Zyfoo Privacy Policy

Puthaiyal App – Privacy Policy

Effective and last updated: 10 September 2026

This section explains how personal data is handled when you use the Puthaiyal mobile application and its related treasure-hunt services (the “Puthaiyal Service”). It supplements the Zyfoo Privacy Policy above. Puthaiyal is powered by Askan Technologies and made available through Zyfoo. The organizer identified for each hunt also handles participant information for operating that event.

1. Information we collect

Depending on your role and the features you use, we may collect:

• Account and contact information: full name, email address, 10-digit mobile number, team name, account role, tenant membership, and acceptance of the applicable terms.
• Optional or legacy profile information: date of birth and emergency contact details, if previously supplied or requested for a particular event.
• Hunt and registration information: registration requests and status, organizer decisions and comments, route assignments, clues made available to you, QR scan records, stop sequence, timestamps, manual stop approvals, finish time, ranking information, and event communications.
• Location information: precise latitude and longitude at the time of a QR scan when location verification is enabled and you grant location permission. We do not need continuous background location tracking for the normal hunt flow.
• Camera and photographs: camera access for scanning QR codes and taking a required team or finish photograph. Submitted photographs are uploaded so authorized event organizers can verify completion.
• Device, notification, and security information: device or installation identifier, session records, Firebase Cloud Messaging token, notification delivery information, IP address and limited request logs used for authentication, security, troubleshooting, and service operation.
• Analytics and diagnostics: app interactions, device and operating-system information, crash reports, performance information, and related identifiers collected through Firebase Analytics and Firebase Crashlytics.
• Organizer information: tenant and hunt details, contact information, administrators invited to a tenant, routes, stop names and coordinates, clues, uploaded event images, broadcast messages, approvals, and administrative audit records.

2. How we use information

We use this information to:

• create and secure accounts, deliver email OTP sign-in, and manage sessions;
• process hunt registrations and allow organizers to approve, reject, or request resubmission;
• assign routes, reveal clues progressively, validate QR scans and proximity where enabled, record progress, and calculate completion and results;
• allow authorized organizers to monitor racers, provide manual stop approvals, review finish photographs, and administer the event;
• send registration, route, race, safety, and organizer messages through email, push notifications, or in-app notifications;
• detect misuse, protect participants, maintain audit and security records, troubleshoot failures, and enforce event rules;
• understand app usage, diagnose crashes, improve performance, and maintain the Puthaiyal Service; and
• comply with applicable legal obligations and respond to valid legal requests.

3. Permissions and your choices

The app asks for camera permission when you scan a QR code or take a team photo, location permission when a hunt uses proximity validation, and notification permission for hunt updates. You can change these permissions in your device settings. Denying a permission does not remove your account, but the related feature may not work. Location is submitted with the relevant scan only when available and applicable; Puthaiyal does not require continuous background location access for normal gameplay.

4. How information is shared

We do not sell Puthaiyal personal data. Information may be shared with:

• The relevant organizer, tenant owner, and authorized tenant administrators, who can access participant and race information needed to operate and monitor their hunt.
• Service providers that support hosting, database storage, email delivery, maps, push notifications, analytics, crash reporting, and security. These include Google Firebase services used for messaging, analytics, and crash reporting.
• Authorities or advisers when disclosure is required by law or reasonably necessary to protect rights, safety, users, or the service.
• A successor organization in connection with a merger, restructuring, financing, or transfer of the relevant business, subject to appropriate safeguards.

Organizers must use participant information only for legitimate event administration and applicable legal obligations. They are responsible for any separate collection or use outside the Puthaiyal Service, such as external payment forms, WhatsApp groups, publicity, or printed registration records.

5. Legal grounds

Where applicable, processing is based on providing the service you request and performing our agreement with you, your consent for device permissions and optional processing, legitimate interests in operating and securing the service and event, and compliance with legal obligations. You may withdraw a device permission through your operating-system settings. Withdrawal does not affect processing already lawfully completed.

6. Data retention

Account information is retained while the account is active and for as long as reasonably needed to provide the service. Hunt registrations, progress, organizer actions, results, and photographs are retained for event operation, verification, support, dispute resolution, safety, and the organizer’s reasonable record-keeping needs, after which they should be deleted or de-identified when no longer necessary. OTP records, sessions, push tokens, logs, analytics, crash information, and backups are retained only for their operational, security, diagnostic, or legal purpose and are deleted or rotated according to the applicable system or service-provider schedule.

When an account-deletion request is completed, data linked to that account is deleted as described below, except for limited information that must be retained to meet a legal obligation, prevent fraud or abuse, protect users, resolve a dispute, or maintain an anonymized security audit. Residual copies may remain temporarily in protected backups until those backups are overwritten in the ordinary cycle.

7. Account and data deletion

You can permanently delete your account from Profile → Delete Account → Delete permanently in the Puthaiyal app. If you cannot access the app, email digital@askantech.com from your registered email address with the subject “Delete my Puthaiyal account”. We may verify ownership before acting on an email request, which is normally processed within seven working days after successful verification.

Deletion removes the account and associated profile, contact and team details, registrations, route assignments, scans and progress, submitted finish photographs, notifications, push tokens, and active sessions. For a tenant owner, deletion may also remove the owned tenant, hunts, routes, stops, registrations, images, and related event records; the app displays this consequence before confirmation. Historical administrative references in another owner’s event may be detached from the deleted identity, and a de-identified deletion audit may remain.

Account-deletion instructions are also available at Puthaiyal Account Deletion.

8. Your privacy rights

Subject to applicable law, you may ask to access, correct, update, delete, or receive a copy of personal data associated with your Puthaiyal account, and may object to or request restriction of certain processing. You may also withdraw consent where processing relies on consent and complain to an appropriate data-protection authority. We may request reasonable verification before completing a request.

9. Security and international processing

We use reasonable technical and organizational safeguards, including HTTPS transmission, access controls, authenticated organizer permissions, restricted tenant access, and protected service infrastructure. No method of electronic transmission or storage is completely secure. Service providers may process data outside your state or country; where required, appropriate contractual or legal safeguards are used.

10. Children’s privacy

Puthaiyal is not directed to children under 16. A minor may participate only where permitted by the organizer and with the authorization and supervision of a parent or legal guardian. If you believe a child’s data was submitted without appropriate authorization, contact us so it can be reviewed and deleted where required.

11. Changes to this section

We may update this Puthaiyal privacy section when the app, its data practices, or legal requirements change. The updated date will be shown above. Material changes may also be communicated in the app, by email, or through another appropriate notice.

12. Contact

For Puthaiyal privacy questions, rights requests, or deletion assistance, contact digital@askantech.com. You may also use the Zyfoo privacy contacts and address listed in the general policy above.