Privacy Policy

Last updated: 20 September 2026 · Version 1.0.7

REVIER is a game of tag you play outside. For that to work, the app needs to know where you are, and it has to tell the people you're currently playing with. It doesn't need more than that — and it doesn't take more than that.

This page explains, in plain language, what data is collected in the process, where it goes, how long it stays, and how you get rid of it.

The essentials, briefly

• No account. No e-mail address, no password, no login. The app creates an anonymous identifier that you can delete yourself at any time.
• Your location is only recorded during a round — including in the background, when the screen is off — and your fellow players can see it.
• Your live location and the exact history of your positions are deleted at the latest 24 hours after the round ends, along with the whole round.
• The round recap stays for 7 days: a map with nicknames and shortened paths, without an identifier. Anyone with the ten-character link can view it without signing in.
• Rally and Assassin rounds are kept for 30 days. Rally photos are deleted 7 days after the round ends.
• Wishes from the wishlist are reviewed before they're visible to everyone. Approved wishes are translated by DeepL — so please don't write anything personal in them.
• We count rounds anonymously: mode, duration, number of players. No identifier, no name, no location.
• No advertising, no analytics software, no selling of data, no push service.
• Deleting everything takes two steps in the app: Home screen → "Legal" → "Delete my data".

1. Who is responsible

E-mail: samuelhofert@gmail.com

That's the address to contact with any question about your data. There is no data protection officer; REVIER is a private project and isn't required to have one.

2. You don't need an account — but you do get an identifier

You don't sign up for REVIER. There's no e-mail address, no password, no username, no login via Google or Apple.

Instead, the app quietly creates an anonymous identifier the first time it starts — a random number that stays on your device and lets the server recognise you again. It contains nothing about you. It's needed so the server can tell which moves come from which device; without it, anyone could change anything in any round.

This identifier is stored with our service provider Supabase (see point 6). You can delete it yourself at any time, along with everything attached to it: Home screen → "Legal" → "Delete my data" (see point 7).

Legal basis: Art. 6(1)(b) GDPR — without this identifier, the app cannot do its job.

3. What the app collects, and why

3.1 Your location — in the foreground

What: Latitude, longitude, and your device's accuracy figure.

When: As soon as you join or create a round, and while the round is running. Not on the home screen, not in settings.

Where to: Two paths, and they last for different lengths of time.

• To your fellow players, directly and fleetingly. Roughly once a second, your device sends your position, accuracy, and nickname over a real-time channel to the other devices in your round. These messages aren't stored; they're gone as soon as they arrive.
• To the database, as your last known position. While you're moving, your device writes latitude, longitude, and the time to your player row every 10 to 30 seconds; while standing still, just a sign of life, at least every 90 seconds. This row keeps getting overwritten: all that's stored is where you were last.
• To the database, as history for the round recap. Roughly every four seconds your device remembers a point, and sends the collected points to the server in batches every twenty seconds. After the round, this becomes the recap — the map with all the paths that you can look at and share (see 3.14).

That is a history of your positions. It sits on the server during the round and is deleted together with it.

What for: So the others can see you on the map. And so the server can check what only it can check — whether you're still on the playing field, whether you're standing in a flag circle, who a hex belongs to.

Accuracy: Positions that are too imprecise are discarded and never sent at all — for the map and the player row, from 25 metres of inaccuracy onward; for the history, from 30 metres.

How long: Both — the row with your last position and the round's history — live as long as the round does. 24 hours after the round ends, it's deleted along with the whole round, automatically, without you having to do anything. See point 7.

After that, the raw history no longer exists. What remains is the condensed recap without an identifier, with nicknames — a shortened line on a map and a nickname (see 3.14). That, too, expires, after seven days.

Legal basis: Art. 6(1)(b) GDPR — that's the game.

3.2 Your location — in the background

What: The same data as above.

When: Only while a round is running. The app asks for permission right when the round starts, and turns off background location tracking as soon as the round is over or you leave it.

What for: Without it, you'd disappear from everyone else's map the moment the screen turns off — and while running, the screen turns off. That would break the game.

How you'll notice: On Android, a persistent notification runs alongside it ("REVIER is running — your location is being shared in the game."). On iOS, the system shows the blue location indicator.

If you say no: The app keeps working, but tells you that you'll become invisible to the others whenever the screen is off.

Legal basis: Art. 6(1)(b) GDPR.

3.3 Your nickname

What: The name you type in when joining. You choose it freely — you don't have to use your real name, and we recommend that you don't.

Where to: Into your player row in the database, into the real-time messages to your fellow players, into your stats row (see 3.6), and, at the end of a round, into the round recap (see 3.14). It also stays stored on your device so you don't have to type it in every time.

Who sees it: Your fellow players in the round — and whoever gets the link to a round recap that you appear in (see 3.14). There's no public leaderboard or profile.

Legal basis: Art. 6(1)(b) GDPR.

3.4 Your in-game progress

What: Your role, your team, your chosen colour, your status (in, caught, left), who caught you and when, which hexes belong to you, your points, collected power-ups, plus a list of game events (round ended, battery low, rematch).

Where to: Into the database, into that round's tables.

Who sees it: Only the fellow players in the same round. Access is restricted at the database level to your own round.

Legal basis: Art. 6(1)(b) GDPR.

3.5 Your distance run and your path

What: Two different things, and they live in different places.

• The distance (a number in metres) goes into your player row in the database at the end of the round. It's needed for the "Longest Path" award, which compares all distances in the round.
• The path (the sequence of points you ran) stays on your device for everyday use. The app draws it onto the shareable images at the end of the round, and keeps it there for the last three rounds; after that it's deleted automatically.

Two paths lead to the server, and both are time-limited: during the round, the history of your positions is sent to the server in batches (see 3.1) and is deleted, together with the round, 24 hours after it ends. At the end of the round, your path is sent to the server once, into the round recap — where it's shortened and stays for seven days (see 3.14).

Legal basis: Art. 6(1)(b) GDPR.

3.6 Your overall stats

What: Nickname, number of rounds played, wins, hexes captured, catches, and when you last played. One row per identifier, kept up to date permanently.

Where to: Into the database. Aborted and expired rounds don't count towards it.

Who sees it: Only you. Each device can only read and write its own row. There's no leaderboard across rounds.

Legal basis: Art. 6(1)(b) GDPR — the stats are part of the app you use.

3.7 Your battery level

What: Only the answer to a yes/no question: is the battery below 20% and not currently charging?

Where to: If yes, the app writes an event into the round once per round — without your name and without an identifier. The others see "someone's battery is running low", not who. The percentage figure itself never leaves your device.

What for: So the group knows the round should probably wrap up soon.

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in a game that doesn't fall apart mid-field.

3.8 The camera

What: While scanning, the camera image is only analysed, never stored, and never transmitted. The app only looks for QR codes in it.

When: Only while the scan screen is open — when joining via a QR code and when catching someone.

The one exception is the Rally: it has photo challenges. When you complete one, you deliberately take a photo with the camera, and that photo is uploaded (see 3.17).

What for: In REVIER, catching someone means: going up to them, tapping hands, and the caught player shows their code, which the hunter scans. Being nearby isn't enough — which is exactly why the camera is needed.

What does NOT happen: No recording without your doing, no video, no audio. The microphone permission has been explicitly removed from the app.

Legal basis: Art. 6(1)(b) GDPR.

3.9 Your photos

What: The app writes an image to your photos — the results image from your round — only when you tap "Save".

What does NOT happen: The app never reads your photos. It only asks for write access; the read permission has been removed from the app.

Legal basis: Art. 6(1)(a) GDPR — the consent you give by tapping "Save".

3.10 Notifications

What: Two hours after a round has ended, REVIER shows you a local notification reminding you of your results image. Tapping it opens the round in "Recent Rounds".

What explicitly does NOT happen: There is no push service. The notification is scheduled by your device for your device and never leaves it. No push token is generated, stored, or transmitted, either to us or to Apple, Google, or Expo. We don't find out whether it arrived, whether you tapped it, or whether you turned it off.

On Android, the app also shows the game status as a notification while a round is running; on iPhone, on the lock screen. That, too, is generated on your device and doesn't leave it.

When you're asked: Only after your first completed round, and beforehand with a dedicated screen explaining why. If you say no, you're never asked again. You can turn it off at any time, in the app's settings at the bottom, and additionally in your operating system's settings.

Legal basis: Art. 6(1)(a) GDPR — the consent you give by tapping "Yes, remind me", which you can withdraw at any time.

3.11 Bug reports

What: When you use "Report a bug" in the menu, the following is sent: your sentence, the round code, the round's number and mode, the app's version, build, and status, your device type and operating system, and a short block of context (state of the round, number of players, whether connections are silent, the last five game events in words).

What explicitly is NOT included: No location data — not your position, not the field's centre, not the place name. No nickname. Not your anonymous identifier. You should be able to send a bug report without identifying yourself in the process.

Who reads it: Only us. The table doesn't grant anyone read access through the app; it's only read in the admin interface.

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in finding bugs.

3.12 Where the playing field is

What: The coordinates of the field's centre, if the host set them manually, plus the centre and radius of the play zone and the location of the flag circles.

Good to know: As long as a round is still sitting in the lobby (i.e. hasn't started yet), these settings are readable by any signed-in device — that's needed so people can join a round via the 6-digit code without already being a member. They say where the game is going to be played, not where a particular person is. Once the round is running, that no longer applies.

Legal basis: Art. 6(1)(b) GDPR.

3.13 What stays on your device

• Your nickname, your last chosen colour, the last mode played, and the settings you last used
• Saved playing fields and terrain
• The path you ran in the last three rounds, unshortened. It only reaches the server via the two time-limited paths described in 3.5
• The results of the last twenty rounds (placements, your numbers, award, location, date — no path). Since the cleanup after 24 hours, this is actually the source for "Recent Rounds": what you see there comes from your phone, not from the server
• Whether you've already seen the explainer on first launch, whether and when you were asked to leave a rating, and which announcement you've dismissed

You delete all of this with "Delete my data" (see 7.2), or by removing the app from your device.

3.14 The round recap

What: At the end of a round, it's condensed into a single entry and stored. That's how the recap of the round is created — all paths on the map at once, how the field changed colour, how the zone shrank, who caught whom.

What it contains:

• the display names of the players, their colour, their team, and their role
• the paths that the devices contributed at the end of the round — shortened: everything outside the playing field is removed, and of what remains, the first and last 150 metres. So the path from home to the game and back isn't included. Anyone who ran less than 300 metres on the field has no path at all in the recap
• which hex got which colour and when, how the zone shrank, who caught whom, and the result

What explicitly is NOT in it: no identifier, no device identifier, no e-mail address — nothing that would link the entry to an account. The players are only listed with sequential numbers in it, and those numbers only apply within that one recap. Whoever reads it sees a round with nicknames and paths; who the person behind it is appears nowhere.

How long: The round recap stays for seven days, then it's automatically deleted. It's the only part of a round that survives the 24-hour cleanup — and that's deliberate: the raw location data (your continuously overwritten last position, the point-by-point history, the player row with your identifier, the field, the events) all keeps disappearing after 24 hours. What remains is the condensed recap without an identifier, with nicknames. It isn't anonymous in the strict sense: anyone who knows you and your nickname will recognise your path. That's why the path is shortened, and why the recap expires.

Sharing: Every recap has a ten-character random code, and beneath it an address in the form revier.games/r/K7M2P9XQ4T. The code is long on purpose so it can't be guessed. Anyone with this link can view the recap in a browser — without the app, without an account, without signing in. It shows the same as the app: paths, nicknames, numbers. No identifier, no join code, nothing that leads to an account. After seven days it shows "Recap no longer available".

This also means: whoever passes the link on is passing on the nicknames and paths. Anyone who doesn't want that shouldn't share it — and anyone who was already part of the round can see the recap in the app anyway.

In one sentence, for whoever's organising: whatever gives away who you are is gone after a day. What remains is a map with nicknames on it.

The recap can be read by anyone who took part in the round. In the first 24 hours the server checks this against the round itself; after that it no longer exists, and instead a random key that your device received on upload is what counts. Anyone without it can't get in.

Deleting: The delete button in the app ("Delete my data", see 7.2) deletes your identifier and everything attached to it. The round recap isn't attached to any identifier — so it can't be found via one either. If you want a specific recap gone, write to us; the round can be clearly identified by its code and the date.

Legal basis: Art. 6(1)(b) GDPR (carrying out the game and following up on it) and Art. 6(1)(f) GDPR (legitimate interest in a seven-day-limited reminder of the round, without an identifier and with nicknames).

3.15 The anonymous round count

When a round ends, the server counts it: mode, start and end time, duration, number of players, whether it ended or was aborted, whether it was played with teams, and whether it was a custom mode. Nothing more — no identifier, no nickname, no game code, no location, and no playing field. The count also doesn't carry any reference to the round itself; once the round is deleted, the row can't be linked to it or to a person. This means it isn't personal data. It lets us see whether, and which, modes are being played. Only the operator can read it.

3.16 The wishlist and its translation (DeepL)

What: In the wishlist you can write, in one sentence, what the app is missing, and vote for other people's wishes. What's stored is the text, the time, your votes, and — if you report someone else's wish — that report. Every wish is linked, on the server, to your anonymous identifier. That's needed so there's only one vote per person, so the app can tell you when your own wish has been approved or implemented, and so "Delete my data" can find your wishes.

Who sees what: No wish is public right away — we read it first. Approved wishes are visible to every REVIER user, without a name and without an identifier: nobody but you sees who a wish is from. Even during approval, we see the text, not the identifier behind it.

Translation: Once a wish is approved, we automatically translate its text into the app's languages (German, English, French, Spanish) so everyone can read it. To do this, the text of the wish — and only the text — goes to DeepL SE, Maarweg 165, 50825 Köln, Germany. Your identifier, your nickname, your IP address, or anything else pointing to you is not transmitted in the process; the request comes from our server, not from your device. Wishes that aren't approved never leave our server.

We use the free developer tier of the DeepL API for this. Under this tier, DeepL doesn't explicitly guarantee that texts aren't stored. We therefore assume that DeepL may temporarily store texts under its own terms and use them to improve its services. Please don't write anything personal into a wish, then — no names, addresses, or contact details. We don't approve wishes that contain personal information.

If our translation quota is used up, nothing more is transmitted; wishes then only appear in the original language. More on DeepL: https://www.deepl.com/privacy

How long: Until you delete your data (see 7.2).

Legal basis: Art. 6(1)(b) GDPR for the wishlist itself; Art. 6(1)(f) GDPR for the translation (legitimate interest in having the wishlist readable in every language of the app).

3.17 Rally

The Rally is a mode with challenges instead of tagging. It involves different data than the other modes:

• Answers and photos. Whatever your team submits — text, quiz answers, and photos taken with the camera — is uploaded. Photos are only visible to the game master and your own team. Be mindful of who appears in a photo.
• Your path. It's recorded on your device during the Rally and uploaded once at the end. Your fellow players can see it within the round.
• The Rally recap. The game master can explicitly create a recap at the end. It's reachable in a browser under the six-digit game code — meaning by anyone who knows the code, without signing in. It shows the teams with their names and points, each team's path as a single line, without player names, and only the photos the game master has approved. No nicknames, no identifier.

How long: Photos and the Rally recap are deleted 7 days after the round ends. The round itself (teams, challenges, answers, points, nicknames, paths) is kept for 30 days, so the result of a group's day out can still be looked up, and is then deleted automatically.

Legal basis: Art. 6(1)(b) GDPR.

3.18 Assassin

Assassin runs over several days and doesn't need location — the app collects none in this mode. What's stored are the nicknames, who each person's target is, the contracts, and reported hits. Only you (and the game master) see your target and your contract.

The game master can manually add players who don't have a phone. Their name then appears in the round without them using the app themselves. Anyone running a round should only enter nicknames and let those people know.

How long: A completed round is kept for 30 days and then deleted automatically. A round nobody ends is ended automatically after 60 days.

Legal basis: Art. 6(1)(b) GDPR.

3.19 Custom modes

In the mode builder, you can put together your own custom mode. It stays on your device — unless you publish it. In that case its name, description, settings, and the nickname it should appear under go to the server. We review it before it becomes visible; after that, every REVIER user can see it, under that nickname. Nobody sees your identifier in the process. Others can report a mode.

How long: Until you delete your data (see 7.2).

Legal basis: Art. 6(1)(a) GDPR — you publish it yourself.

3.20 Reporting and blocking

Reporting: If you report someone in a round, we store your identifier, the reported person's identifier, their nickname at that moment, the reason, your comment, and the round's number. A report concerns a person, so it has to be clear who's reporting whom. Only we can read it. It outlives the round so we can follow up on it, and is deleted as soon as either person deletes their data.

Blocking: If you block someone, we store the pair made up of your identifier and theirs, so you no longer end up in the same round. Only you can see the list; you can undo it in settings.

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in a game where people can defend themselves against misconduct.

4. What the app doesn't do

This is just as important as the list above:

• No advertising. No ad identifiers, no cross-app tracking, no ad networks.
• No analytics software. No Google Analytics, no Firebase Analytics, no Facebook SDK, no crash-reporting service.
• No selling or passing on your data to third parties for their own purposes.
• No profile of you. Nothing is derived from your positions, and nothing is pieced together across rounds.
• No movement history beyond the round. The exact history of your positions is deleted 24 hours after the round ends. What stays for seven days is the shortened path in the round recap, without an identifier.
• No location outside a round. Nothing is collected on the home screen, in settings, or after the round ends.
• No chat, no messages, no profiles. You only upload text and images where you explicitly choose to: nickname, wish, bug report, report, published custom mode, Rally answers, and Rally photos.
• No microphone, no contacts, no calendar, no health data.

5. Who else sees your data

Your fellow players. Everyone in the same round sees your nickname, your colour, your position on the map (not continuously, depending on mode and role — in some modes you only see others when they briefly light up), your points, your hexes, and, at the end, your distance run and your award. That's the game.

All REVIER users see approved wishes (without a name, see 3.16), published custom modes together with the nickname chosen for them (see 3.19), and the settings of open lobbies (see 3.12). They don't see your nickname from a round or your stats.

Anyone who gets a recap link. Anyone with the ten-character link to a round recap sees the nicknames and shortened paths of that round (see 3.14). Anyone who knows the game code of a Rally sees its recap with team names, team paths, and approved photos (see 3.17).

Anyone who receives a shared image. If you share an image at the end of a round, depending on the card it may contain your nickname, your placement, the names of your fellow players, the place name, the date, and the path you ran. Where that image goes is up to you.

6. Our service providers

The database and the real-time connection run through:

https://supabase.com/privacy

The data is stored on servers in the Central EU region in Frankfurt am Main, and thus within the European Union. We have a data processing agreement with the provider under Art. 28 GDPR, which also covers the standard contractual clauses for the case of access from a third country.

Translation. Approved wishes are sent for translation to DeepL SE, Maarweg 165, 50825 Köln, Germany — only the text, see 3.16. https://www.deepl.com/privacy

Map data. The map in the app comes from Google Maps (Google Ireland Limited) on Android and from Apple Maps (Apple Inc.) on iOS. When the map is displayed, your IP address is transmitted to the respective provider; their own terms apply to processing there: https://policies.google.com/privacy and https://www.apple.com/legal/privacy/ respectively.

Place search. If you search for a place in settings, your search term goes to Photon (https://photon.komoot.io, Komoot GmbH), a search service based on OpenStreetMap. If it finds nothing, or is unreachable, the app asks your operating system's location service instead. The app asks that same system service once at the end of a round, to get the name of the place where you played.

App updates. The app can update itself via Expo Application Services (Expo, Inc., USA). In doing so, your device transmits technical information about the installed version. https://expo.dev/privacy

The stores themselves. The download runs through Apple or Google. What they collect in the process is beyond our control.

7. How long the data stays — and how you get rid of it

7.1 How long

On location data specifically, because it's the most sensitive point: while a round is running, two things sit on the server: a row per player with their most recent position, which keeps getting overwritten, and the point-by-point history of your positions. 24 hours after the round ends, both are gone, together with the whole round. The complete, unshortened path is then only kept on your device — so you can still build your results image later — and only for the last three rounds.

The round recap is the one exception, and it's precisely bounded (for the Rally, 3.17 applies). It's built once at the end of a round and stays for seven days. It contains nicknames, colours, teams, and the shortened paths — but no identifier, no device identifier, and nothing that leads to an account. The link between "which path belongs to which identifier" no longer exists anywhere after that: it lived in the player row, and that's deleted after 24 hours.

The 24 hours are a safety margin, not a retention period: your phone stores the round's result the moment it ends. Should that ever go wrong — the app gets wiped, the battery dies — you can still open the round again on the same day and redo it.

7.2 How to delete everything — in the app, in two steps

At the very bottom of the home screen is "Legal". Behind it you'll find "Delete my data". A confirmation follows, then a second one, and then it's done. It takes seconds and doesn't involve us.

This deletes:

• your anonymous identifier
• all your player rows from every round — with nickname, last position, and distance run
• your overall stats
• your wishes, votes, and reports in the wishlist
• your published custom modes
• reports you've made or that concern you, and your block list
• everything stored on your device: round archive, paths run, nickname, colour, settings, and the identifier itself

After that, REVIER behaves like a fresh install. You can keep playing right away — the app just won't know anything about you anymore.

Three things that are deliberately NOT deleted along with it, because they don't belong to you alone:

• 1. Rounds you created that other people were also part of. They remain in place, but your own row inside them is removed. The round is then transferred to the next person in it. If you'd been the only person in it, it's removed entirely. The reason: the memory of a shared evening doesn't belong to you alone just because you happened to tap "Create game" back then. (After 24 hours the round is gone anyway; after 30 days for Rally and Assassin.)
• 2. Round recaps. They carry no identifier and can't be found via one. They expire on their own after seven days; if you want one gone sooner, write to us (see 3.14).
• 3. Bug reports. They deliberately carry no identifier — you should be able to report a bug without identifying yourself in the process. Anything not attached to an identifier also can't be found again via an identifier. If you want to withdraw one, send us the date and roughly what it said, to samuelhofert@gmail.com.

7.3 The e-mail route remains available as well

If the button doesn't work for you, or you'd rather write: e-mail samuelhofert@gmail.com. For us to know which identifier is meant, we need something to go on — for example your nickname together with the code of a round you were in, or the approximate time of your last round. We reply within one month (Art. 12(3) GDPR).

8. Your rights

Under the GDPR you have the right to:

• Access (Art. 15) — what's stored about you
• Rectification (Art. 16) — correcting inaccurate information
• Erasure (Art. 17) — see point 7
• Restriction of processing (Art. 18)
• Data portability (Art. 20) — your data in a common format
• Objection (Art. 21) to anything based on legitimate interest — that is, the battery notice, bug reports, the round recap, translation of wishes, and reports about you
• Withdrawal of consent (Art. 7(3)) — at any time, with effect for the future; this also applies to a published custom mode. You can also revoke the system permissions for location, camera, and photos at any time in your device's settings.

To exercise these, contact samuelhofert@gmail.com.

Right to complain: You can lodge a complaint with a data protection supervisory authority. The competent authority is the one for your place of residence or our registered office:

9. Children

REVIER isn't a game for young children — it involves running around outside, which requires being able to navigate traffic on your own. We don't target children under 13 and don't knowingly collect data from them.

If you're under 16, you need your parents' consent to use the app (Art. 8 GDPR).

If you believe a child has given us data, write to samuelhofert@gmail.com — we'll delete it.

10. Security

The connection between the app and the server is encrypted throughout (TLS).

Row-level security applies in the database: you only see what belongs to your own round. Whatever the game decides — catching, distributing teams, points, awards — is calculated by the server; your device can't write it directly. No device has write access to the sensitive columns (membership in a round, identifier, who caught you, points, award).

11. Changes

If the app changes, this page changes with it. The date at the top shows when it last did. For significant changes, we'll point this out within the app.