Privacy Policy

1. Data Fiduciary (Controller)

The entity responsible for processing personal data, acting as Data Fiduciary under the DPDP Act 2023 and as Controller under the GDPR, is:

Scafa Investments LLC
9830 Bahama Dr
Cutler Bay, FL 33189-1568
United States
Email: info@scafa-investments.com
Website: mapraiders.com

For privacy-related queries and grievance redressal, please write to: info@scafa-investments.com. We will name a data protection officer here as soon as one has been appointed.

2. Overview of Collected Data

MapRaiders is the game at mapraiders.com/play/, which you play in the browser or in the MapRaiders app (section 6.7). When you use MapRaiders, we collect and process the following categories of personal data:

Additional Optional Data

• Photos: Only the clan picture a clan leader chooses from their files; it is shown publicly once we have approved it
• Audio: Voice chat and calls between players run live and encrypted (WebRTC, DTLS-SRTP) through our relay server, which cannot decrypt them; conversation content is neither recorded nor stored (technical connection data see section 4d)
• Push notifications: Not used at the moment; we store no push token

3. Legal Basis for Processing

We process your personal data under the following legal bases:

3.1 Under the DPDP Act 2023 (for Indian Data Principals)

• Section 6, Consent: For processing of GPS location data, the clan picture, reviews and other voluntarily provided data. Consent is free, specific, informed, unconditional, unambiguous, and given through a clear affirmative action.
• Section 7, Legitimate Uses: For processing necessary to deliver the service you have requested, to maintain security, and to prevent fraud or cheating.

3.2 Under the GDPR (for users in the EU/EEA, including Indian users travelling abroad)

• Article 6(1)(a) Consent: For the use of your device location. The game tells you on the “Start here” button itself that players near you will see your figure there. You give consent by choosing “Start here” or “Walk by GPS” and allowing location access. You withdraw consent by removing location access in your device or browser settings.
• Article 6(1)(b) Contract: For processing account data and game activity data necessary to provide the gaming service.
• Article 6(1)(f) Legitimate Interest: For processing technical data to ensure security, stability, and anti-cheat measures.

4. GPS Location Data: Detailed Information

GPS location data is particularly sensitive because it can reveal where you live, work, or spend your time. We take the protection of this data very seriously.

4.1 Collection

Your device location is only used while the game is open in the browser or in the app and you have allowed location access on your device: once when you choose “Start here”, which places your figure at your real location, and continuously while you walk by GPS. From then on, the position of your figure, at first your real location, goes about every second with your player name to players within about 1.5 kilometres (live position, section 4.2); our server removes it about one minute after your last report. The game does not collect your location in the background: once you close the game, no location is recorded. If you start at another place on the map and move with the on-screen joystick, only the position of your figure on the map is processed, not the location of your device.

4.2 Use

Your GPS data is used exclusively for:

• Taking land: when you close a loop by GPS, its outline becomes your land
• Live position: while you are in the game world, the game sends the position of your figure to our server about once a second, so that players within about 1.5 kilometres see your figure with your player name and clan, and you see theirs. After “Start here” and while you walk by GPS, this is your real position or a place close to it. We keep the position in a cache, not in the database. After about 12 seconds without a new report it is no longer shown to anyone; it is removed completely about one minute after your last report (our server clears it out once a minute, so it can take up to about 72 seconds), immediately when the account is deleted. The members of your clan see your position worldwide, whatever the distance, as long as you are in the game world and not incognito, together with how you are moving and whether you are fighting; when you are online outside the game world, they see where you are in the game (for example the menu, a deck or a duel). If you call your clan to you from the clan lobby, the members in the lobby see the position of your figure for 90 seconds, even if you are incognito. As a guest without an account you are not stored, you see no other players and they do not see you; our server then receives the position of your figure but neither stores nor uses it. For moderation, the operator can see where a player is standing at that moment.
• Incognito: in the game you can choose the stance “Incognito”. Our server then shows your figure to no other player on the map, not even to your clan, and the operator's tools do not show your location either; your land does not show whether you are playing right now. In the game world you cannot attack, and other players can neither attack nor challenge you, and in voice chat nearby you hear no one and no one hears you. Incognito does not hide everything: the game still sends the position of your figure to our server, which keeps it briefly in the cache as described above, for example for your own distance and your missions. Other players' towers can still hit you. A scout you sent out before stays visible to players near it with your player name and its path, which starts where you stood, until it is back (at most about 25 minutes). The operator's overview shows that you are on the map right now and how you are moving, but not where. Your land with its outline, player name and clan, your messages, your player card and leaderboards stay as visible as usual. If you play a duel, for example in the arena, your opponent sees you with your player name.
• Game mechanics: quests, duels, finds and buildings near you; the distance walked per kind of movement (walking, running, cycling) for missions and your player card
• Anti-Cheat: plausibility checks of loops, runs and kinds of movement

4.3 Storage Duration

We do not store a continuous track of your movements. The outline of the land you have taken and the distances walked are kept for the duration of your account, as they are essential for game operations. If raw GPS points of a route are stored, they are deleted automatically after 90 days at the latest.

4.4 No Advertising Tracking

Your GPS data is never used for advertising, advertising profiles, location analytics for third parties, or any purpose unrelated to gameplay. We do not share GPS data with advertisers, telecom operators, or tracking services.

4a. Playing Without an Account: Map, Location, Runner Leaderboard

In the game at mapraiders.com/en/play/ you can play as a guest without an account. Your browser loads the world map in tiles from our server api.mapraiders.com, which fetches them from OpenFreeMap. Our server sees the tile numbers, roughly the map area of about two kilometres you are playing, and your IP address. Like every request, the tile request appears with IP address and tile number in the server log, which we delete after 30 days at the latest (section 5). Beyond that we store nothing for this; the IP address is held in memory for up to ten minutes only to limit requests (abuse protection). OpenFreeMap receives only the tile numbers, not your IP address.

If you choose "Start here" or "Walk by GPS", your browser asks for your location. As a guest, the game sends the position of your figure to our server, which neither stores nor uses it (section 4.2); as a guest you see no other players and you are not shown to them. Territory, revealed cards and collected finds of a guest are stored only by your browser; you delete them with your browser's site data.

Only if you play the runner in the colosseum and enter the leaderboard do we process: the nickname you choose, your score, run duration and the place of the leaderboard, and a random identifier of your browser, which your browser creates and stores itself. We store this identifier only as a one-way hash; it makes sure a nickname can only be used by you. Beyond that, we do not store your IP address for this (server log see section 5); it is only held in memory to limit requests and new nicknames (abuse protection) and deleted there by the end of the day (UTC) at the latest.

Nickname and score are publicly visible on the leaderboard. The legal basis is your consent under Article 6(1)(a) GDPR and under the DPDP Act 2023 (you add yourself to the leaderboard voluntarily). You can remove your name with all its runs at any time in the colosseum with "Delete my name"; the deletion takes effect immediately. We also delete entries with names that are not allowed.

4b. Audience Measurement and Game Statistics

Website visits. To understand how many people visit mapraiders.com and where they come from, we count page views without cookies, without a counting script and without a tracking pixel. We only use what your browser sends to our server with every page request anyway, and of that only: IP address, the page requested without attached parameters, campaign tags from the link (utm_source, utm_campaign), time, the address of the referring website without its subpage, browser identifier (user agent), preferred language, technical details from the browser about the kind of request (whether a page is opened or only preloaded), whether the connection is encrypted and whether the browser loaded the page’s brand mark (this shows us that a real browser is displaying the page). These details are kept for at most three days in a separate log on our server at Hetzner in Germany and are then deleted automatically. Every 15 minutes our server turns them into daily totals: page views, number of visitors, entry pages, origin (only the name of the referring website, such as “Google”; websites that sent only one visitor on a day are not named), campaign tags, language and device type (phone, tablet, desktop), and browser type with major version. With the technical details we tell visits by people apart from automated requests (bots) and from pages that a browser or search engine only preloads; we count such requests separately and only as totals. Apart from the general server log (section 5), only these totals are stored, no IP address, no identifier and nothing that could be linked to a person or an account. We build no profiles, do not follow you across other websites and pass nothing on to third parties.

Game statistics with an account. When you play signed in at mapraiders.com/en/play/, the page sends a heartbeat about every 25 seconds and whenever the part of the game changes, while it is visible and you are playing, with the part of the game currently shown (map outdoors, map at home, card duel, deck building, menu). This produces sessions and play time for your account. We also store the time and method of your sign-ins (password, Google, Apple) and the start of card duels. When someone starts filling in the sign-up form, we add one to a daily count without storing anything about the person. In the same way, on the game page without an account we only count as daily totals how often the game is started, the first loop is closed, a hint to sign up is shown or the sign-in window is opened. We use this information to improve the game and to see where players get stuck. It is included in your account's data export.

Legal basis and objection. The legal basis is our legitimate interest in measuring and improving our service (Art. 6(1)(f) GDPR). If your browser sends the “Global Privacy Control” or “Do Not Track” signal, we do not count your page views, the game page sends no heartbeat and increases none of these daily totals. Sign-ins and duel starts of your account are still stored. You can also object at any time under Art. 21 GDPR by email to info@scafa-investments.com. We then delete your account's sessions and sign-ins and record no new ones for your account.

Retention. Page view log: at most three days. Daily totals of the website and of the game page: no time limit, they contain no personal data. Sessions, sign-ins and duel starts: 13 months, after which we delete them automatically, immediately on account deletion.

4c. Reviews of the Game

When signed in, you can review the game in your account under “Rate the game”. We then store your stars (1 to 5), your optional text, the language of the game, the time and your consent. The review appears publicly with your player name and the date on mapraiders.com/en/reviews/. The legal basis is your consent under Article 6(1)(a) GDPR, which you give expressly before sending. You can change or withdraw the review in the game at any time; once withdrawn it is deleted and no longer visible at once, and the same happens when you delete your account. We hide reviews containing spam or unlawful content; we never remove one because it is negative. The review is included in the data export of your account.

4d. Messages, Voice Chat, Clan Picture and Reports

Messages. Messages you write to other players or in your clan are stored on our server so that the recipients can read them, and are deleted with your account. You can block a player; you then no longer receive messages or calls from them.

Voice chat and calls. When you switch on voice chat or take part in a call, your voice goes live from your device to the other players over WebRTC, encrypted (DTLS-SRTP) and always through our own relay server (TURN), so that no player learns another player's IP address. Each device is connected to every other participant on its own, in calls with several people too; no server mixes or decrypts the sound. The relay server only passes on encrypted packets and cannot listen in. Our server arranges the connection setup and in doing so also passes on the devices' key fingerprints; unlike some messengers, you cannot check these yourself, so we do not call this end-to-end encryption. Conversation content is neither recorded nor stored. Our relay server logs technical connection data such as IP addresses for at most 30 days, never the content of conversations.

Clan picture. A clan leader can upload a clan picture (PNG or WebP). The game redraws the picture before uploading, which removes embedded metadata such as a location. The picture is stored in our database and shown publicly once we have approved it. The clan leader can remove it at any time. The legal basis for messages, voice chat and the clan picture is Article 6(1)(b) GDPR.

Reports. You can report a player from the chat or from the player card. We then store who reported whom, from where and when. The operator looks at open reports and closes them; nothing happens to an account automatically because of a report. A report is deleted when the account of the reporting or of the reported player is deleted. The legal basis is our legitimate interest in a safe game for all players (Art. 6(1)(f) GDPR) and, under the DPDP Act 2023, the legitimate use of keeping the service safe (Section 7).

5. Data Retention

Upon account deletion, all personal data is deleted from our database immediately. Database backups are overwritten after 60 days at the latest. Legal retention obligations remain unaffected. This satisfies Section 8(7) of the DPDP Act 2023 (erasure once purpose is no longer being served).

6. Data Sharing and Third-Party Service Providers

6.1 Google Sign-In and Sign in with Apple

When you register or sign in via Google Sign-In, MapRaiders receives your verified email address from Google and uses only that. Your Google name is not used: a new account receives a neutral player name (Raider_ followed by four characters), which you can change in the game. No additional Google data is collected. Google's Privacy Policy also applies. When the game shows the Google sign-in, your browser loads a script from Google; Google learns your IP address in the process. With Sign in with Apple on Apple devices, we receive your email address (or the forwarding address Apple creates) and a stable Apple identifier; when you delete your account, we also revoke the sign-in with Apple.

6.2 Hosting and Infrastructure

Our servers are operated by Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany), a German hosting provider that processes data exclusively in Germany and the EU. A Data Processing Agreement under GDPR Article 28 is in place with Hetzner. For Indian users, this means your data is stored in a jurisdiction with adequate data protection standards.

Emails. We send confirmation, password and service emails through the mail server of united-domains GmbH in Germany. The legal basis is GDPR Article 6(1)(b).

Network services. Name resolution (DNS) for mapraiders.com is run by BunnyWay d.o.o. (bunny.net, Cesta komandanta Staneta 4A, 1215 Medvode, Slovenia, EU) on servers distributed worldwide. In doing so, bunny.net processes the address of the querying DNS server (with some DNS providers also a shortened part of your IP address), the requested name and the time, and estimates your country from them. Visitors from East, Southeast and South Asia and from Australia and New Zealand receive the main domain mapraiders.com through the bunny.net content delivery network (CDN); the game backend api.mapraiders.com does not run through it. A bunny.net server in their region, that is, outside the EU, receives the complete page request (including IP address, browser identifier, language, referring page and requested address), serves images, fonts and program files from its cache (for at most one day) and fetches the pages from our server; it passes the IP address on to our server. We have switched off access logs at bunny.net. With a VPN or a foreign DNS service, the assignment to a region may differ. Visitors and players from Russia reach the website and the game (including api.mapraiders.com) through a relay server in Moscow that we rent from LightNode, LLC (6/F Manulife Place, 348 Kwun Tong Road, Kowloon, Hong Kong), because direct connections from some Russian networks to Germany are unreliable. This server passes the encrypted connection through unchanged. It sees the IP address, the time, the requested domain name and the amount of data, but not the content. We have switched off connection logs there; only in the event of serious technical errors can an address briefly appear in an error message. We have no influence over records kept by the provider or over access by authorities in Russia. bunny.net processes this data on our behalf and only to establish the connection; a Data Processing Agreement under GDPR Article 28 is in place with bunny.net. LightNode processes this data only to establish the connection. There is no data processing agreement with LightNode yet. The legal basis is our legitimate interest in a fast and reachable website (GDPR Article 6(1)(f)).

6.3 No Sale of Personal Data

We do not sell, rent, or transfer your personal data to third parties for advertising, marketing, or analytics purposes. No advertising SDKs or third-party tracking tools are used in the app.

6.4 Map Services: OpenFreeMap and OpenStreetMap

The game map, in the browser and in the app, is drawn from vector tiles of the map service OpenFreeMap (openfreemap.org) with map data from OpenStreetMap. Your device does not load the tiles from OpenFreeMap directly but from our server api.mapraiders.com, which fetches them from OpenFreeMap and keeps them in a cache. OpenFreeMap therefore receives only tile numbers, not your IP address and no player data such as your name, email address or game progress (details in section 4a). To check whether a building has forest or water nearby, and for the subway lines of some cities, our server also queries OpenStreetMap data from the Overpass API (overpass-api.de) for the map area concerned; only that map area is sent, no personal data. The legal basis is Article 6(1)(b) GDPR, or your consent under the DPDP Act 2023 (the map display is required for gameplay). Map data © OpenStreetMap contributors, ODbL.

6.5 Push Notifications

The game does not send push notifications at the moment and does not store a push token. If we introduce them, we will update this privacy policy beforehand.

6.6 Camera and Microphone Access

The game uses your microphone only while you use voice chat or a call with other players. Your voice goes live and encrypted to the other players, through our relay server, which cannot decrypt it; it is neither recorded nor stored (technical connection data see section 4d). The camera is not used; a clan picture is chosen from your files. The MapRaiders app does not request microphone access in its current version; voice chat is available in the browser. You allow microphone access in your device or browser and can withdraw it there at any time; processing in voice chat rests on the same legal basis as in section 4d.

6.7 The MapRaiders App

The MapRaiders app opens the game at mapraiders.com/play/; everything in this privacy policy applies to it. The app uses your location only while it is open and you walk by GPS. It does not request background location, microphone or camera access and contains no advertising, analytics or crash reporting components. Links to other websites open in your device's browser.

6a. Data Transfers to Other Countries

MapRaiders uses service providers located outside India:

• Hetzner Online GmbH (Germany): Server hosting. Germany is recognised as a country with strong data protection laws (GDPR).
• Google LLC (USA): Google Sign-In. Email address for social login; your IP address when the sign-in script loads.
• Apple (Sign in with Apple, only if you choose it): for users in the EU, Apple Distribution International Limited (Ireland) is responsible for this data. According to Apple, it transfers data to Apple Inc. in the USA on the basis of EU Standard Contractual Clauses. We receive your email address or Apple’s forwarding address and an Apple identifier. When you delete your account, we send Apple only the details needed to revoke the sign-in.

The Indian government has not yet notified specific restricted countries under Section 16 of the DPDP Act 2023. Transfers are based on contractual safeguards and your consent.

Our database and its backups are kept on Hetzner servers in Germany, on a second server in Germany and on a backup computer of the operator. Please note: the controller is a company based in the United States and may be subject to US law there, including requests from authorities to hand over data.

Routing outside the EU. For connections from the regions of Asia and Oceania named in section 6.2, bunny.net servers in those regions answer the page requests; connections from Russia run encrypted through the server in Moscow. We use both routes only for connections that, according to our location estimate, come from these countries, not for connections from the EU. Account, GPS and game data continue to be stored only in the places named above.

6b. Automated Decision-Making

MapRaiders checks automatically whether loops, runs and scores are plausible, for example by the kind of movement and the pace, in order to detect GPS spoofing and cheating. A loop or score that fails these checks is rejected automatically. Accounts are not suspended or restricted automatically; such measures, and the handling of reports, are decided by a person.

This is not a decision within the meaning of GDPR Article 22, because it has no legal or similarly significant effect on you. If you think a rejection was wrong, a person will review it when you write to us at info@scafa-investments.com.

7. Advertising

MapRaiders contains no advertisements and uses no ad trackers. We do not set cookies for advertising purposes. There is no ad tracking, no retargeting, and no profiling for advertising partners.

8. Your Rights as a Data Principal / Data Subject

Whether you are a Data Principal under the DPDP Act 2023 or a Data Subject under the GDPR, you have the following rights, which you may exercise at any time.

Right to Access (Section 11 DPDP / Article 15 GDPR)

You may request a summary of personal data being processed, the processing activities undertaken, and the identities of any other Data Fiduciaries with whom your data has been shared.

Right to Correction and Erasure (Section 12 DPDP / Articles 16, 17 GDPR)

You may request correction of inaccurate data and erasure of personal data once the purpose of processing has been fulfilled. You can change your player name directly in your account in the game. You can delete your account in the game under Menu, Account, Security, Delete account, or by writing to us.

Right to Grievance Redressal (Section 13 DPDP)

You may raise a grievance with us as Data Fiduciary. We will respond within a reasonable period. If not resolved, you may approach the Data Protection Board of India.

Right to Nominate (Section 14 DPDP)

You may nominate another individual to exercise your rights in case of your death or incapacity.

Right to Data Portability (Article 20 GDPR)

You have the right to receive your personal data in a structured, commonly used, machine-readable format. You can download your data as a JSON export in your account in the game, or write to us and we will provide it.

Right to Object (Article 21 GDPR)

You have the right to object to processing based on legitimate interests.

Withdrawal of Consent

If processing is based on your consent (in particular GPS data), you may withdraw consent at any time. Withdrawal does not affect the lawfulness of prior processing. You can withdraw location access at any time in your device or browser settings.

Right to Lodge a Complaint

If you believe processing of your personal data violates the law, you may lodge a complaint with the Data Protection Board of India (once notified by the Central Government), or, if you are in the EU, with a GDPR supervisory authority, in particular that of the EU state in which you live or work or in which the alleged infringement took place (GDPR Article 77). A list of the EU authorities is available at edpb.europa.eu. Indian consumers may also approach the National Consumer Helpline at 1915.

Contact for all requests: info@scafa-investments.com. We respond without undue delay and within one month at the latest (GDPR Article 12(3)).

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data, in line with Section 8(5) of the DPDP Act 2023 and GDPR Article 32:

• Encrypted data transmission (TLS/HTTPS) between your device and our server
• Voice chat and calls encrypted between the devices (WebRTC, DTLS-SRTP), through our own relay server, which cannot decrypt the content
• Encrypted password storage (bcrypt hashing)
• Authentication via JWT tokens with limited validity
• Regular security updates of server software
• Access restrictions to personal data limited to authorised operators
• Servers in German data centres (Hetzner), backups as described in section 6a; routing outside the EU see 6.2 and 6a

10. Protection of Children

MapRaiders is intended for people aged 18 and older. By registering, you confirm that you are at least 18. If we learn that an account belongs to a younger person, we delete it. We do not undertake tracking, behavioural monitoring, or targeted advertising directed at children.

11. Changes to This Policy

We may update this Privacy Policy to reflect legal changes (such as future DPDP Rules notified by MeitY) or changes in app functionality. The current version is always available at mapraiders.com/en-in/privacy.html. For material changes, we will notify you via in-app notification.

Last updated: 18 October 2026