Privacy Policy – Epic Scape

1. General

Epic Scape ("Service") is committed to protecting the privacy of its users and processing personal data in accordance with the General Data Protection Regulation (GDPR) and the Finnish Data Protection Act. This privacy policy explains what personal data we collect, how we process it, and what rights you have regarding your data.

2. Data Controller

Epic Scape
Maria 01
Lapinlahdenkatu 16, 00180 Helsinki
Jyri Puhakka
jyri@epicscape.game

3. What Data Do We Collect?

We collect and process the following data:

Nickname – The player’s chosen nickname is stored in the game system to enable gameplay functionality. Note that nicknames may contain personal data if voluntarily provided by the user.
Player ID – A unique, automatically generated identifier is assigned to each player for internal tracking purposes. This identifier does not directly identify a natural person.
Game events and interaction data – We collect detailed in-game event data, such as actions taken by the player (e.g. opening a card, completing or abandoning a puzzle, submitting answers), including timestamps and the sequence of events.
Gameplay metadata – Additional contextual data related to gameplay, such as time spent on puzzles or cards, number of attempts, and whether a puzzle was completed or abandoned.
Session and performance data – Information such as total playtime, number of hints used, and estimated distance walked during gameplay.
Approximate location context – The selected game track (e.g. a specific city area or venue) provides approximate location context. We do not collect precise location data such as GPS coordinates.
Estimated walking distance – Walking distance is calculated based on predefined distances between game points within a track. This is a rough estimate and may not reflect the player’s actual movement.
Contact information (e.g., name, email address) – Only if the user voluntarily provides it, for example when submitting feedback and requesting a response.
Written feedback and survey responses – If a player submits feedback or participates in surveys, the provided information is stored.

All gameplay data is processed in a pseudonymised form and cannot be directly linked to an identifiable individual without additional information.

4. How Is the Data Used?

Collected data is used for the following purposes, each based on a specific legal basis under the General Data Protection Regulation (GDPR):

Enabling gameplay – The nickname, player ID, and game data are used to provide and maintain the game experience. This processing is based on contractual necessity.
Service improvement and analytics – Gameplay data, including interaction patterns and performance metrics, is used to analyze player behavior, balance game difficulty, optimize content, understand player flow, and detect bugs. This processing is based on our legitimate interest in developing and improving the Service.
Customer service and communication – If the user provides contact details, they are used to respond to inquiries or feedback. This is based on legitimate interest.
Marketing and notifications – These are sent only with the user's explicit consent. Users can withdraw their consent at any time.
Fulfilling legal obligations – In rare cases, data may be processed to comply with applicable laws or regulatory requests.

We only collect and process data that is necessary for gameplay functionality and service improvement.

5. How Is the Data Stored and Protected?

Your data is stored in secure systems and is only accessible to individuals who need it to perform their duties. We implement appropriate technical and organizational measures to ensure data security.

6. Who Has Access to the Data?

We do not sell or disclose personal data to third parties without your consent, except in the following cases:

Legal obligations (e.g., requests from authorities).
Technical service providers who assist in operating our services (e.g., hosting and backend infrastructure such as Supabase), under appropriate data processing agreements.
Partner venues and staff – Authorized personnel at partner locations (e.g. libraries or venues hosting a game track) may have access to gameplay data related only to their specific track. This data is limited to pseudonymised gameplay information and does not include direct personal identifiers.

7. Cookies and Analytics

Our website and services, may use cookies and analytics tools to enhance user experience. Cookies may be used, for example, to ensure the proper functioning of the game and remember user preferences.

Consent: We only use non-essential cookies, such as marketing and analytics cookies, if you have given explicit consent. You can manage or withdraw your cookie consent at any time through your browser settings.

Users who do not wish to use cookies can also disable them via their browser settings. Please note that disabling cookies may affect the functionality of certain features.

8. How Long Is Data Retained?

We retain personal data only as long as necessary to fulfill the purposes listed above or to comply with legal obligations. Specific retention periods include:

Nicknames and game data – retained for 12 months after last user activity.
Contact information – retained for 6 months after the inquiry has been resolved.
Survey responses and feedback – retained for 12 months unless deletion is requested.

9. User Rights

Since we store player nicknames and game data, users have the following rights under the General Data Protection Regulation (GDPR):

Request deletion of their nickname and game data from the system.
Obtain information about how their data is used and access a copy of their data.
Request correction of inaccurate or incomplete data.
Object to or restrict the processing of their personal data in certain cases.

If you wish to exercise any of these rights, please contact us at jyri@epicscape.game.

Right to lodge a complaint: If you believe that your data has been processed unlawfully, you have the right to file a complaint with the Finnish Data Protection Authority (Tietosuojavaltuutetun toimisto).

Contact details:

Website: tietosuoja.fi
Email: tietosuoja@om.fi
Address: P.O. Box 800, FI-00531 Helsinki, Finland

11. Automated Decision-Making

Epic Scape does not use automated decision-making that produces legal or similarly significant effects on users. Gameplay data may be analyzed in aggregate to improve the Service, but it is not used to make individual decisions that significantly affect users.

12. Changes to This Privacy Policy

We reserve the right to update this privacy policy. We recommend checking this policy regularly.