Legal notice

The information a provider of an online service has to make public in the European Union: who is behind it, what is sold and on what terms, what happens to your data, and what this site stores in your browser.

Last updated: 23.10.2026

The operator details are not configured on this installation yet.

GameOut lets you build outdoor treasure hunts that children play on their phones: stations on a map, puzzles, a villain who writes to them, a clock, a treasure at the end. You write the game in the web app, print its cards and hand the players one link; they play without an account. Games can be shared with other accounts, read by your own software over an HTTP API using an API key, and written by an AI assistant you connect.

The service is supplied as it stands, without a guarantee that it will be free of interruption or fault. Your statutory rights as a consumer are not affected by that sentence.

If you buy a period as a consumer, the law guarantees that the service does what this notice and the documentation say it does, for the whole of that period. If it does not, you may ask for it to be put right, for a proportionate reduction of the price or, unless the fault is minor, to end the period and have the rest of it refunded.

You are responsible for what you put into it: you need the right to use the texts and pictures of your games, you are the one who runs the game on the ground and looks after the children playing it, and the service may not be used to break the law.

The limits keep the service quick for everyone. Please:

  • Use one account per person.
  • When a request is refused, stop and wait for the time the answer gives.
  • Do not make calls or games meant to load the server rather than to play.

Usage is checked automatically for such patterns, but only a person decides about an account. An account that breaks these rules or the law may be suspended, for a while or for good. You are told by e-mail, with the reason, and you can reply to it.

If the account had paid access, we look into what happened and how much harm it caused, and refund the unused part where that is fair. The rights consumer law gives you are not affected.

If you connect an AI assistant to your account, it acts on your behalf and within the limits you set: it can only reach the games you switched AI access on for, and what it does there counts as done by you.

Should the service ever be shut down for good, you will be told in advance by e-mail, and the unused part of any paid period is refunded.

This notice is the whole agreement between you and the operator. When it changes, the date at the top changes with it; a change to a price or a limit applies to purchases made after it, never to a period already bought.

What is sold is a PERIOD of access, once. It is not a subscription: nothing renews, nothing is charged a second time, and there is nothing to cancel. Buying again while a period is still running adds to the end of it instead of replacing it.

Period Price
30 day(s) €8
180 day(s) €34
365 day(s) €54

The price shown is the total you pay. It is a gross price: VAT is contained in it and is worked out at the rate of your own country, so the total does not change with where you are. There is no separate charge added at the payment step.

Access can be stacked up to 730 days into the future.

An account without a paid period keeps working: the web app stays usable and the API keeps a small daily allowance, so the product can be tried in full before any money is spent. The limits on both are set out on the pricing page. They are fair use ceilings that protect the server - nothing is metered and there is no balance to run out of.

Who takes the payment

No payment provider is connected on this installation, so nothing can be bought here at the moment.

Refunds and the right of withdrawal

If you buy as a consumer in the EU, you have 14 days from the purchase to withdraw from it without giving a reason. At the checkout you ask for the access to start at once, so if you withdraw, the days already used are charged at the daily rate of the period and the rest is refunded to the payment method you used. Once the 14 days are over, or the period has run out, the right no longer applies. Nothing else is deducted - the payment provider's fees are our cost, not yours.

Any refund - in full or for the days not used - ends the access that purchase gave: the whole period is taken back at the moment of the refund. Periods bought later move up to fill the gap.

To withdraw, write to the e-mail address in section 1 within the 14 days and say which purchase you mean. The refund is made by the payment provider.

Model withdrawal form

You do not have to use this form - any clear statement that you withdraw will do. It is here because the law says it has to be offered to you.

To: the operator named in section 1 I hereby give notice that I withdraw from my contract for the provision of the following service: (which period of access, and the order number if you have it) Ordered on: .......... Name of consumer: .......... Address of consumer: .......... Signature of consumer (only if this form is sent on paper): .......... Date: ..........

Buying for a business

If you buy for a business - a company, or as a sole trader for your trade - consumer law does not apply: there is no right of withdrawal and the purchase is final. You say which it is at the checkout, and the payment provider's invoice then carries the business name and VAT number you enter there. Should a refund ever be granted to a business as a matter of goodwill, the payment provider's fees are deducted from it, because they are not returned to us.

All sales are final - a period is not refunded.

This is a one time purchase of one period, not a subscription: nothing renews, nothing is charged again and there is nothing to cancel. There is also nothing to buy blind - the free allowance never runs out, and a promo period (if you were given one) unlocks the full limits, so you can run the whole product on your own templates and your own data before you pay anything.

The one exception is the right the law gives you: a consumer in the EU may withdraw within 14 days of buying, pays for the days already used and gets the rest back. If you buy for a business, consumer law does not apply: there is no right of withdrawal and the purchase is final. A refund granted to a business as a matter of goodwill is made net of the payment provider's fees. How that works

The controller of your personal data, in the sense of the GDPR, is the operator named in section 1.

What is stored, and why

Data Why Legal basis
Your account: display name and e-mail address(es). If you sign in with Google or GitHub, the account identifier, the name and the e-mail address that provider hands us. To have an account and to sign you in. Performance of the contract.
If your account was suspended: the reason and until when. To keep an account that was used against the rules out, and to tell you why. Legitimate interest in a working, secure service.
If the automatic abuse checks pointed your account out: which check it was, and when. So that the same case is brought to our attention once, and not again and again. Legitimate interest in a working, secure service.
The language you last used the app in. To write our e-mails to you in that language. Performance of the contract.
Which of the guided hints of each page you have seen, and where you stopped. So that the hints are shown once, in every browser you use, and again only when you ask for them. Performance of the contract.
Your games: their names, settings and texts, the stations with their places and tasks, the quiz, the pictures you upload and the villain's face. To store and run your games. Performance of the contract.
A history of changes to each game: the state before each of its last changes, whether made on the edit page or through an AI assistant - and for the latter the name of the assistant software. So that a change can be seen and undone. Performance of the contract.
Sharing: which account a game is shared with and at what permission. A game is shared to an e-mail address; an address that has no account yet gets one holding just that address, so the game is there when its owner first signs in. To make sharing work. Performance of the contract.
API keys - kept only as a hash, so not even we can read a key back - with their validity dates and any IP allow or deny list you set on them. To authenticate your API calls. Performance of the contract.
The apps you connected: for each AI app you signed in to and allowed - what the app calls itself, the address it sent you back to, when it was connected and last used - and the access tokens it was given, kept only as a hash. To let the app act for you, and to let you see and end the connection. Performance of the contract.
Your access periods and the order records behind them: the provider, its order identifier, the product and the amount. To know what you bought, and to keep the accounting records the law requires. Performance of the contract, and a legal obligation.
A technical log: time, event type, the account it belongs to, the IP address the request came from, and a short description. To keep the service secure, to investigate abuse, and to show you your own activity. Legitimate interest in a working, secure service.
Counters used for the rate limits, which are kept per account and, on the public payment webhook, per IP address. Also the single use hashes behind sign in links and e-mail verification. To enforce the limits and to let you sign in by e-mail. Performance of the contract, and legitimate interest.
If you were invited into a promotional campaign: the e-mail address it was aimed at, and the record of the free period it granted. To hand out the offer once and to the person it was meant for. Legitimate interest in running the offer.

Apart from the automatic abuse checks described in section 2, which only point an account out to a person, there is no profiling and no automated decision making. Your data is not sold, and it is not used to advertise anything to you.

A message you send through the contact form is delivered as e-mail and is not stored in the application database.

We send e-mail only about your account: sign in links, verification, a game shared with you, reminders before an access period ends and a note once it has, a reminder before an api key of yours runs out, a notice when an app is connected to your account, a free period you were given or a period the operator granted or took back by hand, a notice when your account is suspended or reinstated, a message from the operator when there is something about the service you need to know, and answers to your messages. There is no newsletter.

An e-mail address is the only thing you have to give us: without one there is no account to sign in to. Everything else is either optional or arises from using the service.

How long it is kept

Your account and everything attached to it is kept while the account exists, and for exactly as long as you choose to keep it. Deleting the account removes your profile, your e-mail addresses, any linked Google or GitHub identifiers, your API keys, the apps you connected, your games with their pictures, players, progress, chats, shares and history, and your access periods.

An app you connected stays connected until you disconnect it, and ends by itself when it was not used for 30 days, or 365 days after you allowed it at the latest. What is left of an ended connection is deleted 30 days later.

Any paid access still running is lost when you delete the account, and is not refunded.

Two things outlive the account, on purpose. Order records are kept because tax and accounting law requires them to be, and technical log entries are kept for security, but both are detached from the deleted account: a log entry keeps the account's number and loses the name that was on it. An order record holds the order number, the product, the amount and the payment provider's customer number - not your name, e-mail or address.

An e-mail address the operator put on the list of a promotional campaign stays on that list until the campaign is closed, whether or not an account exists for it.

Log entries, including the IP address in them, are deleted after 365 days. A note that the abuse checks pointed an account out is deleted after 30 days.

Your rights

You have the right to ask for a copy of your data, to have it corrected, to have it erased, to have its processing restricted, to receive it in a portable form, and to object to processing carried out on the basis of a legitimate interest.

Erasure you can carry out yourself, immediately and without asking anyone: the profile area has a "Delete account" page that removes the account and everything in it. It takes effect at once and cannot be undone.

For anything else - a copy of your data, a correction, a restriction or an objection - write to us and the request is answered within one month.

This site sets no advertising cookies, no analytics cookies and no third party cookies. Nothing here tracks you, on this site or anywhere else. That is why you are not asked to consent to cookies: what is used is limited to what the service cannot work without, plus two settings you chose yourself - the theme, and which hints you have seen -, and none of those needs consent.

The session cookie is marked HttpOnly, so scripts in the page cannot read it, and SameSite=Lax, so it is not sent along with requests started by other sites. Over HTTPS it is also marked Secure.

You can delete them at any time in your browser settings. Removing the session cookie signs you out; removing the saved form cookie only means the form is not filled in again; removing the theme setting returns the site to following your system preference. Removing the hints setting only means the hints of a page may be shown to you once more.

Your games, their pictures and everything the players do are processed on infrastructure we run ourselves. The map tiles the players' phones show come from OpenStreetMap, which thereby sees the phone's address and the area it looks at, and nothing else.

Others are involved only in these places:

  • Signing in with Google or GitHub — only if you choose it. That provider then knows you signed in here. Signing in by e-mail link avoids this entirely.
  • AI assistants — only if you connect one. Whatever the assistant reads or writes here - the games, their texts and the state of play - passes through the assistant's own provider under that provider's terms. You choose the provider, and you can switch AI access off per game, disconnect the app or delete the key at any time.
  • E-mail — sign in links, e-mail verification, the expiry reminder and replies to your messages are delivered through a mail service, which necessarily sees the address and the message.
  • Page assets — the stylesheets, scripts and icons this page is built with are loaded from the public content networks cdn.jsdelivr.net and cdnjs.cloudflare.com. They set no cookies, but loading a file from them reveals your IP address to them, as fetching any URL does.
  • Hosting — the servers this runs on are rented, so the hosting provider holds the machines the data sits on.

Some of these are based outside the EU. Where that is so, the transfer rests on the safeguards in Chapter V of the GDPR - standard contractual clauses or an adequacy decision.

Tell us first - most things are a misunderstanding and are fixed the same day.

If you are not happy with how your personal data is handled, you may complain to the data protection supervisory authority of the country you live in.

As a consumer you may also take a dispute to the out of court consumer settlement body of your own country.

This notice is governed by the law of the country the operator is established in. If you are a consumer, the protection the law of your own country gives you is not taken away by that.