01Who we are
DetectiveX is operated by UnFog Ltd, London, United Kingdom (“we”). We are the data controller. Our current support address is contact@detectivex.app.
02What we collect and why
- Account: email address, password hash, display name, optional profile photo, sign-in provider identifiers, language and onboarding status. We use these to create, secure and restore your account.
- Case progress and rewards: selected city, verified cases, distinct places visited, attempts, hint and fog-reveal progress, Coins, tool purchases and uses, passes and purchase records. The server ledger is the authoritative record so rewards cannot be duplicated and your progress follows your account.
- Location: precise GPS is used on your device to centre the map and check whether a nearby case is available. We do not store a continuous location history or your live GPS position in your account. Your selected city and verified place IDs are stored.
- Camera and photos: camera access is requested only when you start a photo check. Frames or photos needed for matching are sent over an encrypted connection to our verification service. Verification evidence and results may be kept for up to 30 days for disputes, safety and fraud prevention, then deleted. A photo is saved to your private Case Files or device library only when you choose the relevant save or upload action. We do not use your photos to train AI without separate opt-in consent.
- Feedback: if you submit feedback, we store your message, up to three screenshots, account email, IP address, device details, country, language and submission time. We also send these details to our private Feishu support channel so the team can respond quickly.
- Fridge-magnet fulfilment: at checkout we record only your supported destination country/region, or your choice to continue digital-only and waive the physical reward for that order. We request a recipient name, full postal address and optional phone number only after the server confirms five eligible places and you choose to claim. We use this only to validate and fulfil the DetectiveX city-magnet reward, prevent duplicate claims and handle delivery support.
- Optional personalisation: if we offer photo personalisation when you claim and you actively choose it, we process the selected photo and the print preview you approve solely to make the magnet. We share them only with the print/fulfilment provider, do not use them for facial recognition, advertising or AI training, and normally delete the production copy within 30 days after dispatch or resolution of a delivery issue.
- Technical and security data: IP address, timestamps, app version, device/browser description, error and security logs. We use these to run, protect and troubleshoot the service.
03Device permissions
Location, camera and photo-library permissions are controlled by iOS or Android for this installation of the app, not by a DetectiveX account. Switching accounts on the same phone does not normally trigger the system prompt again. After reinstalling, the operating system may ask again. You can change permissions at any time in system Settings. Denying a permission disables only the feature that needs it.
04Purchases and service providers
Apple or Google processes payment details. We receive transaction identifiers and product status to verify and restore access. We also use providers for cloud hosting and private object storage, email delivery, photo verification and AI guide answers, maps, and the private Feishu feedback notification. Map-tile providers may receive your IP address when map tiles load. Providers may process data only to supply their service to us. We do not sell personal data, serve behavioural ads or do cross-app tracking.
05International transfers and retention
Where data is processed outside the UK/EEA, we use an adequacy decision or appropriate contractual safeguards. Verification evidence and routine technical logs are normally retained for no more than 30 days. Account progress, purchases and Case Files remain until you delete the account or the applicable legal retention period ends. A magnet claim, delivery address and any opted-in personalisation are kept while fulfilment or support is active and afterwards only as reasonably required for fraud prevention, accounting or legal obligations. Deleting your account removes the active address and personal claim record; purchase replay-protection and legally required accounting records may be retained in pseudonymous form.
06Your choices and rights
Settings lets you export your account data and delete your account. Under UK GDPR/GDPR you may also ask us to access, correct, erase, restrict or transfer your data, or object to processing. California residents may exercise their rights to know, correct and delete; we do not sell or share personal information as those terms are defined by the CCPA/CPRA. You may complain to your local regulator, including the UK Information Commissioner’s Office.
07Children, AI and changes
DetectiveX is not directed to children under 13. Younger visitors must play with a parent or guardian using the adult’s account. Photo matching and guide answers may use automated or AI systems and can make mistakes; they do not make decisions with legal or similarly significant effects. We will give in-app notice of material changes.