MystWalk Privacy Policy
Last updated: 25 October 2026
This policy explains what personal data the MystWalk app (web, Android and iPhone) processes, why, for how long, with which service providers, and what your rights are.
1. Controller
2. What we process and why
3. Location
4. Legal bases
5. What others can see
6. Service providers and transfers
7. Cookies and device storage
8. How long we keep data
9. Your rights
10. Account deletion
11. Security
12. Data Protection Authority
13. Changes
1. Data controller
The controller is NOESIS STRATEGY EXECUTED E.E., Pindou 7, 164 51 Argyroupoli, Greece, GEMI 168257503000, VAT EL802019452. For anything about your data: mystwalk@noesisse.gr.
2. What we process and why
2.1 Account
Email, nickname, password (stored only as a one-way hash that cannot be reversed), language, the profile icon you choose, whether you want to appear on leaderboards, and whether your email is confirmed. Purpose: to give you an account, let you sign in and play.
2.2 Play, team and leaderboards
The hunts you start, your team and your role in it, the answers you type, the hints you take, the stops you complete, scores, times, achievements, your reviews (rating and comment) and in-app notifications. Purpose: to run the game, show the team its shared progress, and produce results and leaderboards. We also use answers, in aggregate, to improve the puzzles.
2.3 Location
Only when you confirm arrival at a stop. See section 3.
2.4 Corporate events (Walk Marathon)
If you play in an event organised by a company: your team in the event, its time and progress, in-game coins, the tips your team buys or sells, taunts and alliances. Purpose: to run the event.
2.5 Security and technical operation
When you sign in and for important actions (such as changing your password, deleting your account, or actions by our support team) we record the action, your IP address and your browser type. We also record technical errors of the app: the page, the error message and, if you are signed in, your account. Our hosting providers keep their own technical logs. Purpose: protecting accounts from misuse, investigating problems and fixing errors.
2.6 Payments
Purchases inside MystWalk are not available yet, and today we process no payment data. When they open, card payments will be handled by Stripe. Card details will reach only Stripe and will never pass through us. We will keep only the order itself (what you bought, when, the amount), as tax law requires. If purchases are offered through the App Store or Google Play, Apple or Google will handle the payment under their own terms. We will update this policy before purchases open.
2.7 Emails and contact
We send only necessary emails: email confirmation and password reset. We do not send marketing messages. If you write to us, we keep your message and address in order to reply.
3. Location
- When: only while you play a hunt and only when you tap "I'm here" to confirm you have reached a stop or a puzzle's place. We never track you in the background or while the app is closed.
- What we keep: the coordinates rounded to 5 decimal places (about one metre), the accuracy your phone reports, the distance to the stop, whether the arrival was accepted, and the time. Failed attempts are kept too, because after two of them the app lets you confirm arrival yourself.
- Why: so the server can check that you are close enough. Your location is not shown to other players.
- Deletion: an automatic task that runs every hour deletes locations older than 90 days. They are also deleted at once when you delete your account.
- Without location: you may refuse the permission. Where the stop allows it, you then confirm arrival yourself.
4. Legal bases (Article 6 GDPR)
| Processing | Legal basis |
|---|---|
| Account, play, team, location at arrival, necessary emails | Performance of the contract for using the app (6(1)(b)) |
| Appearing on leaderboards and shared results | Your choice in your Profile, which you can change at any time |
| Corporate events | Performance of the contract; the organiser's legitimate interest in running the event (6(1)(f)) |
| Security records, error logs, improving puzzles from aggregate data | Legitimate interest: security and quality of the service (6(1)(f)) |
| Order records, once purchases open | Contract (6(1)(b)) and the legal obligation to keep tax records (6(1)(c)) |
| Answering your messages | Legitimate interest in replying (6(1)(f)); or contract, where it concerns your account |
5. What others can see
- Your teammates see your nickname and who answered or arrived at a place.
- Leaderboards and results you share show your nickname only if you allow it.
- Reviews show your nickname only if you have allowed it.
- At corporate events, the game master (who may work for the organising company) sees the nickname and email of each team's members. Other teams see only your team's name, progress and time.
- The MystWalk support team sees what it needs in order to help, and every action it takes on a hunt is recorded.
- Your email is never shown to other players.
6. Service providers and transfers
- Microsoft Azure: hosting of the app, database, files, secure key storage, operational monitoring and sending email. Data is stored in European Union data centres (West Europe).
- Google Maps: showing maps. When a map loads, Google receives your IP address and the map area, but not the location you send us when you tap "I'm here". Google may process data outside the EU, with the safeguards the GDPR provides for (for example the EU–US Data Privacy Framework). Walking directions open in your phone's own maps app.
- Stripe, once purchases open: card payments. Stripe may process data outside the EU, with equivalent safeguards.
We do not sell your data. We use no advertising networks and no third-party analytics tools.
7. Cookies and device storage
We use only essential cookies:
- Sign-in: keeps you signed in for up to 30 days.
- Sign-in security: protects the sign-in form from attacks and remembers which page to return to.
- Language: remembers the language you chose.
We use no advertising or analytics cookies, and the app itself stores no other data about you on your device. When it loads, the Google map may use its own technical storage in order to work, under Google's privacy policy.
8. How long we keep data
| Data | Period |
|---|---|
| Locations | 90 days, deleted automatically; at once when you delete your account |
| Email confirmation and password reset links | Valid for 48 hours and 60 minutes respectively; deleted when you delete your account |
| Account, play, teams, reviews | As long as the account exists; after deletion they remain only anonymously (section 10) |
| Security and error records | As long as needed for the security of the service and to investigate misuse. We will set a fixed maximum period and state it here. |
| Order records (once purchases open) | As long as tax law requires |
| Messages to support | As long as needed to handle the request and for our legal obligations |
9. Your rights
You have the right to access, rectify, erase, restrict and object to the processing of your data, and to data portability. In the app, under Profile, you can yourself:
- download all your data as a file (JSON), including your history, answers, locations and reviews;
- delete your account;
- change your nickname, language and leaderboard visibility.
For anything else write to mystwalk@noesisse.gr from your account's email address. We answer within one month at the latest, as the GDPR requires.
10. Account deletion
You can delete your account in your Profile, or ask us by email. On deletion your email and nickname are replaced with anonymous values, signing in becomes impossible, and your locations, notifications, review comments and email links are deleted. Hunt results and review ratings remain without your name, so your teammates' scores are not affected. All the details are on the Delete account page.
11. Security
- All communication with the app is encrypted (HTTPS).
- Passwords are stored only as one-way hashes (bcrypt). After 10 wrong sign-in attempts the account locks for 15 minutes.
- The MystWalk team must sign in with two-step verification, and every action it takes on accounts and hunts is recorded.
- The service's secret keys are kept in a secure vault (Azure Key Vault), and media files in private storage with links that expire.
- Requests to the app are rate-limited to deter attacks.
No system is perfectly secure. If a breach affects you, we will inform you as the law requires.
12. Data Protection Authority
If you believe the processing of your data breaks the law, you may lodge a complaint with the Hellenic Data Protection Authority, 1–3 Kifisias Avenue, 115 23 Athens, Greece, www.dpa.gr. We would appreciate it if you wrote to us first, so we can try to resolve it together.
13. Changes
The date at the top shows the latest change. If something important changes, such as a new purpose, a new provider or purchases opening, we will tell you in the app before the change applies.