Privacy Policy

1. Who is responsible for your data

The data controller and developer of the Magyarföld Kincse app is ndsinfo.hu (company registration number: 61684674, tax number: 91672951-1-24, Hungary). Contact: mano@magyarfoldkincse.hu, website: ndsinfo.hu.

2. What personal data we collect

When you register and play, we store the following data using the Supabase service (EU data centre):

• Email address and username — to sign you in and to show you in rankings and on the map
• Password — stored in encrypted (hashed) form; even the developer cannot read it
• Chosen profile avatar — shown on the map and in your profile
• Collected gold, completed missions, game progress — to run the game
• Phone number — only if you apply to the Wizard school, and only to contact you
• Uploaded location photo — only for Wizard/admin accounts when placing a treasure chest; it becomes publicly visible on that chest's page
• Place and time of your latest treasure-search request — for fraud protection (see section 3); it is overwritten with every new request and no movement history is built from it

During registration we use Cloudflare Turnstile to filter out bots; it processes minimal technical data under Cloudflare's own privacy policy.

3. Location data: only for the game, never for tracking

The game uses your device's precise location (GPS), only while the app is in use. We do not track your movement in the background and we do not build a movement history.

• On your device: the distance to treasure chests is calculated by your phone.
• Coordinates sent to our server: so that the app does not have to download every treasure chest in the country, it sends your current coordinates to our server to look up chests near you (app version 2.0.7 and later), to find the nearest undiscovered chest, to check how close you are to Special treasures and, for Wizard accounts, to pick the meeting point of the Malakor battle and to place a treasure chest.
• What we store: only the place and time of your latest treasure-search request (to detect impossibly fast, spoofed location changes). It is overwritten with every new request. For Wizard accounts we also store the randomly chosen in-game meeting point of the Malakor battle and the location of treasure chests that you place.
• What we do not do: we do not share your location data with third parties for advertising or any commercial purpose, we do not sell it and we do not use it for profiling.

Your location data is deleted when your account is deleted. You can turn off location access at any time in your phone settings; the map features of the game will then not work.

4. Purpose and legal basis

We use your data solely to manage your account, to run the game and to display rankings. Legal basis: performance of the contract with you (providing the service) and your consent given at registration (GDPR Article 6(1)(b) and (a)).

5. Who can access your data

The following service providers process your data on our behalf, only to operate the service:

• Supabase — database, authentication and file storage (EU region)
• Google Maps SDK — displaying the map (Google's own privacy policy applies)
• Cloudflare Turnstile — bot protection at registration
• Resend — sending account e-mails (e.g. e-mail confirmation)

We do not sell your personal data and we do not share it with third parties for advertising or other commercial purposes.

6. Data security

Data is transmitted over encrypted connections (HTTPS/TLS). Passwords are stored hashed. Access to the database is restricted by access-control rules, and server functions validate requests.

7. How long we keep your data

We keep your data as long as your account is active. After you request account deletion there is a 14-day grace period (during which you can cancel the deletion); after that your data is permanently and irreversibly deleted.

8. Your rights

Under the GDPR you can at any time request access to the data we hold about you, its correction or deletion, restriction of processing and data portability, and you can object to processing. You can lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, naih.hu).

9. How to delete your account and data

You can request permanent deletion of your account and all associated data in two ways, even if the app is no longer installed:

10. Children

The app is not specifically directed at children and we do not knowingly collect age-specific data. Under the GDPR, users under 16 need the consent of a parent or guardian to register.

11. Changes to this policy

We may update this policy when the app changes. The effective date and version at the top of this page show the latest update; significant changes affecting your data are also announced in the app.

12. Contact

Questions about your data? Write to us: mano@magyarfoldkincse.hu.