Privacy policy — Hunt.It

This is a translation of the French policy, which is the reference version.

Last updated: 22 October 2026 Data controller: Antoine Goube, sole trader (EI), trading as "Hunt.It" — SIREN 919 406 462 — 4 chemin François Lefeuvre, 92420 Vaucresson, France Contact: contact@huntit.fr

1. Introduction

Hunt.It (the "app") is a car-collecting game: you photograph cars you spot in the street, collect them and level up. This policy explains what data the app processes, why, and what your rights are.

We apply the principle of data minimisation: you can play without an account and without giving your identity, and we only keep what the game needs.

2. Data we process

2.1 Photos (camera)

When you make a spot, you take a photo with the camera. This photo is sent to our servers to identify the car (see §2.6), check that the spot is valid and show it on the shared map. Other players can see it on the map. Licence plates are blurred before the photo is saved (see §2.6). Please avoid photographing people: only the car is concerned.

2.2 Location (GPS)

With your permission, the app uses your position only while you are using it to:

record where a spot was made;
show the map and your live position;
work out the city of a spot (reverse geocoding).

The position is linked to your spots and sent with the spot to our servers so that it can be shown on the shared map, visible to other players.

2.3 Game progress

Garage, level, experience, coins, challenges, titles and game statistics are stored locally on your device, and a copy is backed up online on our servers (even without an account) so that it is not lost. With an account (§2.4), you can restore it on another phone. A player ID (6 characters) is generated at random; it contains no personal data.

2.4 Anonymous session and account (optional)

To save your spots, the app opens an anonymous session: a random technical identifier is created, unrelated to your identity. It links your spots to your device and helps limit abuse.

If you wish, you can create an account with an email address and a password, to keep your progress and retrieve it elsewhere. In that case your email is stored by our authentication provider (Supabase), your password is kept only in encrypted form, and the recovery code (forgotten password) only as an irreversible fingerprint.

2.4 bis Nickname, team, friends and messages

Your nickname, level, team, friends, races and team messages are stored on our servers and visible to the players concerned. Nicknames and team names are checked (list of banned words, then analysis by an AI, Anthropic) before being accepted; only the name is sent.

2.5 Notifications

With your permission, the app can send local notifications (reminders: spot available, fuel refilled, challenges…). You can turn them off at any time in your phone settings or in the app settings.

2.6 Artificial-intelligence recognition and licence plates

The photo is sent to an artificial-intelligence model (Claude, by Anthropic) which works out the make, model, colour and, if readable, the licence plate and its country. This analysis is used only to validate the spot and prevent cheating (for example, spotting the same car twice).

Plates are blurred: the AI locates plates in the photo and we pixelate them before the photo is saved on our servers. Older photos are blurred in the same way the next time their owner opens the app. No automatic blur is perfect: if you see a readable plate, report the spot or write to us and we will remove it.
The plate is never stored in clear text: we only keep an irreversible fingerprint (hash), enough to detect a duplicate but impossible to turn back into a plate number.
Anthropic receives only the photo, without your identifier or your position.

2.7 Advertising and in-app purchases

Rewarded ads (AdMob / Google): to get fuel or an extra spot, you can watch an ad. Google may then use your device's advertising identifier. On iPhone we ask for tracking permission (ATT); in the European Economic Area a consent form is shown. You can say no: the game works exactly the same, with non-personalised ads.
In-app purchases (RevenueCat, Apple / Google): payments are handled by Apple or Google; we have access neither to your card nor to your identity. RevenueCat receives the anonymous technical identifier of your account and your purchase history to confirm that purchases were made.

2.8 Reports and blocks

When you report content or block a player, we record your technical identifier, the content concerned and the reason. This information is visible only to the moderation team, never to other players.

2.8 bis Safe driving and referral

While the camera is open, your phone's speed (from GPS) is used to check that you are not spotting while driving. If the phone is moving, the app asks whether you are a passenger. We record on your account that you accepted the safety rules (date and version) and your answers "I'm a passenger" / "I'm driving" (date and measured speed), so that we can prove that the instructions were given. If you use a referral code, we record the link between your account and your sponsor's, in order to pay the rewards.

2.9 Data we do NOT collect

The app never asks for your real name, your phone number or your contacts. Your email is requested only if you choose to create an account. We do not sell any data.

3. Why (legal bases)

Providing the game you ask for (performance of a contract): spots, garage, backup, races, rankings, teams, friends, purchases.
Your consent: camera, location, notifications and personalised advertising. You can withdraw it at any time (phone settings, or the ad-consent form in the app); the game keeps working.
Our legitimate interest in keeping the game safe and fair: anti-cheating (plate fingerprint), safe driving (recording "passenger" answers), nickname checks, moderation and fighting abuse.

4. Hosting and third-party services

Hosting (Supabase): photos, positions and analysis results of your spots are stored with our hosting provider Supabase, in the European Union (Ireland).
Advertising (Google AdMob) and purchases (RevenueCat): see §2.7.
Artificial intelligence (Anthropic): photos are analysed through Anthropic's API (see §2.6), under its own privacy policy.
Geocoding: converting a position into a city is done by the operating system's location service (Apple / Google).
Website (huntit.fr): hosted by Hostinger. The website uses no cookies, no audience measurement tool and no advertising. Like any host, Hostinger records technical logs (IP address, page requested) for server security.

Transfers outside the European Union. Some providers are located in the United States: Anthropic (analysis of photos and nicknames), Google (advertising), RevenueCat (purchases); Supabase is a US company that hosts our data in the European Union. These transfers are covered by the European Commission's standard contractual clauses and, where applicable, by the EU–US Data Privacy Framework. You can ask us for a copy at the contact address.

5. Retention

Local data (game progress) is kept as long as the app is installed; uninstalling deletes it. Data hosted online (spots, profile, backup) is kept as long as your account exists. You can delete everything yourself: Settings → "Delete my account and data" erases your account, your spots and their photos, your profile, your friends, your online backup, your safe-driving answers and your referral links. Reports you have made are kept for as long as needed for moderation and the security of the service, at most one year.

6. Security

We take reasonable measures to protect data: access to data limited by server-side rules, encrypted passwords and recovery codes, blurred plates, abuse limits.

7. Your rights

Depending on your jurisdiction (notably the GDPR in the EU), you have rights of access, rectification, erasure and objection. You can:

delete your account and all your online data from the app's Settings;
delete local data by uninstalling the app;
revoke camera / location / notifications in your phone settings;
contact us at contact@huntit.fr for any other request: access, rectification, erasure, restriction, objection, portability, removal of a photo. We reply within one month;
set instructions for what happens to your data after your death;
lodge a complaint with the CNIL (www.cnil.fr), the French data protection authority.

8. Children

The app is not intended for children under 13 and does not knowingly collect their data. Between 13 and 15, a parent's agreement is required for processing based on consent (notably personalised advertising): without it, refuse ad tracking; ads then remain non-personalised and the game works the same.

9. Changes

We may update this policy. The "last updated" date at the top will change accordingly.

10. Contact

For any question: contact@huntit.fr.