Ship Seek: Privacy Policy

This is a draft for legal review. It is not a finished, legally checked document. Do not treat it as binding until a solicitor has reviewed it and Josh has signed off on the final wording.

Last updated: 5 September 2026 (draft).

Who runs Ship Seek

Ship Seek is operated by Josh Hosking, an individual based in the United Kingdom, not a registered company. This section will be updated with a registered business name and address if Ship Seek incorporates. For now, contact Josh at the support address given at the end of this policy for anything covered here.

What this policy covers

This policy explains what personal data Ship Seek collects when you use the app or the website, why, how long it is kept, who it is shared with, and what rights you have over it. It applies to the mobile app (iOS and Android), the web app at app.shipseek.app, and the TV and host site at shipseek.app.

What we collect

Account information. When you sign up, we collect an email address (for email sign-in) or the identifier your chosen sign-in provider gives us (Sign in with Apple, Google).  If you quick join as a guest, we collect a display name, an email address and, optionally, a photo. The email is kept as an unverified contact, separate from your sign-in details, until you confirm it with a code we send you. Until then it is not attached to your account. It lets you get back into your game if you lose your phone. A guest can later upgrade to a full account without losing their game history. Your email is visible only to you and to Ship Seek admins, never to other players.

Guest accounts. A guest account is deleted automatically 90 days after you last used the app, or 30 days if the guest never joined a game. A guest in a game that is still running is not deleted. Deleting a guest removes the profile, photo and any email you saved, and your name in past games becomes "Deleted player". Confirming your email, or linking Apple or Google, turns a guest into a full account, which is kept until you delete it.

Profile photo. Optional. Shown to other players in the games you join.  Profile photos are stored in a public location. Anyone who has the link to a photo can load it without signing in, though the photos are not listed anywhere.

Photos of other players. This is the one most worth reading carefully. Ship Seek is a hide-and-seek game: when you find another player, you take a photo as evidence of the capture. Some game features (wildcards, radars) also ask you to take a photo of yourself or your surroundings in response to a challenge. These photos are shared with the other players in that specific game so they can see the capture or the response. See "Photographing other players" below for the consent process around this.

Short video clips. On the website, a wildcard or radar can ask for a short muted video clip instead of a photo. The clip is shared with the other players in that game, in the same way as a photo. It is stored privately, not in a public location, and it is deleted on the same schedule as photos (see "How long we keep it").

Chat and other game text. Messages you send in a game's chat, radar text answers, dispute detail text, and anything else you type into the app during a game are stored and shown to the other players in that game as intended by the feature.

Points, stats and badges. For each game we record what is needed to score it: your captures, penalties and points and, in Capture the Flag games, your tags, captures and time carrying a Flag. These are kept as part of the game record and shown in the recap. Badges you earn are stored against your account. Players you share a game with, your accepted friends and the people in your crews can see your badges. A Flag player's identity stays secret while the game runs and is only shown in the end-of-game recap.

Play again. After a game you can tap Play again. We record that you asked, so that when the host runs the game again we can send you an in-app notification (and a push, if you allow notifications) with a link to join. The host sees how many players asked, not who. The record is deleted with the game or your account.

Leaderboards. Ship Seek has a global leaderboard, crew boards and friends' boards. Appearing on the global board is on by default and you can turn it off at any time in your profile. Turning it off takes effect immediately. For players who are on the board we keep a copy of their display name with their board entry so others can see who they are. If you opt out, that copy is removed straight away.

Voice notes. In a game's Everyone chat you can send a short voice note (up to 15 seconds). The microphone is used only while you hold the record button. A voice note goes to everyone in that game, who can listen to it, and anyone can report it. It is stored privately, not in a public location. The host can turn voice notes off for a game and can remove a note. The push notification names the sender and carries no audio.

Game modes and deck reports. Some game modes keep extra records, tied to your player in that game. Muster, Hot or cold, Secret Targets and Sardines record who started an action and who it affected. Secret Targets also keeps each player's private assignment and strikes, which are shown only as that mode's rules allow. In some modes a Hider or a Flag player can report which deck of the ship they are on. This is something you choose to tell the game. It is not read from your phone's location. We keep the latest deck report with the game record.

Short-lived safety records. To stop abuse we keep a few short-lived records: how often a network address (stored as a scrambled, hashed value, not the address itself) has used quick join, and counts of recent seat-transfer and catch-code attempts. These are deleted after 24 hours.

Push notification token. If you allow notifications, we store a device token so we can send you game alerts (a wildcard or radar is played, someone found you, a capture is disputed or resolved, a game starts, pauses, resumes, is cancelled or ends, you are frozen, you are tagged or your team's Flag is captured, a deck is closing or locked, the host asks you to check your deck, a game, team or voice-note message arrives, a crew invite arrives, or a game you asked to play again opens) . Chat and voice-note alerts are not sent for messages from someone you have blocked or who has blocked you . This token identifies your device for push delivery, not you personally, though it is linked to your account so we know where to send things.

The text of a push notification, including the sender's name and the words of a chat message, passes through Expo's push service and then Apple's or Google's push service to reach your phone. Voice-note alerts carry the sender's name only, never audio.

Purchase entitlements. If you buy Game Pass, Host Pro, or a library pack, our payments processor, RevenueCat, tells us which entitlement you now hold and until when. We do not receive or store your card details; the app stores (Apple, Google) or RevenueCat's web billing (Stripe) handle payment directly.

Web purchases through RevenueCat Web Billing are offered only when switched on, and only to a signed-in full account, not to a guest. Test (sandbox) purchases made by App Review or testers grant the same access as real ones, and each purchase record notes whether it was a test or a live purchase.

What we do not collect. We do not track your location. Ship Seek is rule-based and honour-based by design, not a location-tracking app. The only location-like item is the deck report described above, which you choose to give.  We do not run advertising or sell data to advertisers, and we do not use any product analytics SDK as of this draft. If that changes, this policy will be updated first.

Crash and performance reports. The apps and the website send crash and error reports, and a small sample of performance timings, to Sentry so we can fix problems. They are set up not to include personal details, and screen recording (session replay) is off.

Why we collect it

Everything above is collected to run the game you are playing: to identify you to your crew, to let you take part in captures, wildcards and radars, to let the host and other players see the outcome, to notify you when something happens, and to unlock what you have paid for. We do not use your data to build an advertising profile, and we do not sell it.

How long we keep it

Evidence and response photos (capture evidence, wildcard photo responses, radar photo responses) are deleted automatically after a retention period that depends on the plan the host used to run the game:

Free-tier games: 7 days after the game ends.
Games run with a Game Pass: 30 days after the game ends.
Games run under Host Pro: 90 days after the game ends.

The clock starts when a game ends or is cancelled, so the photos from a cancelled game expire on the same schedule. The length is set by the plan recorded when the game started, and the figures are held in our plan settings, not in the app. A photo, clip or voice note that is part of an open report is kept until a moderator reviews the report, then deleted on the usual schedule.

Voice notes are not on that schedule. They are hidden when the game ends or is cancelled, earlier if the host removes them, or if you delete your account.  The audio file itself is then removed from storage by a clean-up job, usually within a day. A voice note that is part of an open report is kept, and hidden from players, until a moderator reviews the report, then deleted on the usual schedule.

A recap of the game (who won, capture counts, timings) is kept longer so players can look back on it, but the underlying photos themselves are removed from storage once their retention period passes. This is enforced by an automated job, not a manual process, so it runs on schedule regardless of whether anyone asks.

Chat messages and other game text  are deleted automatically on the same schedule as photos: 7, 30 or 90 days after the game ends, depending on the host's plan. A message that is part of an open report is kept until a moderator reviews the report, then deleted on the usual schedule.

Game activity logs (the event feed that keeps phones in step, connection health checks, capture attempts and queued alerts for a game) are deleted 14 days after the game ends. In-app notifications you have read are deleted after 90 days. Unread ones are kept. A TV pairing is deleted when the host unpairs it, or 7 days after the game ends.

Account information is kept until you delete your account (see "Your rights" below), except that a guest account is deleted automatically as described under "Guest accounts" above.

Push tokens are removed automatically if the app store tells us the device is no longer reachable, or when you delete your account.

Who we share it with

Ship Seek is a small operation and relies on a short list of service providers to run:

Supabase, which hosts our database, authentication and file storage. Your account data, game data, and photos live here.

Vercel, which hosts the web app (the TV display, host desktop, and public pages).
Expo's push notification service, which delivers push notifications to your device using your push token. Apple's and Google's own push services carry the message from there to your phone.
RevenueCat, which manages in-app purchases and entitlements, and, for web purchases, connects to Stripe to process payment.
Sentry, which receives crash and error reports and performance timings.
Resend, which sends our sign-in and confirmation emails, such as one-time codes.
Apple and Google, as the app stores through which iOS and Android purchases are made, and as sign-in providers if you use Sign in with Apple or Google.

None of these providers are permitted to use your data for their own purposes; they process it on Ship Seek's behalf to provide the service. We do not sell personal data to anyone, and we do not share it with advertisers or data brokers.

Other players in a game you join can see your display name, profile photo (which is also reachable by its link, as described above), chat messages, and any capture or response photo involving them, since that is the point of the feature. Other players cannot see your email address or any account information beyond your display name and photo.

Players in your game can also listen to voice notes you send, and see your badges (as described above).

If a host pairs a TV or big screen to a game, that screen shows only public game information: players' names and photos, scores, deck and Flag status, game announcements and the Everyone chat. It does not show private chat or email addresses, and it is not signed in to any account. The pairing ends when the host unpairs it or the game ends.

Photographing other players

Taking a photo of another player, whether as capture evidence or a wildcard/radar response, is a core part of how Ship Seek works, and it involves photographing real people who have not necessarily read this policy themselves at the moment the photo is taken. We handle this in a few ways:

The app shows a consent prompt before your first capture in any game, explaining that you are about to photograph another player and that they will be able to see the photo (the exact wording is in Docs/Consent-Copy.md).
Anyone in a game can report a photo (or a message) they believe is inappropriate, and can block another player outright. Reports go to Ship Seek's moderation queue for review.
Photos and clips are only ever visible to members of the same game, never posted publicly or shown to anyone outside that game, and they are deleted automatically per the retention schedule above.

If you are photographed in a game and want a photo removed before its scheduled deletion, report it in-app (see Docs/Consent-Copy.md for the report flow) or contact the support address below and it will be actioned.

Your rights

Delete your account. You can delete your account entirely from inside the app, at any time, with no need to contact anyone.

This changes your profile name to "Deleted player" and removes your profile photo and email address. In games you played, your name is replaced with Deleted player (including in game announcements such as "joined the game"), your deck reports and location history are removed, and your chat messages stay but no longer show a name. The photos and clips you took or answered with (capture evidence, wildcard and radar photos and clips), your voice notes and your profile photo are queued for removal straight away and are deleted from storage by a clean-up job, usually within a day; a file that has been reported is kept until the report is resolved. Your friends, blocks, crews you were the last member of, saved guest email and unverified venues are deleted. Records that only show an anonymous player number, such as scores and capture history, stay as "Deleted player". You cannot delete your account while you are hosting or playing in a game that is running (active or paused); finish or leave the game first. Deletion cannot be undone.

Export your data.  You can download a copy of your data from your profile, in the app and on the website. It covers your profile, games, captures, penalties, points, friendships, crews, badges, push tokens, purchases and messages, and also your saved guest email, blocks, who you have muted for game news (shown by display name and crew name only) , reports you filed, rules acknowledgements, notifications, leaderboard entries, wildcard and radar answers, deck reports, muster, hot or cold, target, sardines, bounty, capture the flag and seat transfer records. It also lists the photos, clips, voice notes and profile photo you uploaded, each with a link. These links are bearer links: anyone who has the link can open the file, so do not share the export file. The links stop working 24 hours after you export. Other people appear by display name only, and nothing of theirs is included. You can export once every 10 minutes. You can still contact the support address below if you need help.

Correct your data. You can update your display name and profile photo yourself, at any time, in the app.
Leaderboard.  You can take yourself off the global leaderboard at any time in your profile, and it takes effect straight away.

If you are in the UK or EU, you have rights under UK GDPR and, where applicable, EU GDPR, including access, rectification, erasure, and objection to processing. This policy is drafted with those rights in mind but has not yet been confirmed by a solicitor; treat the mechanisms above (in-app deletion, contacting support) as the practical way to exercise them until the legal review is complete.

Children

Ship Seek is not directed at children under 13, and account creation requires either a supported sign-in method or a quick join  (which asks for an email address) intended for use at an event the host is running (for example, a group of adults on a cruise). Hosts are responsible for who they invite into a game they run, including whether any player is a minor and whether a parent or guardian is aware. If you believe a child under 13 has created an account or been added to a game without appropriate oversight, contact the support address below and we will act on it.

Changes to this policy

This policy will be updated as features change (for example, if an analytics tool is added, or if the retention periods change) . Material changes will be reflected in the "Last updated" date at the top of this document.

Contact

For anything in this policy, including data export requests, deletion questions, or a report about a photo, contact Josh Hosking at the support email address listed in the app and on shipseek.app. As this is a draft, that address is not yet finalised here; add it to this section before publishing.

Back