Privacy Policy

Last updated: 2026-10-29

This policy explains what Street Scavenger collects, why, who it's shared with and how long it's kept. Street Scavenger is run by [OPERATOR NAME] ("we", "us"). To play, you sign in with Google or with an email link. Either way, we try to collect as little as possible.

What we collect

Your display name. The name you pick for your account. It isn't checked or reserved, so please don't use your full real name.
Your account, if you sign in with Google. Google gives us only your Google account ID and email address (nothing else: we don't receive or show your Google name or photo). Your account stores those, the display name you choose, the avatar you design (a choice of cartoon parts and colours, not a photo), which other players see next to your name, your all-time stats (games, wins, points and finds) and when the account was created. Your email is never shown to other players; we use it to identify your account and to answer support and data requests.
Your account, if you sign in by email. You can instead sign in with a link (or a 6-digit code) we email you. We store your email address to identify your account, and the account holds the same things as above. The link and code work once and expire after 15 minutes, and we keep only a hashed copy of them. If you sign in by email and with Google using the same address, both lead to the same account.
Friends. Your account gets a friend code. Anyone you share it with can send you a friend request, and you're only friends once both of you have accepted. We store your friendships and pending friend requests. Room invites you send or receive aren't stored: our server holds them in memory and they expire after 2 minutes.
Game data. The rooms you're in, your votes, scores, likes and results. All-time stats are kept on your account.
Where you are in the game. While you play, your browser reports where you are on the map or in Street View, so other players in your room can watch you.
The views you submit. When you press Submit we receive the Street View panorama you're in and which way the camera points. Our server uses them to get that exact image from Google for the judge. It also keeps where each find was made, so you can't score twice in the same spot during a game.
Server logs. Our server logs each submission's name, the thing being looked for and the judge's verdict, plus errors, so we can fix problems and spot abuse. It doesn't log IP addresses.
Your subscription, if you subscribe. Payments are processed by Stripe. You type your card details into Stripe's own checkout page, so we never see or store your card number. On your account we keep your Stripe customer ID, your subscription's status, when it renews or ends, and whether it's set to cancel.
Free-game counts. Free players get a few games a week. To count them, we note when each game starts against your account, your browser and your network. Your browser is identified by a random device cookie (see below), and your network by your IP address: the whole address for IPv4, and for IPv6 only its first half (the /64 network your device is on). We never store either as is: only salted hashes of them, which can't be turned back into the cookie or the address, with the time the game started.
Datacenter and VPN check. Our server checks your IP address against public lists of datacenter, hosting and VPN address ranges, kept on our server. Those networks are shared by strangers, so if you're on one, your free games are counted by your account and browser only, not by network. The address isn't stored or sent anywhere for this check.

Stored in your browser

The game saves your name, the room you're in, your last game settings and, if this site uses one, the game password in your browser's local storage, so you don't have to type them again. They never leave your device except when the game sends them to our server. You can clear them by clearing this site's data in your browser.

When you sign in, we set a first-party session cookie that keeps you signed in for up to 90 days or until you sign out. It holds a random token (we store only a hashed copy on our server) and can't be read by the page's scripts.

Everyone also gets a first-party device cookie. It holds a random ID that lets us count free games per browser, can't be read by the page's scripts, and lasts about 400 days. It isn't linked to anything outside this game. We don't use advertising or tracking cookies, and no ads.

Who we share it with

Google. The map, Street View and fonts load directly from Google, so Google receives your IP address and what you look at, under the Google Privacy Policy. Our server also asks Google for the image of each view you submit. If you use Sign in with Google, the page loads Google's sign-in script from accounts.google.com, which is also covered by Google's privacy policy.
Brevo (Sendinblue SAS), if you sign in by email. Brevo sends the sign-in emails for us, so it receives your email address and the email's contents in order to deliver them, under the Brevo Privacy Policy.
Our AI judge. Each submitted image and the thing being looked for are sent to OpenRouter, which passes them to one of the AI providers it works with for a verdict. Your name isn't sent. [Before publishing, set OpenRouter's data_collection preference to "deny" in the judge so this next sentence is true:] We only use providers that don't keep these requests or train on them.
Other players. Players in your room see your name, avatar, score, where you are while you play, your submitted views and the judge's reasons. Everyone can see the all-time leaderboard, which lists accounts by display name. Other players never see your email.
Your friends. Friends see your display name, your avatar, your all-time stats, whether you're online, and which room you're in (or that you're playing solo). The friends leaderboard shows you and your friends. Turning on "Appear offline" in the Account tab hides your online status and room from friends and stops them inviting you. Friends never see your email either.
Our hosting provider, [HOSTING PROVIDER], which runs our server.
Stripe, our payment processor, if you subscribe. We give Stripe your email address to set up your customer record; Stripe collects your card details itself, under the Stripe Privacy Policy.

We don't sell your information or share it for advertising. We may disclose it if the law requires us to.

How long we keep it

Submitted images are never saved to disk. Our server holds each one in memory only while your room can still show it, then deletes it. That's the round in progress and the summaries of the current game.
Rooms, including where you are and what you submitted, are deleted after 2 hours without activity.
Accounts, with their stats, friendships and pending friend requests, are kept until you delete your account or ask us to.
Room invites are never saved; they expire after 2 minutes.
Email sign-in links and codes expire after 15 minutes or once used.
Sign-in sessions end after 90 days, when you sign out, or when you delete your account.
Server logs are kept for [PERIOD].
Free-game counts (the hashed device ID and network, and when each game started) are deleted 7 days after the game started. If you delete your account, the counts stay, unlinked from it, until those 7 days are up, so deleting an account doesn't give out new free games.
Subscription details on your account are deleted with your account. Stripe keeps payment records as long as tax and accounting law requires.

Your choices and rights

You can delete your account yourself at any time with "Delete account" in the game's menu. That immediately removes your account, its stats, its friendships and pending friend requests, and its sign-in sessions. If you have a subscription, it's cancelled at the same moment (see the Terms).

You can also ask us to see, correct or delete what we hold about you by emailing [CONTACT EMAIL]. Email us from, or tell us, the email address you signed in with, and we'll match the request to that account. Depending on where you live (for example the EU, UK or California), you may have further rights under data protection law, such as the right to object or to complain to your local data protection authority. We'll reply within 30 days.

Children

The game isn't meant for children under 13, and we don't knowingly collect information from them. If you think a child under 13 has played, contact us and we'll delete their data.

Security and location

Our server is in [COUNTRY]. We use reasonable measures to protect what we hold, but no service is completely secure.

Changes

We'll update this page and its date when this policy changes, and tell you in the game about significant changes.

Contact

[OPERATOR NAME], [POSTAL ADDRESS OR CITY AND COUNTRY]
Email: [CONTACT EMAIL]