Privacy Policy

Last updated: 31 August 2026

Wunder City ("we", "us", "our") operates the Wunder City mobile application (the "App"). This Privacy Policy explains what personal data we collect, why we collect it, and your rights regarding that data.

By using the App you agree to this policy. If you do not agree, please do not use the App.

1. Data We Collect

We collect the following categories of data:

Account information — email address and chosen display name when you create an account.
Profile photo — an optional photo you upload as your avatar.
Location data — precise GPS coordinates while the App is open, used solely to show nearby treasure drops on the map and to verify you are within claim range. We do not collect location in the background.
Game activity — drops claimed, points earned, leaderboard rank, streaks, and redemption history.
Push notification token — to send you alerts about nearby drops (only if you grant permission).
Analytics & session data — we use PostHog for first-party product analytics (screens opened, hunts started, drops claimed) and optional session replays to improve the App. Session replays mask all text inputs. We do not use this data for advertising or share it with data brokers.
Device information — operating system version and platform, collected with analytics events.

2. How We Use Your Data

To provide core app functionality (map, claiming drops, leaderboard, shop).
To verify your proximity to a drop before awarding points.
To send push notifications about nearby rewards (opt-in only).
To display your profile, rank, and history within the App.
To improve the App through anonymised usage analytics.
To communicate transactional messages (email verification, prize codes).

We do not sell your personal data. We do not use your data for third-party advertising.

3. Data Sharing

We share data only with the following service providers, each of which is bound by appropriate data-protection agreements:

Supabase — database, authentication, and file storage (EU/US infrastructure).
PostHog — first-party product analytics and session replay (US infrastructure). Not used for advertising.
RevenueCat — subscription and in-app purchase management.
Apple — push notifications via APNs; in-app purchase processing via StoreKit.

4. Data Retention

We retain your account data for as long as your account exists. When you delete your account (see Section 6), all personal data associated with your account is permanently deleted within 30 days.

Anonymised, aggregated analytics data may be retained indefinitely.

5. Your Rights

Depending on your location you may have rights to access, correct, or delete your personal data, and to object to or restrict its processing. To exercise these rights, email us at hello@wundercity.app.

If you are in the European Economic Area, you also have the right to lodge a complaint with your local supervisory authority.

6. Account Deletion

You can delete your account at any time from within the App: go to Profile → delete account. This permanently removes your profile, points, history, and all associated personal data. You can also email hello@wundercity.app to request deletion.

7. Children's Privacy

The App is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

8. Security

We use industry-standard security measures including HTTPS for all data in transit, Supabase Row Level Security for data at rest, and hashed credential storage. No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

9. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes via in-app notice or email. The "Last updated" date at the top of this page reflects the most recent revision.

10. Contact

If you have questions about this policy, contact us at:
hello@wundercity.app