X Marks The Spot is a treasure hunt played on a 3D globe at xmarksthespot.club. This page explains what we collect, why, and what you can do about it. Questions: support@xmarksthespot.club.
What we collect
- Your account: your email address, the display name you choose (shown on the Board), and a securely hashed password if you set one. If you sign in with Google or Apple, we receive your name and email address from them (Apple may give us a private relay address instead).
- How you play: where you drop your X on the globe, the height you dropped from, when our server received it, the clues and hints you unseal, and your finds and place on the Board.
- Fair-play signals:a scrambled (keyed hash) version of your network address, the type of device or app you play from, and an app device ID. We use these only to enforce drop limits and to spot cheating; we don’t store your raw IP address with your drops.
- Playing without an account: if you play before signing up, a random ID in a cookie keeps your progress. If you then sign up, that progress moves to your account.
- Payments: Club memberships and hint packs are paid through Stripe. Stripe handles your card details; we only see the result (for example, that your membership is active).
Cookies and local storage
We use cookies to keep you signed in, to remember a guest’s progress, and to credit referrals. Your browser also stores small conveniences, like where you last looked on the globe and whether you closed the welcome card, and a random analytics ID (in local storage, not a cookie) so we can see how people move through the game. We don’t use advertising cookies today; if we add ads, we’ll update this page and ask for consent where the law requires it.
How we use it
- To run the hunts: check your drops, keep your progress and rank you on the Board.
- To send account email (sign-in links) and, if you choose, our newsletter, the Dispatch.
- To keep the game fair and secure.
- To fix problems and improve the game: error reports when something breaks, and simple usage events (for example, that a map opened or a drop missed). These never include where you dropped or where a Mark is, and we don’t record your screen.
- To bill memberships and purchases.
We don’t sell your personal information.
Who we share it with
Only the services that run X Marks The Spot for us:
- Vercel (hosting) and Supabase (database).
- Stripe (payments) and Postmark (email delivery).
- Sentry (error reports) and PostHog (product analytics; it doesn’t keep your IP address).
- Google Maps Platform, which draws the globe. Your browser loads map imagery directly from Google, under the Google Privacy Policy.
- Google or Apple, if you choose to sign in with them.
Your display name, finds, times and Board rank are public. Your email address is never shown to other players.
Your choices
- Cancel your Club membership from your account page.
- Change your display name or email by writing to support@xmarksthespot.club.
- Ask us for a copy of your data, or to delete your account, at support@xmarksthespot.club.
- Unsubscribe from the Dispatch from any newsletter email.
Children
X Marks The Spot isn’t directed at children under 13, and we don’t knowingly collect their personal information. If you think a child has given us information, contact us and we’ll delete it.
Keeping it
We keep account and game records while your account is open, and drop records for as long as we need them for fair play and any prize claims. Guest progress that’s never claimed may be deleted.
Changes
If we change this policy, we’ll update the date above, and tell you in advance of any significant change. See also our terms of service.