Mystery Trails Privacy Policy

Effective date: 4 November 2026

Contact: support@mysterytrails.app

Mystery Trails is a murder-mystery game played on foot. This policy says what the app collects, who receives it, and what stays on your phone.

Summary

• There are no accounts, no ads, and no advertising identifiers.
• We do not sell your data.
• Your location is used to play the game. While the app is open, it sends your position to our server every 20 to 60 seconds, with a random install ID, so the server can place Cases near you. The server keeps your latest position in memory only and forgets it about 10 minutes after the last report. The record of the ground you have walked never leaves your device.
• Apart from our server, the app sends only map requests to outside services. Map tiles come from MapTiler; each request carries only the tile address and the app key. Ground data for boxes about 1 km wide around you goes through our server, which keeps each answer for up to 24 hours. If our server cannot be reached or fails, the app sends that box to public Overpass servers directly.
• The camera is used only when you open the Look around view. Nothing it sees is saved or sent.

Accounts, ads and analytics

• You do not create an account. You do not give us a name or an email address.
• The app has no ads and no third-party analytics or crash-reporting service.
• The app is built with the Unity game engine. Unity may collect basic device hardware statistics. We have turned this off in the app settings. If the setting does not take effect on your device, Unity may still send those statistics.

Location

• The app asks for precise location when the map first needs it.
• Your position is used on your device to place you on the map and to unlock Scenes and NPCs when you walk near them.
• Your position also goes to our server, as described under Nearby Cases.
• If you deny the permission, the map cannot follow you, and the game cannot unlock Scenes by walking to them.
• You can withdraw the permission at any time in your phone settings.

Nearby Cases

Cases appear on the map near where players are. To place them, the app reports to our server.

• What is sent. Your current position, a random install ID, and the IDs of the Cases you have solved, so you are not offered them again.
• When. When the app starts and when you return to it, then every 20 seconds while no Case is near you, or every 60 seconds once one is. Nothing is sent while the app is closed or in the background. The app sends a report only when your phone's location looks genuine.
• The install ID. A random code the app makes the first time it sends a report. It is not your name, your phone number, your Google account or an advertising ID. Uninstalling the app or clearing its storage makes a new one.
• What the server keeps. The latest position for each install ID, in memory only. It is not written to a database or a file. The server forgets the position 10 to 11 minutes after the last report. To limit abuse it also counts reports per install ID; those counts hold no position and last until the server restarts. Everything it holds is lost when the server restarts.
• Who sees it. A Case is placed about 500 metres from the player whose report started its search, and every player within about 1 km of it gets the same Case. Its position and identifier can show those players where that player stood when the Case was placed. Other players do not see your install ID or your later positions.

Server logs

Our server runs on Google Cloud in Belgium. Like any web server, it logs each request: the time, the address requested, the response, your IP address and the app's user agent. For ground data the address includes the box of about 1 km around you, so the logs show roughly where you were. The logs do not contain your exact position or the contents of your reports. Google Cloud Logging keeps these logs for 30 days, then deletes them. We use them only to find faults and stop abuse.

Camera

• The app asks for the camera only when you first open the Look around view at a Scene. It never asks at launch.
• The camera image is drawn on your phone as an ink picture. It is not saved, not uploaded and not shared. No photo or video is kept, and we do not look for people, faces or text in it.
• Look around runs on Google Play Services for AR (ARCore), which is provided by Google and governed by the Google Privacy Policy. Google processes camera images on your phone to find surfaces and track movement.
• If you deny the permission, the game works as before, without the view.
• You can withdraw the permission at any time in your phone settings.

Map services

Playing alone, the app sends map requests to our server and to two outside services, MapTiler and Overpass. Each one can see your IP address and basic request details, as with any web request.

• Map tiles (MapTiler). The app downloads OpenStreetMap map data from MapTiler in squares at zoom level 14. A square is up to about 2.4 km wide (about 1.5 km in London). Each request carries only the square's map coordinates and the app's key, so MapTiler can tell roughly which area you are in. It does not receive your exact position. The app asks for the squares within about 1.1 km of you. When you take a Case, it also downloads the squares that cover the Case area and 500 m around it, so the Case works without signal. If any are missing, it asks for them again when the app starts.
• Ground data (streets and buildings). To choose places for Cases, the app asks our server for the streets and buildings in boxes about 1 km wide around the part of the map you are in. This is not your exact position. Our server gets the data from Overpass (OpenStreetMap data) and keeps each answer for up to 24 hours. If our server cannot be reached or fails, the app sends that box to public Overpass servers directly.

MapTiler and Overpass have their own privacy policies. We do not control them. Map data © OpenStreetMap contributors, delivered by MapTiler.

Squads

A Squad is a group of players working one Case together on a shared Murder Board.

• You join a Squad with a short code. There is no account.
• When you are in a Squad, your position and your actions in the Case go to the host you joined. The host is the server address you chose or were given.
• Your device uses a random member token to identify you to that host. The token is not linked to your name.
• The host keeps the state of the Squad so that members can leave and rejoin. This includes member tokens, member positions, and the board and Case actions of the Squad. On the server we run, this state is stored in a database.
• The state is kept until the Squad ends. A Squad ends when no one is left in it. The state is then deleted.
• Other members of your Squad can see your position and your actions on the shared board.
• If someone else runs the host you joined, that person controls what happens to the data. Join only hosts you trust.
• The app does not show a Case's answer key to any Squad member.

What stays on your device

• Your session and progress.
• A cache of map tiles. Tiles for the Case you are playing stay while it is active; other tiles are removed oldest first once the cache passes 50 MB.
• A cache of ground data (streets and buildings) from our server or Overpass.
• A record of the ground you have walked, used to draw the fog on the map. It is kept only on your phone, in a folder Android does not back up. It is never sent to us, to a Squad or to any other service. To delete it, use Settings › Clear walked ground.
• The host address you used for a Squad.
• Your member token.

Uninstalling the app removes all of this. You can also clear the app's storage in your phone settings.

Sharing

• We share data only with the services named above, and only as needed to run the map and Squads.
• We do not sell your data.
• We do not use your data for advertising.
• We may disclose data if the law requires it.

Children

Mystery Trails is not directed at children under 13. We do not knowingly collect data from them. If you think a child has used a Squad, contact us and we will remove the related data.

Security

Squad traffic is sent to the host. We use reasonable measures to protect the data on the server we run. No system is perfectly secure.

Your choices and requests

• Deny or withdraw location permission in your phone settings.
• Deny or withdraw camera permission in your phone settings.
• Leave a Squad to end your part in it.
• To ask what Squad data exists about a member token, or to have it deleted, write to support@mysterytrails.app and include your Squad code.

Changes

If this policy changes, we will update the effective date above. Material changes will also be noted in the app listing.

Contact

support@mysterytrails.app