Privacy policy

Account details. Your name, email address, mobile number and a securely hashed password. We never store your password in readable form.

Phone verification. We send a one-time code by SMS when you join, to confirm one account per person. Verification is handled by Twilio.

Precise location, at the moment you scan a code. When you scan a hunt token, your device shares its GPS position so we can confirm you were genuinely at the location. We record that position, the time, and whether it fell inside the accepted radius. We do not track your location at any other time, and the app never follows you in the background.

Payment information.Memberships are billed by Stripe. Your card details go directly to Stripe and are never seen, transmitted or stored by us. We keep only Stripe's customer and invoice references and the amounts paid.

Website activity. We record the pages visited on hub4.au, the approximate city a visit came from, timestamps, and basic browser and device information. We do this with a first-party cookie that identifies a browser rather than a person. If you later log in from that browser, we associate that browsing history with your member account so we can support you and detect abuse.

Gameplay records. Scans, answer attempts, holds, wins, skill points and referrals — the record of how the game was played.

Messages you send us. Anything you submit through our contact form, including your name, email and message.

Location is central to a treasure hunt, so we want to be precise about it. Exact GPS coordinates are collected only when you deliberately scan a hunt token, and only to verify that a claim is genuine. That data is used for verification and dispute resolution.

Separately, for analytics, we record only the approximate city a website visit came from — derived from your IP address by our hosting provider. That is deliberately coarse: we do not build precise location profiles of members from ordinary browsing.

We use a first-party cookie to recognise your browser across visits (retained up to two years), and a session cookie to keep you logged in. We also use Google Analytics, which sets its own cookies and processes data under Google's privacy terms.

You can clear or block cookies in your browser. Blocking the session cookie will prevent you from logging in.

To run your membership and billing; to run the game fairly and verify wins; to pay winners; to send you clues, results and service messages; to keep one account per person; to detect collusion, spoofed locations and other abuse; to improve the site; and to meet our legal obligations.

We do not sell your personal information, and we do not share it for others' marketing.

Only the service providers who make Hub 4 work: Google Cloud (hosting and databases, Sydney), Stripe (payments), Twilio (SMS), Mailgun (email) and Google Analytics. Each receives only what it needs. Some are located overseas, which means your information may be processed outside Australia.

We may also disclose information where the law requires it, or where it's necessary to investigate suspected cheating or protect someone's safety.

Account and gameplay records are kept while you're a member and for seven years after your last payment, to meet tax and financial record-keeping obligations. Website activity logs are kept for two years. You can ask us to delete anything we're not legally required to keep.

You can ask for a copy of the personal information we hold about you, ask us to correct it, ask us to delete it, or complain about how we've handled it. Email us and we'll respond within 30 days. If you're unhappy with our response you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

Data is stored in Google Cloud's Sydney region. Passwords are hashed, credentials are held in a managed secrets service, and traffic is encrypted in transit. No system is perfectly secure, but if a breach ever affected you we would notify you and the OAIC as required by law.

Hub 4 is for people aged 18 and over. We don't knowingly collect information from minors.

If we change this policy we'll update the date above and, for significant changes, tell members directly. Questions or requests: get in touch.