Effective Date: March 21, 2026 | Last Updated: March 21, 2026
This Privacy Policy ("Policy") describes how the operator of youarenotit.com ("Operator," "we," "us," "our") collects, uses, discloses, and protects information in connection with the You Are Not It real-world GPS tag game and website (collectively, the "Service").
By accessing or using the Service, you acknowledge that you have read, understood, and agree to the practices described in this Policy. If you do not agree to this Policy, please do not use the Service.
This Policy should be read in conjunction with our Terms of Service, which govern your use of the Service.
We are committed to data minimization and collect only the information necessary to operate the Service. The categories of information we may collect are described below.
| Data Type | What We Collect | Purpose |
|---|---|---|
| Anonymous Session Identifier | A random, anonymous token generated by Firebase Anonymous Authentication. This is not linked to any personal identity, email, phone number, or account. | To identify your session within a game and associate game actions with a player slot. |
| Device Geolocation Data | GPS coordinates (latitude and longitude) obtained through your device's browser Geolocation API, only when you actively grant permission and are in an active game session. | To enable real-time gameplay by sharing your position with other players in your game session. This data is end-to-end encrypted (see Section 4). |
| Basic Device and Browser Information | Browser type, device type (mobile/desktop), screen resolution, operating system, and language preference. | To ensure the Service functions correctly on your device and to diagnose technical issues. |
| Usage Data | Pages visited within the Service, game actions (creating a game, joining a game, game events), session duration, and error logs. | To maintain and improve the Service, diagnose technical problems, and understand aggregate usage patterns. |
| IP Address | Your Internet Protocol address, which is automatically transmitted when you connect to any web service. | Processed by our infrastructure providers (Firebase/Google Cloud) for network routing, abuse prevention, and security purposes. We do not log or store IP addresses ourselves. |
We want to be explicit about what we do not collect:
The Service may use browser local storage and session storage (not traditional tracking cookies) to:
The Service displays non-personalized, contextual advertisements served by Google AdMob. These ads are selected based on the app category (games/entertainment) and coarse city-level location — not based on your browsing history, personal profile, or cross-app behavior. AdMob may use cookies solely for ad frequency capping (preventing the same ad from repeating) and aggregated reporting. We do not use tracking pixels, cross-site tracking technologies, or participate in behavioral advertising networks or data exchanges.
We use the information we collect for the following purposes and no others:
We do not use your personal information for targeted advertising, marketing, profiling, or automated decision-making. Ads displayed in the Service are non-personalized and contextual — they are not based on your data.
Because the Service is a GPS-based game, location data is central to its functionality. We take the following measures to protect your location privacy:
Your device's geolocation data is accessed only after you explicitly grant permission through your browser's native geolocation permission prompt. You can revoke this permission at any time through your browser or device settings. If you deny or revoke location permission, you will not be able to participate in active game sessions, but you may still access other portions of the Service.
Location data transmitted during active game sessions is protected by end-to-end encryption. This means:
Location data is inherently transient within our system:
Because location data is end-to-end encrypted and ephemeral:
We do not sell, rent, lease, or trade your personal information or data to any third party.
We may share limited information only in the following circumstances:
When you join a game session, your encrypted location data and your chosen in-game nickname are shared with other players in the same game session. This sharing is the core functionality of the Service and is necessary for gameplay. This data is end-to-end encrypted as described in Section 4.
The Service is built on Firebase (by Google) and hosted on cloud infrastructure. These providers may process technical data (such as IP addresses) as part of providing their infrastructure services. These providers are bound by their own privacy policies and data processing agreements. We do not provide these providers with any additional personal information beyond what is automatically transmitted through standard internet protocols.
We may disclose information if required to do so by law, regulation, legal process, subpoena, court order, or governmental request. However, because player location data is end-to-end encrypted, we are technically unable to provide decrypted location data even if compelled to do so. We may be able to provide non-encrypted metadata such as anonymous session identifiers, IP addresses processed by our infrastructure, or aggregate usage statistics.
We may disclose information if we believe in good faith that disclosure is necessary to protect the safety of any person, to address fraud or security issues, or to protect the rights or property of the Operator.
In the event of a merger, acquisition, reorganization, bankruptcy, or other similar event, information may be transferred as part of that transaction. Any successor entity would be bound by the terms of this Policy with respect to previously collected information.
The Service uses the following third-party services:
| Service | Provider | Purpose | Privacy Policy |
|---|---|---|---|
| Firebase Realtime Database | Google LLC | Real-time game state synchronization and data storage | Firebase Privacy |
| Firebase Anonymous Authentication | Google LLC | Anonymous session management without requiring personal information | Firebase Privacy |
| Google AdMob | Google LLC | Non-personalized, contextual ad serving. Ads are based on app category, not user behavior. May use cookies for frequency capping only. | Google Ads Privacy |
| CARTO / OpenStreetMap | CARTO / OSM Contributors | Map tile rendering for game display | CARTO Privacy |
| Google Fonts | Google LLC | Font delivery for the website | Google Privacy |
We have no control over and assume no responsibility for the privacy practices of third-party services. We encourage you to review the privacy policies of these third-party services.
We retain data only as long as necessary to provide the Service:
| Data Type | Retention Period |
|---|---|
| Real-time location data (encrypted) | Deleted when the game session ends. Overwritten with each update during gameplay. |
| Game session data (scores, events) | May be retained for a short period after the game ends (typically hours to days) for display of recent game results, then automatically deleted. |
| Anonymous session identifiers | Ephemeral. May expire automatically based on Firebase's session management. Not retained by the Operator beyond what Firebase manages automatically. |
| Aggregate usage statistics | May be retained indefinitely in aggregated, non-identifiable form. |
| Error logs and diagnostic data | Retained for up to 30 days for debugging purposes, then automatically deleted. |
We do not maintain long-term archives of player data, location histories, or game session records. When data is deleted, it is removed from active databases. Residual copies may briefly exist in database backups, which are automatically rotated and overwritten according to our infrastructure provider's retention schedule.
We implement reasonable technical and organizational measures to protect the information we process, including:
However, no method of transmission over the Internet or method of electronic storage is completely secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee its absolute security. You use the Service and transmit information at your own risk.
The Service is not intended for children under thirteen (13) years of age. We do not knowingly collect personal information from children under 13. Because we use anonymous authentication and do not collect names, emails, or other identifying information, we have no practical means of verifying user age.
If you are a parent or guardian and you believe that your child under 13 has used the Service, please contact us at the address provided in Section 16. Because we do not collect personal information, there is unlikely to be any identifiable data to delete, but we will make commercially reasonable efforts to address your concern.
Users between thirteen (13) and seventeen (17) years of age may use the Service only with the consent and supervision of a parent or legal guardian, as described in our Terms of Service.
You have the following rights and choices regarding your information:
You can grant or revoke location access at any time through your browser or device settings. Revoking location access will prevent you from participating in active game sessions but will not affect your access to non-gameplay features of the Service.
You can clear local storage and session storage through your browser settings. This will remove any locally cached game preferences and session data.
Because the Service uses anonymous authentication and does not require account creation, you can simply stop using the Service at any time. There is no account to delete. Your anonymous session identifier will expire automatically, and any associated ephemeral data will be removed according to the retention schedule in Section 7.
Because we do not collect personally identifiable information, we may not be able to locate data associated with a specific individual. If you wish to make a data access or deletion request, please contact us at the address provided in Section 16 with as much detail as possible (such as the approximate date and time of your game sessions), and we will make commercially reasonable efforts to assist you.
If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with certain rights regarding your personal information.
As described in Section 2, the categories of information we may collect include: anonymous identifiers, geolocation data (encrypted), internet activity information (usage data), and device information. We do not collect information in the following CCPA categories: real name, email, postal address, Social Security number, driver's license number, financial information, biometric data, or protected characteristics.
We do not sell personal information. We have not sold personal information in the preceding twelve (12) months. We do not have plans to sell personal information.
We do not share personal information for cross-context behavioral advertising.
You have the right to:
To exercise these rights, contact us at the address provided in Section 16. Due to the anonymous nature of our Service, we may require additional information to verify your identity and locate your data.
If you are located in the European Economic Area (EEA), the United Kingdom (UK), or Switzerland, the General Data Protection Regulation (GDPR) and applicable local data protection laws provide you with certain rights.
We process information on the following legal bases:
Subject to applicable law, you have the right to:
Due to the anonymous nature of the Service, we may not be able to identify data associated with a specific individual. To exercise your rights, please contact us at the address provided in Section 16.
The Service uses Firebase by Google, whose infrastructure may process and store data in the United States and other countries where Google operates data centers. If you access the Service from outside the United States, you understand and consent to the transfer, processing, and storage of your information in the United States and other jurisdictions that may have different data protection laws than your country of residence.
Where required by law, we rely on appropriate safeguards for international data transfers, including those provided by Google/Firebase under their data processing terms, which may include Standard Contractual Clauses approved by the European Commission.
Some browsers offer a "Do Not Track" ("DNT") signal. Because there is no accepted standard for how to respond to DNT signals, and because we do not engage in cross-site tracking, the Service does not currently respond to DNT signals. Our privacy practices remain the same regardless of whether a DNT signal is received.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, the "Last Updated" date at the top of this Policy will be revised.
We encourage you to review this Policy periodically. Your continued use of the Service after the posting of changes constitutes your acceptance of such changes.
If we make material changes that significantly affect how we handle previously collected information, we will make reasonable efforts to provide additional notice (such as a banner within the Service).
For questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact:
You Are Not It
Website: youarenotit.com
Email: hello@youarenotit.com
For GDPR-related inquiries, you may also contact us at: hello@youarenotit.com
We will respond to privacy-related inquiries within thirty (30) days, or within the timeframe required by applicable law.