Privacy Policy
Version: 1.0
This policy explains what personal data Hyzeer keeps, why, for how long, who else processes it, and what rights you have. It applies to the Hyzeer app (web and Android), hyzeer.com and the lost-disc label pages.
1. Who is responsible
The controller of your data is Hyzeer. Write to us about privacy at support@hyzeer.com.
2. What we keep, and why
| Data | Why | Legal basis (GDPR Art. 6) |
|---|---|---|
| Account: email, username, display name, confirmation of age 16+, language, time zone, distance unit, flag (optional), privacy settings, the version of the terms you accepted and when | To run your account and log you in | Contract (b) |
| Games: courses played, scores, throws with their GPS positions (in advanced scoring), the discs used, other participants, visibility of each game | To score games and show results to the people you allow | Contract (b) |
| Discs and labels: your discs, notes, nicknames, bag and collection, label codes, lost status | To keep your disc list and route found reports to you | Contract (b) |
| Course changes and course photos you add | To build the public course pages | Contract (b) |
| Purchases: what you bought, when, the store, the status of your subscriptions | To give you what you bought, handle refunds, and keep accounting records | Contract (b), legal obligation (c) |
| Reports you send about players, games, courses or images | To moderate Hyzeer | Legitimate interest (f): keeping Hyzeer safe |
| Log-in and security: refresh tokens, log-in codes, the time of the last use, action logs | To keep your account safe | Contract (b), legitimate interest (f) |
| Error reports: what went wrong in the app, the app version and the device type, without your name, email or IP address | To find and fix bugs | Legitimate interest (f) |
| Support: emails you send to support@hyzeer.com, and our replies | To help you, and to see what happened before if you write again | Legitimate interest (f) |
Phone permissions
The app asks before it uses your phone's location, camera or notifications. Each is optional: Hyzeer works without it, only the feature that needs it doesn't. You can change your answer at any time in your phone's settings.
| Permission | What for | Without it |
|---|---|---|
| Location | Courses near you, your position on a course map, setting a course's location, and recording throws in advanced scoring. Your location is sent to us only when you save something with it, such as a throw or a course's location; we don't track where you are. | Search courses by name, score without GPS |
| Camera | Scanning a Hyzeer label, and taking course photos. Location and camera data in a photo file are removed before it is saved. | Choose a photo from your gallery; attach labels from the disc's page |
| Notifications | Scoring from the lock screen while you play | Score in the app |
On the web, your browser asks for the same permissions.
Discord
Our Discord server is run by Discord, under Discord's privacy policy. What you write there is seen by the other members and by Discord. We don't link your Discord account to your Hyzeer account, unless you tell us who you are there.
If you find a disc (no account needed)
When you report a found disc through a label page, we keep the message, and, only if you add them, a photo and your location. We send them to the disc's owner. To stop abuse, we keep a code made from your network address and device for 90 days; it can't be turned back into the address. The owner never sees who you are, and you never see who the owner is. The legal basis is our legitimate interest (f) in returning lost discs and preventing spam.
What we don't do
- We don't sell your data and don't show ads.
- We don't use analytics or tracking cookies (see Cookies).
- We don't make automated decisions about you that have legal or similar effects.
3. Who sees your data
- Other players see your username and display name, always. Who sees your games, throws and profile details depends on your privacy settings and each game's visibility (Me → Profile settings → Privacy). Your email, label codes, found reports, disc notes and nicknames are never shown to others.
- Our team can see account data to give support and moderate content. Every admin action is logged.
- Processors who run part of Hyzeer for us, under a data processing agreement:
| Processor | What for | Where |
|---|---|---|
| netcup GmbH | The server Hyzeer runs on, with its database | EU (Germany, Nuremberg) |
| OVH SAS (OVHcloud) | File storage (finder photos, course photos) and backups | EU (Germany, Frankfurt) |
| Brevo (Sendinblue SAS) | Sending emails (log-in, found reports, account emails) | EU (France) |
| Esri (Environmental Systems Research Institute, Inc.) | Map images on course pages (your device loads them directly; Esri sees your IP address) | USA, under the EU–US Data Privacy Framework |
- Stores, when you buy something. Stripe (web) and Google (Android) process payments as merchants of record: they are controllers of the payment data under their own privacy policies (Stripe, Google). We get the purchase and its status, never your card details.
- Authorities, only when the law requires it.
Transfers outside the EU
Our servers, file storage and email provider are in the EU. Esri, which serves the map images, is in the USA and is certified under the EU–US Data Privacy Framework. Stripe and Google decide where payment data goes, under their own privacy policies.
4. How long we keep it
| Data | Kept |
|---|---|
| Account data | Until you delete your account. Deletion is completed within 30 days. |
| Finder photo and location | Deleted 90 days after the found report is closed. An open report closes by itself after 90 days. |
| Finder message and dates | With the disc, until the disc or the account is deleted |
| Finder abuse-prevention code | 90 days |
| Backups | 30 days, then deleted. If a backup is ever restored, deleted accounts are deleted again. |
| Error reports | 30 days |
| Support emails | 2 years after the last message |
| Purchase records | As long as tax and accounting law requires, without your name after account deletion |
| Finished games | Your scores stay so others' results don't change, with your name replaced by "Deleted player" |
| Course changes and photos | Stay on the course page without your name |
5. Your rights
You have the right to:
- access your data and get a copy: Me → Download my data gives you everything in a file (JSON);
- correct it: most of it in Me → Profile settings;
- delete it: Me → Delete account (see Delete Your Account);
- data portability: the export file is in a machine-readable format;
- object to processing based on our legitimate interest, and restrict processing;
- withdraw consent where we asked for it, at any time.
If you can't log in (for example, your account is blocked), write to support@hyzeer.com from the account's email. We answer within one month.
You can also complain to the Slovenian data protection authority, the Information Commissioner (Informacijski pooblaščenec, ip-rs.si), or to the authority in your EU country.
6. Security
Hyzeer has no passwords: you log in with a link or code sent to your email. Connections are encrypted (HTTPS). On the web, the log-in cookie can't be read by scripts. Finder photos are in private storage, available only through short-lived links.
7. Children
Hyzeer is not for children under 16, and they can't create an account. If you think a child under 16 has an account, write to us and we will delete it.
8. Cookies
Hyzeer uses one cookie, and only to keep you logged in. We use no analytics, advertising or tracking cookies, so we don't need to ask for your consent and don't show a cookie banner.
| Cookie | Set by | What for | How long |
|---|---|---|---|
hz_refresh | api.hyzeer.com, for all of .hyzeer.com | Keeps you logged in on the web app and on label pages. Only set when you log in. Scripts on the page can't read it. | Until you log out, or 180 days after you last used Hyzeer |
The cookie is strictly necessary for a service you asked for (logging in), so the law (ePrivacy Directive Art. 5(3), Slovenian ZEKom-2) allows it without consent. If you block it in your browser, you can't stay logged in on the web.
Other storage on your device:
- The app stores your games, courses and discs on your phone or in your browser so you can score without signal. Logging out deletes it.
- The website remembers whether you chose the light or dark theme, in your browser's local storage. It is never sent to us.
- Maps on course pages are loaded by your device directly from Esri, which sees your IP address but sets no cookies.
9. Changes
When this policy changes in a way that matters to you, the app shows a summary and asks you to accept the new version.