Privacy policy

Last updated: 4 November 2026

This policy explains how Pataholm System AB ("GeoQuestr", "we", "us") processes personal data when you use GeoQuestr's website, apps and services (the "Services").

Contact: hello@geoquestr.com

1. Short summary

• Participants use anonymous accounts. They do not need to register or give their real name or their email address.
• Participants' location is not stored and is never sent over the network. The location is only handled on the participant's device, to draw the avatar on the map and to interact with objects in the game.
• All personal data, including backups and logs, is stored within the EU on our own servers at Hetzner in Finland and Germany.
• Participants' data is deleted or anonymized no later than 6 months after the round has ended.
• We never sell personal data and do not use it for advertising.

2. Who is responsible for the data

GeoQuestr has two roles:

• Processor. When an organization, such as a municipality, school, association or company, runs an activity in GeoQuestr, the organization is the controller of the participants' data. We only process that data on the organization's behalf and according to its instructions. This is governed by a data processing agreement under Article 28 GDPR (see section 13). Where the agreement says so, this also applies to data about the organization's administrators.
• Controller. We are the controller for other administrators' accounts, payments, support and our website.

If you take part in an activity run by an organization, you can contact the organization with questions about your data. You can also contact us, and we will help.

3. Data we process

3.1 Administrators

• Name, email address and login credentials. Passwords are only stored as salted hashes. If you sign in with Google or Apple, we receive your name and email address from them.
• Organization, plan, subscription and purchases.
• Content you create: texts, quests, locations, images, audio and video.
• AI credits and how they have been used.
• What you write to us in emails and support requests.

3.2 Participants

• An anonymous account with a random account ID, a player name the participant chooses, and an avatar.
• Scores, progress and answers.
• Photos and videos submitted in photo and challenge quests. They may show people.
• If the organizer has chosen to ask for it when the participant joins: age, gender, email address or answers to a custom question. Only the organizer sees the answers.

Participants do not need to give their real name.

Anonymous accounts. When someone joins an activity, an anonymous account is created automatically, with no registration, email address or password. The account stores score, progress and achievements, and the same account is used for the activities the participant joins on that device. It can only be reached from the browser or the app on that device, not from another one. If browser data is cleared or the app is uninstalled, the account can no longer be accessed.

The account stays anonymous as long as participants do not themselves provide details that show who they are, such as a real name as player name, a photo of themselves, or an email address the organizer asks for. We therefore treat data belonging to an anonymous account as personal data. On the web, a participant can choose to create a regular account. Their progress then carries over and the account is no longer anonymous.

3.3 Data we do not process

• Location data is never stored and is not sent over the network. The GPS position is only used on the participant's device, to show the map and to determine when the participant has arrived at a quest.
• Sensitive personal data under Article 9 GDPR (special categories of personal data), such as data about health, religion or ethnic origin, must not be processed in GeoQuestr. Organizers must not ask for such data.

3.4 Technical information

• IP address, timestamps and error logs, to run the Services and detect abuse.
• Visitor statistics from Plausible Analytics. Plausible runs on our own servers, uses no cookies and stores no personal data.

3.5 Children

Children often take part in activities, for example through schools, associations and municipalities. There is no minimum age for taking part, and participants do not need to register, as they take part with an anonymous account. If the participant is under 13 (or the higher age that applies in their country), a parent or guardian must have approved the participation, or the activity must be run by an organizer, such as a school, that is responsible for having consent from a parent or guardian or another legal basis. To create an administrator account or make purchases, you must be at least 18 or have consent from a parent or guardian. Do you believe a child has provided data without such approval? Contact us.

4. Why we process the data

• To provide the Services: participation, scores and leaderboards, the control room and reports.
• To assess submitted photos automatically with the AI judge, if the organizer has turned it on.
• To manage accounts, payments, subscriptions and AI credits.
• To provide support to administrators.
• To protect the Services against cheating, abuse and intrusion.
• To comply with the law, for example the Swedish Accounting Act.
• To improve the Services based on anonymous, aggregated statistics.
• To send news to administrators, with consent where the law requires it.

Participants' data is only used for the activity they take part in, for the organizer's reports, and to show the participant's own history and achievements.

5. Legal basis

When we are the controller, we base the processing on:

• Contract: to provide the Services and manage accounts, payments and subscriptions.
• Legal obligation: to comply with tax and accounting rules.
• Legitimate interests: for security, to prevent abuse and to improve the Services.
• Consent: for newsletters where the law requires it.

When we are the processor, the organizer decides the legal basis for the participants' data.

6. AI features

• The AI judge runs an open AI model (Qwen3-VL-Reranker-2B) on our own server in the EU, at Hetzner in Finland. Our app server passes the photo to it over a private, encrypted network connection. The judge reads the photo in memory, scores how well it does the task, turns that into bonus points and keeps no copy. It writes no comments and does not filter content: the organizer reviews submitted photos. Submitted photos and videos are not sent to OpenAI.
• AI generation sends the administrator's instructions to OpenAI when quests, texts, images, translations or report summaries are created. For report summaries, player names and scores from the leaderboard are sent as well.
• OpenAI only receives what the feature requires and is not used to store personal data.
• AI narration sends quest texts to ElevenLabs when audio files are created. Whoever creates the game chooses whether to use narration. No participant data is sent.
• The organizer can turn off the AI features completely. No personal data is then sent to OpenAI or ElevenLabs.

7. Leaderboards, photos and reports

• During an activity, participants see each other's player names, avatars and scores on the leaderboard.
• Submitted photos are shown to the organizer in the control room and in reports, and may be shown to other participants in the same activity.
• The organizer chooses whether a report is shared publicly. A public report shows statistics and the leaderboard with player names, but no submitted photos.

8. Where the data is stored

All personal data, including backups and logs, is stored within the EU on our own servers at Hetzner Online GmbH, in data centers in Finland and Germany. This applies to the website, the login, the database, the files, email and the backups.

9. Sub-processors

We use the following sub-processors. Each one only receives the data its function requires. The current list is always available on Trust & security.

Organizations that have a data processing agreement with us are notified in writing at least 30 days before a sub-processor is added or replaced.

10. Transfers outside the EU/EEA

Personal data is stored within the EU. Sub-processors outside the EU/EEA only receive personal data on the basis of an adequacy decision, such as the EU–US Data Privacy Framework, or the European Commission's standard contractual clauses.

11. How long the data is kept

• Participants' data is deleted or anonymized no later than 6 months after the round has ended.
• Anonymous accounts that have never been used to take part in an activity are deleted automatically.
• Administrator accounts are kept for as long as the agreement or subscription is in force, and are deleted no later than 90 days after it has ended. Accounts without an agreement or a subscription are deleted after 2 years of inactivity. You can delete your account yourself at any time.
• Content that you have created can be requested within 90 days after the agreement has ended: texts, quests and locations as a JSON file and images in their original format.
• Payment and accounting data is kept for 7 years under the Swedish Accounting Act.
• Backups are taken daily, stored encrypted within the EU and kept for at most 30 days. Deleted data therefore disappears from the backups within 30 days.
• Logs are kept for 24 months and then deleted or anonymized.

12. Security

• Encryption in transit (HTTPS/TLS) and at rest.
• Our own login service, where every request is authorization-checked on the server, so that administrators can only reach their own organization's data. Passwords are only stored as salted hashes.
• Only authorized staff have access to the production environment, with personal SSH keys and two-factor authentication.
• Everyone who processes the personal data has committed to keeping it confidential.
• Data minimization: participants use anonymous accounts and location data is not stored.
• Automatic deletion or anonymization according to the retention periods above.
• Daily, encrypted backups within the EU.

Have you found a security issue? Email security@geoquestr.com.

13. For organizations: data processing agreement

We sign data processing agreements under Article 28 GDPR with organizations that use GeoQuestr. In the agreement we undertake, among other things, to:

• process personal data only according to the organization's written instructions,
• notify the organization in writing at least 30 days before a sub-processor is added or replaced, and let the organization object,
• notify the organization without undue delay, and no later than 36 hours, after becoming aware of a personal data breach,
• help the organization respond to requests from data subjects and assist with data protection impact assessments,
• let the organization, or an independent auditor, audit compliance with the agreement after written notice at least 30 days in advance,
• hand over the organization's content within 90 days after the agreement has ended, delete the data according to the retention periods above and confirm the deletion in writing on request.

Email upphandling@geoquestr.com to sign an agreement.

14. Personal data breaches

In the event of a personal data breach, we notify the affected organizations without undue delay, and no later than 36 hours after becoming aware of it. When we are the controller ourselves, we notify the Swedish Authority for Privacy Protection (IMY) of the breach when required, and inform you if the breach may result in a high risk to you.

15. Your rights

Under the GDPR you have the right to:

• access your personal data,
• have inaccurate data corrected,
• have data erased,
• restrict or object to processing,
• receive your data in a machine-readable format (data portability),
• withdraw your consent,
• delete your account,
• lodge a complaint with the Swedish Authority for Privacy Protection (IMY).

Email hello@geoquestr.com to exercise your rights. If the request concerns data from an activity run by an organization, we forward it to the organization without delay and help it respond. An anonymous account is not linked to a name or email address, so please include the name of the activity and your player name so that we can find your data.

16. Changes

We may update this policy. We announce material changes well before they take effect, by email, in the app or on the website.

17. Contact

Pataholm System AB
Org.nr: 559347-4280
Pataholm 106, 384 92 Ålem, Sweden
Email: hello@geoquestr.com
Security: security@geoquestr.com

Supervisory authority: Swedish Authority for Privacy Protection (IMY), Box 8114, 104 20 Stockholm, Sweden