This Privacy Policy explains what personal data Lost On Purpose ("we", "us") collects, why we collect it, and what rights you have over it. We are based in Spain and aim to comply with the EU General Data Protection Regulation (GDPR).
Lost On Purpose is operated as an independent project. For any privacy-related question or request, contact us at lostonpurpose.support@gmail.com.
| Category | Examples |
|---|---|
| Account data | Email address, password (stored securely as a hash, never in plain text) |
| Location data | GPS coordinates while an Operation is active, used to detect arrival at a location and to verify photo submissions |
| Photos | Images you submit to complete certain in-game challenges |
| Gameplay data | Selected city, themes, group size, in-game chat messages with the Bureau Operative, and completed Operation history |
| Payment status | Whether you hold an active subscription, and a customer reference ID — your card details are handled entirely by LemonSqueezy and never reach our systems |
| Optional API key | If you choose to activate the "Independent Bureau Frequency" feature, the personal API key you provide |
| Technical data | IP address, browser type, and similar information collected automatically by our hosting provider |
We use the following service providers ("sub-processors") to operate Lost On Purpose. We do not sell your personal data to anyone.
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, file storage | EU (Ireland) |
| Groq | AI processing for Operation generation, in-game chat, and photo verification | May process data outside the EU |
| LemonSqueezy | Payment processing (Merchant of Record) | Global |
| Vercel | Website hosting | Global content delivery network |
| Google (Gmail) | Sending account verification and notification emails | Global |
Some of the providers above may process data outside the European Economic Area. Where this occurs, we rely on the safeguards offered by these providers, such as Standard Contractual Clauses, to ensure your data remains protected.
We retain your account and gameplay data for as long as your account remains active. If you delete your account, we will delete or anonymize your personal data within a reasonable period, except where we are required to retain certain records (for example, billing records) for legal or accounting purposes.
If you are in the EU/EEA, you have the right to: access the personal data we hold about you; correct inaccurate data; request deletion; request a copy of your data in a portable format; object to or restrict certain processing; and withdraw consent at any time. To exercise any of these rights, contact us at the email address above. You also have the right to lodge a complaint with your local data protection authority — in Spain, this is the Agencia Española de Protección de Datos (AEPD).
Lost On Purpose is intended for users aged 16 and over, or the minimum age of digital consent in your country if higher. We do not knowingly collect data from children below this age. If we become aware that we have done so, we will delete that data promptly.
We use industry-standard measures to protect your data, including encrypted connections (HTTPS) and database-level access controls (Row Level Security) that restrict each user's data to that user alone. No system can guarantee absolute security, but we take reasonable steps to protect your information.
We use your browser's local storage to keep you signed in between visits. We do not use third-party advertising or tracking cookies.
We may update this Privacy Policy from time to time. The "Last updated" date above will reflect the most recent revision.
For any question about this Privacy Policy or your data, write to lostonpurpose.support@gmail.com.