Privacy Policy

This privacy policy informs you, in accordance with Articles 13 and 14 of the EU General Data Protection Regulation (GDPR), § 5 of the German Digital Services Act (DDG) and § 25 TDDDG, about how personal data is processed when you use the SECTOR platform (sector.tachora.app), a service for location-based live city games. The legally binding version of this policy is the German one; this English translation is provided for convenience.

1. Controller (Art. 4(7) GDPR)

Dmytro Bezrukov
Tachora — sole proprietorship (Einzelunternehmen)
Neue Grabenstraße 24, 32657 Lemgo, Germany
Email: support@tachora.app

2. Data Protection Officer

A data protection officer is not currently required under Art. 37 GDPR in conjunction with § 38 BDSG. Please direct privacy enquiries to the email address in Section 1.

3. Processing activities, purposes and legal bases

We process personal data only to the extent necessary to provide the respective feature.

3.1 Player account

• Data processed: email address, password hash, display name (call-sign), language.
• Purpose: provision of the SECTOR platform, sign-in, participation in games as a player or team.
• Legal basis: Art. 6(1)(b) GDPR (contract / use relationship).
• Retention: until you delete your account; then deletion or anonymisation.

3.2 Location data during a game

• Data processed: your device's GPS position, transmitted at short intervals (about every 15 seconds), only while you are actively taking part in a game.
• Recipients: the organiser of the respective game session and — depending on the game mode — fellow players or teams in the same session (e.g. live map; in elimination mode, players who have already been eliminated can see the positions of active players). No sharing with anyone outside your session.
• Purpose: core game mechanics (live map, hunt, zone mode, proximity features).
• Legal basis: Art. 6(1)(a) GDPR (consent via your browser/device location permission) and Art. 6(1)(b) GDPR (running the game at your request). You can revoke location sharing at any time in your device settings.
• Retention: only the latest position is kept and continuously overwritten. After the game ends, position data is deleted; no persistent movement profile is created.

3.3 Photo tasks and automatic verification

• Data processed: photos you upload for a task.
• Processing: photos are stored in the platform's storage (Supabase). If the organiser has enabled automatic AI-assisted task verification, the photo is sent to Anthropic PBC (Claude, USA) for verification (met / not met). Otherwise the check is performed manually by the organiser or a moderator. In case of doubt, a human always decides.
• Purpose: verification of game tasks.
• Legal basis: Art. 6(1)(b) GDPR (running the game).
• Retention: for the duration of the game session; deletable on request or upon account deletion.

3.4 Game history and messages

• Data processed: game events (e.g. solved tasks, points, the "kill feed" in elimination mode) and messages within a session.
• Purpose: proper conduct of the game, scoring and ranking.
• Legal basis: Art. 6(1)(b) GDPR.
• Retention: as part of the game history, until deletion of your account or the related game data.

3.5 Contact / support

• Data processed: the contents of your message and the contact details you provide.
• Purpose: answering your enquiry.
• Legal basis: Art. 6(1)(b) GDPR; for purely informational enquiries Art. 6(1)(f) GDPR.
• Retention: 12 months after the matter is closed.

4. Recipients / processors

We use carefully selected service providers with whom data processing agreements under Art. 28 GDPR are in place. Personal data is shared only to the extent necessary to provide the respective function.

5. Transfers to third countries

Where processing takes place outside the European Economic Area (EEA) — in particular with Anthropic and, where applicable, the game-server provider — this is based on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR) plus supplementary technical measures (transport encryption, data minimisation).

6. Your rights as a data subject

Under Articles 15–22 GDPR you have the right to:

• access (Art. 15), rectification (Art. 16), erasure (Art. 17),
• restriction of processing (Art. 18), data portability (Art. 20),
• object to processing based on legitimate interest (Art. 21),
• withdraw consent with effect for the future (Art. 7(3)).

Exercising these rights is free of charge. Please contact support@tachora.app. We respond within one month (Art. 12(3) GDPR).

7. Right to lodge a complaint (Art. 77 GDPR)

You have the right to lodge a complaint with a supervisory authority. For the controller's seat (Lemgo, North Rhine-Westphalia) the competent authority is:

State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW)
Kavalleriestr. 2–4, 40213 Düsseldorf, Germany
Email: poststelle@ldi.nrw.de

8. Cookies and similar technologies (§ 25 TDDDG)

SECTOR uses only technically necessary storage technologies; no consent is required under § 25(2)(2) TDDDG:

• Authentication cookie (Supabase Auth session) — required for sign-in; session lifetime.
• Language cookie (NEXT_LOCALE) — stores your language choice.

We do not use tracking, advertising or analytics cookies.

9. Security of processing (Art. 32 GDPR)

• Transport encryption (TLS 1.2+) for all transmissions;
• Password hashing to the state of the art (via Supabase Auth);
• Row-level security on the database layer to isolate user data.

10. Automated decision-making

The optional AI check of task photos only assesses whether a game task is met (accepted / rejected / unclear). No decision based solely on automated processing with legal effect within the meaning of Art. 22 GDPR takes place; in case of doubt a human (organiser or moderator) decides.

11. Changes to this policy

We update this policy upon material changes in our processing. The current version is available at sector.tachora.app/en/datenschutz.

Last updated: July 14, 2026