Privacy
How Visitaki handles your information.
Optional precise location history
In app versions with the updated location-permission disclosure, granting iOS location access automatically enables server location history. Earlier permission grants require the updated explanation before sharing starts. Existing sharing-off choices are preserved. Older app versions use a separate sharing switch. Sharing can be stopped in Settings independently of analytics and error reports. When sharing is enabled, Visitaki collects reliable GPS coordinates and horizontal accuracy, with capture and receipt times, including outside recorded walks and in the background when iOS permissions allow. We retain server history without automatic expiry for route improvement and internal investigations. Only a dedicated location administrator can access it. Guest records use an installation identity; signed-in records belong to the authenticated account. Earlier guest records remain separate after sign-in. Turning sharing off clears pending uploads and stops collection but does not erase server history. You can export or delete history in Settings; guest recovery codes also work at /location/privacy. Account deletion includes linked location history. Offline queues are encrypted, bounded and pruned after seven days. iOS may leave gaps; we do not interpolate them. Precise histories are never sent to OpenPanel or Sentry.
Notifications
With notification permission, guests and signed-in users can receive new and updated quest alerts in their last detected city. We store a push token, a separate installation credential hash and coarse city for this purpose, independently of precise location history and analytics. No account is required for city alerts. Signed-in devices may also receive generic account alerts that contain no private campaign, invitation, reward or participant details on the lock screen. Sign-out removes the visible account association. If cleanup cannot finish immediately, the app keeps a bounded device-only cleanup record containing the push token, departing account identifier and exact registration generation until cleanup is durably confirmed. If an upgraded app has not yet recovered a token that an earlier version kept only in memory, the record temporarily contains the installation credential, account identifier and a reserved generation; it blocks guest registration and becomes an exact token cleanup record when iOS returns the token. It may also retain the departing sign-in credential temporarily in device-only Keychain solely until compatibility deletion succeeds, its authority is durably rejected, or no safe authenticated fallback exists, and until session revocation is durable; a sign-out tombstone prevents it from restoring the account. The credential can be removed while the separate cleanup record remains for a later server roll-forward; new guest city-alert registration stays paused until that cleanup is durably confirmed. Turn off Quest alerts in my city or revoke notification permission to stop city alerts.
Who we are
Visitaki is operated by Makepad. For privacy questions or requests, contact support@visitaki.com.
Information you share
We use your name, email address and city, along with any optional social handles and testing interests, to review early-access applications and contact you about testing. This processing is based on your consent. Your application is not published. Support messages are used to respond to your request.
Storage and services
Applications are sent to the Visitaki team through Slack. Hosting and communication providers process information needed to deliver their services. Application information is kept for the time needed to review applications and manage testing invitations. Linked services, including Calendly, have their own privacy policies.
Using the app
Location supports exploration, nearby quests and arrival checks when you grant permission. Your exploration map is stored on your device. When you sign in to Visitaki, explored map cells are backed up to your account so they can be restored after reinstalling. A second account-specific copy and guest exploration use private iCloud storage where available. Map backups do not contain a GPS timeline. Deleting your account removes the map backup held by Visitaki. Copies on your devices and in private iCloud storage remain; use the app’s progress deletion controls before deleting the account to reset those copies. Community features process account details, completed quests and submitted content to provide the service. You can manage location permissions in your device settings and use the app’s account and progress deletion controls.
Usage analytics and optional error reports
Website analytics are enabled by default, unless you previously opted out or your browser sends a privacy preference. You can disable analytics in Privacy settings on any page. A random browser identifier lasts up to 90 days and is removed when you opt out. We use Makepad’s self-hosted OpenPanel to understand pages, sessions, public campaign sources, device/browser types and product actions. iOS usage sharing remains optional in Settings. Error reports go to self-hosted Sentry only when separately enabled. Reports exclude account identity, form answers, precise location and route history. Network services receive the IP address needed to deliver requests; our trusted proxy uses IP addresses transiently to look up approximate city, region and country in the existing GeoLite database. Raw IPs are removed before analytics queues, event properties and logs; approximate city map coordinates are not device GPS. This geography remains subject to analytics opt-outs and browser privacy signals. No session recordings are collected.
Bug reports you send
When you choose Send report in the app, your description, reviewed technical diagnostics and optional screenshot are sent to the Visitaki team in a private Slack channel. Diagnostics include device/app versions, permission and connection state, and bounded diagnostic event counters. They do not automatically include account identity, credentials or GPS history. Screenshots and text may contain personal information you choose to share; review or omit the screenshot before sending. Reports are independent of automatic analytics and error-reporting preferences. Visitaki does not keep report contents on its server; Slack retains the submitted report under the workspace retention settings. Contact support@visitaki.com with the report ID to request deletion.
Your rights
You may withdraw consent and request access, correction or deletion of your personal information at support@visitaki.com. Depending on the circumstances, you may also request restriction or portability, or object to processing. You may lodge a complaint with the CNIL or your local data protection authority.