Privacy and data in Postrally

Last updated 11 November 2026.

In short

• Team participants create no account and give no email address.
• Teams' positions, answers and photos are deleted 30 days after the event, and practice runs after a day.
• Location data is removed from photos when they are sent.
• The website uses no cookies and no statistics or tracking.

Who is responsible

Postrally is made by Chatoyant Technologies ApS, CVR 46619110, Denmark. You can write to us at hello@chatoyant.tech.

We are the data controller for the website and for organizers' accounts. When a company holds an event for its employees, the company is in principle the data controller for the participants' information, and we process it on its behalf as a data processor. Write to us if your company needs a data processing agreement.

The website postrally.dk

• No cookies and no tracking. The website sets no cookies and uses no statistics or advertising.
• The contact form. Your name, email, company and what you write about the event are sent as an email to hello@chatoyant.tech. We use it to reply to you and don't store it in any other system. The basis is your request for a quote.
• City walk updates. If you leave your email to be told about city walks, we use it only for that one message. We delete it when the message has been sent, or 12 months later at the latest. The basis is your consent, which you can withdraw by writing to us.
• Bot protection. The forms use Cloudflare Turnstile, which processes your IP address and information about your browser to tell people from robots.

Organizers

Information	Why	How long
Your email address	Your account and sign-in	Until the account is deleted
Sign-in codes	Signing in without a password	10 minutes
Sign-in (session)	Keeping you signed in	30 days
Log of sign-ins	Protection against misuse	2 days
Log of emails sent (only a coded form of the address)	Limits on how many emails are sent	2 days
Routes, events and team names	What you build	Until the account is deleted
Captains' email addresses for invitations	Sending the team's link	Until the event ends
Results (team name, place, time, penalties)	The results list	Until the account is deleted

Your account is deleted, with its routes and results, 6 months after you last signed in. You are told by email two weeks before. You can also delete the account straight away under Account. The basis is the agreement to use Postrally.

The organizer site uses necessary cookies: one for sign-in (30 days), a short-lived one during sign-in itself, and one that remembers your language (1 year).

Teams

• No account. A phone joins the team by scanning the team card and gets a necessary cookie that keeps it on the team until the day after the event.
• Location. While the hunt runs, the phone sends its location so the post can unlock and the organizer can see the team on the map. Only the captain's latest location is stored, one per team.
• Answers, help and photos. The team's answers, requests for help and photos from photo tasks are stored. Photos are seen by the organizer and shown on the big screen at the reveal. Location data (EXIF) is removed from photos on the server.
• Deletion. All of this is deleted 30 days after the event, and 24 hours after a practice run. The results list with team names and times stays with the organizer.

The Postrally app for iPhone

• Location is used only while a hunt runs, also when the phone is in a pocket, and stops when the team finishes.
• The camera is used to scan the team card and for photo tasks.
• Notifications tell the team when a post is found, and the organizer when a team asks for help. The organizer's phone registers a notification address with Apple, which is deleted when you sign out, delete the account, or Apple reports it invalid.
• Photos you save from the event to your photo library are your own and are not deleted by Postrally.
• The app has no advertising and no tracking.

Where the information is stored

Postrally runs on Cloudflare. The live event (teams' positions, answers and help) and the teams' photos are stored on servers in the EU. Sign-in codes, invitations and forms are sent as email through Resend. Notifications on iPhone are sent through Apple. Resend and Apple may process information outside the EU, and the transfer is based on the EU standard contractual clauses or equivalent safeguards.

Cloudflare briefly keeps technical server logs so that errors can be found and fixed.

Your rights

You can ask for access to, correction of or deletion of your information, and object to the processing. Write to hello@chatoyant.tech. If you take part in an event for a company, you can also contact the company. You can complain to the Danish Data Protection Agency, datatilsynet.dk.

Changes

If we change how Postrally processes information, we update this page and the date at the top.