Hidloo is a game in which one person hides a small figure inside a photograph and another person looks for it. This page explains exactly what that involves for your data, in plain language.
Hidloo was developed by Danny Chavez. Contact: support@hidloo.app or the contact form.
What we collect
| Data | Why | Kept for |
|---|---|---|
| Photographs you upload | They are the game. A photo becomes a challenge that other people play. | 30 days, then deleted automatically |
| A nickname | So the other player knows who hid it. You choose it; it need not be your real name. | Until you delete your account |
| Email address, if you sign in | To recognise you on a new device. Only if you sign in with Google, Facebook, Apple or email. | Until you delete your account |
| Game results — found or not, time taken, points | Scores, ranks, badges and streaks. | Until you delete your account |
| A notification token | To tell you when it is your turn. Only if you allow notifications. | Until you turn notifications off or uninstall |
You can play without an account. Choose "Continue as guest" and Hidloo stores a random identifier on your device instead of anything about you. No email, no name required.
If you write to us through the contact form on this website, we keep the name, email address and message you send so we can reply, and delete them once the matter is closed. The form uses no third-party service and sets no cookies.
What we do not collect
- No location, ever. Hidloo does not request it and does not read it from photographs.
- No contacts, no address book.
- No advertising identifiers. Hidloo shows no ads and does not track you across other apps or websites.
- No analytics profile built for advertising purposes.
Your photographs
A photograph you turn into a challenge is stored on our servers so the people you send the code to can play it. It is not public: there is no feed, no gallery, no browsing. It reaches only people you gave the code or link to.
Every photograph is checked automatically by Google Cloud Vision before it is stored, to keep sexual, violent and other prohibited content out. A picture that fails is refused and never saved. Anyone playing a challenge can report it, and a reported challenge is hidden immediately.
Challenges are deleted automatically 30 days after they are made, whether or not anyone played them.
Who else sees your data
| Service | What it handles |
|---|---|
| Google Firebase | Accounts, database, notifications, hosting |
| Google Cloud Vision | Checks each photograph for prohibited content |
| RevenueCat | Purchases. It never receives your name or email. |
| Google, Facebook, Apple | Only if you choose to sign in with them |
We do not sell your data. We do not share it with advertisers.
How your data is protected
Everything travels over HTTPS, and nothing about you is stored on our servers unencrypted at rest — Google Cloud encrypts it before it is written to disk.
What reaches the database is limited by design rather than by promise. The app cannot write a score, a streak or a challenge directly: those are written by server code after checking them, so a modified copy of the app cannot invent a result or edit somebody else's. Nothing on any device can read another player's notification token, email address or contact message — those collections refuse read access to every client, and only server code can open them. Photographs are not public: there is no feed and no gallery, and a challenge reaches only the people you sent its code to.
Access to the production database is limited to Danny Chavez, over an account protected by two-factor authentication.
No system is perfect, and we would rather say that than imply otherwise. If you find a way to reach data you should not be able to reach, please tell us at support@hidloo.app before telling anyone else.
Where your data is
Hidloo runs on Google Cloud servers in the United States, and Hidloo is made in Nicaragua. If you are in the European Union, the United Kingdom or another country with data protection rules of its own, your data is transferred outside it to be processed. Google Cloud's transfers are covered by the European Commission's Standard Contractual Clauses.
Your rights
Wherever you live, you can ask us to:
- See what we hold about you, as a copy you can keep.
- Correct anything that is wrong.
- Delete it — see below, and you do not need to ask.
- Object to a particular use, or withdraw consent you gave earlier. Turning off notifications in your phone's settings withdraws consent for the notification token, and the token is deleted when you do.
We do not charge for any of this and we do not ask why. If you are in the European Union or the United Kingdom you also have the right to complain to your national data protection authority, and you do not have to come to us first.
Deleting your account and data
You can do it yourself, inside the app, in four taps: open Hidloo, tap Your standing, scroll to the bottom, tap Delete my account and data. It happens immediately — there is no waiting period and nothing to email.
Deleted: your account and sign-in, your nickname, your points, ranks and badges, your streaks, every challenge you made together with the photographs inside them, and your notification token.
Kept, with your name and identifier stripped off: rounds you played on somebody else's challenge. That record is also the other player's history of their own game, and deleting it would erase their data to satisfy your request. Nothing in what remains points back to you.
If you no longer have the app installed, write to support@hidloo.app from the address you signed in with, or use the deletion page. Requests are completed within 30 days.
Three things we cannot delete, and would rather name than leave you to discover: purchase records held by Apple, Google and RevenueCat, which they are required to keep for tax and refund purposes and which carry no name or email from us; server logs that may hold an IP address for up to 30 days as ordinary abuse protection, after which they roll off by themselves; and backups, which are overwritten on a 30-day cycle.
Uninstalling the app is not the same as deleting your account. If you play as a guest, uninstalling loses your identifier and with it your scores, but any challenges you made stay until they expire.
Age
Hidloo is intended for people aged 13 and over, and is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe a child has given us data, write to us and we will remove it.
Changes
If this policy changes in a way that affects what we collect or who sees it, the date at the top changes and the new version appears here before the change takes effect.