, Google passes on your name and e-mail address. Your password is stored only in encrypted (hashed) form by our sign-in provider, we cannot see it. Purpose: identification, sign-in, protecting your account. Legal basis: providing the service (GDPR Art. 6(1)(b)).
• Profile: your display name, your avatar (emoji and colour), your friend code, your privacy switches and your last online time. Purpose: running the game and the friends feature. Legal basis: providing the service.
• Game progress: the points and trail you explored on the game map, landmarks found, items collected, XP, stamps, postcards (the place in the game, not your real location). Purpose: saving your progress and making it available on several devices. Legal basis: providing the service.
• Rooms and friends: your room membership, room codes, your friend connections and invitations. In a room your companions see your in-game position and progress, which we do not store permanently. Room chat messages are not stored, they only reach the members who are present at that moment. Purpose: playing together. Legal basis: providing the service.
• Usage counters: we count, summed per day and linked to your account, how many maps, panorama images or page loads you started. Purpose: tracking the cost of external providers and detecting faults or abuse. Legal basis: legitimate interest (GDPR Art. 6(1)(f)), justified by cost protection and the stability of the service.
• Performance statistics: only if you allow it in the cookie settings, we collect anonymously (not linked to your account) how long a step takes, how busy the page is, and the screen size, connection type and number of processor cores. Purpose: making the game faster. It does not identify you. Legal basis: your consent (GDPR Art. 6(1)(a)), which you can withdraw at any time in the cookie settings.
• Technical logs: the hosting and database providers may log the connecting IP address and browser details for a short time for security and operation.

Cookies and local storage

We use no advertising or tracking cookies, and we send no data to advertisers. The only optional category is anonymous performance measurement, which is off until you accept it in the cookie banner. You can change your choice at any time with the "Cookie settings" link.

In your browser we store only what is necessary for the game to work: your sign-in (session identifier), a copy of your game progress, your settings (for example your language and turning the tour guide on and off), your cookie choice, and temporarily an invite or room code. These are needed to provide what you asked for, so they do not need separate consent. You can delete them in your browser settings or by deleting your account.

The map and Street View work with the Google Maps service; Google may use data (for example cookies or local storage) for its own operation, see below.

Who do we share data with?

We do not sell data and we do not use it for advertising. The following providers process data on our behalf or to make the service work:

• Supabase (database and sign-in): data is stored in the European Union, in Stockholm (eu-north-1).
• Cloudflare (hosting, domain, network): the website is served through a worldwide distributed network, so related technical data (for example the IP address) may also pass outside the EU, with appropriate safeguards (standard contractual clauses).
• Google (Google Maps JavaScript API, Street View, sign-in with a Google account): when the map and panoramas load, Google receives your IP address and browser details, and when you sign in, Google identifies the sign-in. Google acts as an independent controller: https://policies.google.com/privacy
• The road network and map data come from OpenStreetMap contributors (© OpenStreetMap contributors, ODbL). No data about you is sent to OpenStreetMap when it is used.

How long do we keep the data?

• Account data, the profile, progress and connections are kept until you delete your account. When you delete your account they are deleted immediately and permanently.
• Usage counters linked to your account are kept until the account is deleted.
• Rooms expire after 24 hours. Anonymous performance statistics are not personal data.
• The providers keep their technical logs according to their own rules.

What rights do you have?

• Access and portability: in the game, under Profile → My data, the "Download my data" button gives you all the data stored about you in a JSON file.
• Erasure: in the same place, the "Delete my account and data" button permanently deletes your account and all your data at any time.
• Rectification: your display name and avatar can be changed on the Profile page.
• Restriction and objection: you can object to processing based on legitimate interest (usage counters). In that case, or for any other question, write to the e-mail address above and we will deal with the request within one month of receiving it.
• You can withdraw your consent (where processing is based on it) at any time; this does not affect the lawfulness of earlier processing.
• Complaint: if you feel we have violated your rights, you can turn to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, 1055 Budapest, Falk Miksa utca 9-11., ugyfelszolgalat@naih.hu, www.naih.hu), or to a court.

Children

The game may be used by people who are at least 16 years old. If you are younger than 16, ask your parent or guardian for approval and use it with their help.

Security

The connection is encrypted (HTTPS). In the database we set permissions so that everybody can reach only their own data, and sees other people's data only as the rules of the game allow (for example results that friends have allowed). However, no online service can guarantee complete security.

Changes

If this notice changes in a meaningful way, we publish a new version and you have to accept it again at your next sign-in. The current version can always be read on this page.