Privacy Policy

1. Information We Collect

Mission Masters collects information that you provide directly to us, including:

• Account information (name, email address, phone number)
• Profile information and preferences
• Event participation and game data
• Location data when using our app
• Payment information (processed securely through third-party providers)

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Process transactions and send related information
• Send technical notices, updates, and support messages
• Respond to your comments and questions
• Monitor and analyze trends and usage
• Personalize your experience

3. Information Sharing

We do not sell your personal information. We may share your information only in the following circumstances:

• With your consent
• To comply with legal obligations
• To protect our rights and safety
• With service providers who assist in our operations

4. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction.

5. Your Rights

You have the right to:

• Access your personal information
• Correct inaccurate data
• Request deletion of your data
• Object to processing of your data
• Data portability

6. Selfies and Personalized Media (Murder Mystery add-on)

If your organization purchases the optional Personalized Media add-on for a Murder Mystery event, we may collect a selfie from each consenting player so we can generate personalized evidence photos and short video clips that feature their likeness in the game's world. Participation is strictly opt-in and governed by these rules:

• Consent is event-specific. You must grant consent for each event; consent granted for one event does not carry over to another.
• In-app capture + liveness required. Selfies for Personalized Media are captured through our in-app camera with a liveness check. We do not accept uploaded files for Personalized Media, because that would make it impossible to confirm the selfie is of the consenting person.
• Custom Whodunit guest photos. A guest of a Custom Whodunit who is 18 or older and gives both photo okays may upload one photo of themselves for their placard and the host's keepsakes. There is no liveness check: the photo is a picture the guest chose to give us, not proof of identity. We remove the hidden details phones add (such as location), analyze it only to confirm one clear face and nothing unsuitable, store it encrypted, and never show it in public. While the guest list is still open, the guest can remove the photo or take an okay back on their invitation page and it is deleted at once. After the host locks the guest list, the guest can ask us to delete it at privacy@missionmasters.io and we do. In any case it is deleted within 6 months of the day it was uploaded. No guest photo is sent to an image generator unless that feature is turned on after a reviewed pilot.
• Decline at any time. If you decline consent (or later revoke it), you can pick a fictional avatar from our built-in catalog for the game instead. Declining never affects gameplay or scoring.
• Third-party processors are named and limited. We process selfies and derived media through AWS services (Rekognition for liveness and moderation, S3 for storage) and the media generation vendors disclosed in the in-app consent screen. We never send your selfie to any LLM (including Bedrock / Claude), and we never train a model on your selfie.
• Retention is short and automatic. Selfies are deleted from our storage (and from any cached device copy) approximately 24 hours after the event ends or 24 hours after the event recap video is ready, whichever is later, capped at 7 days post-event regardless of recap status. Generated images and videos are retained for up to 30 days so you can download them as a keepsake, then deleted.
• Immediate deletion on request. You can revoke your consent at any time in the app. Revocation cancels any in-flight generation, expires any generated assets, and schedules the selfie for immediate deletion from S3.
• Biometric disclosure (Illinois BIPA and similar state laws). To the extent any state law classifies the liveness check or the generated derivative as a biometric identifier, we do not sell it, we do not disclose it to third parties except as strictly necessary to render your selected media, and we delete it on the retention schedule above or sooner upon your request.
• Abuse reporting. If you see a generated asset you believe misuses a likeness, use the in-app Report action. Reported assets are hidden from gameplay immediately while our team reviews.

If you are located in the European Economic Area or the United Kingdom and your organization has enabled this feature for you, we rely on your explicit consent under Article 9 of the GDPR. You can withdraw consent at any time using the same in-app revoke control.

Custom Whodunit shared yearbook. A guest of a made-to-order Custom Whodunit can choose, at the last question of their alter ego setup, to appear on the yearbook page the host can share after the game. Only if they say yes, that page shows their first name, their alter ego, their awards and their picture (the photo they gave, or a ready-made portrait). It is optional and off unless they say yes, it depends on their earlier photo okays, and they can take it back at any time from their yearbook page (Take me off the shared page); the next person to open the shared page will not see them. The host turning the share link off hides everyone. We delete the photo, and anything made from it, when the guest asks, and in any case within 6 months of the day it was uploaded; after that the shared page shows a ready-made portrait in its place.

Questions or deletion requests for selfies or generated media can be sent to privacy@missionmasters.io.

7. Photos and Videos You Capture During a Mission

Some mission challenges ask your team to take a photo or film a short scene. Those captures are yours. Here is exactly what happens to them:

• You choose to capture. Nothing is recorded without a tap on the shutter, and you can reshoot or skip a scene before it is sent.
• Uploads happen only while the app is open. A capture is saved on your phone first, then sent to our private storage while the app is in the foreground. We never read your camera roll, and copying a capture to your Photos library is optional and asks first.
• The host decides whether to keep the footage. When a game ends, the host chooses Save or Discard. Discard deletes every photo and clip from the game. If no choice is made, the footage is deleted automatically.
• Kept footage is available for 30 days. After a host saves a mission, the team's photos, scene films, and memory video are available to download or share from the team's account for 30 days, then deleted from our storage. Hosts and admins can delete them sooner.
• Who can see them. Only your team, the host of your game, and the judges reviewing your challenge. Judging is done by people; we never use automated systems to judge your videos. Nothing is published without your action.
• How we use them. To score the challenge and to make your team's memory video. We do not use your captures to train AI models and we do not sell them.

Deletion requests for mission photos or videos can be sent to privacy@missionmasters.io.

8. Children's Privacy (COPPA / GDPR Article 8)

We require an age gate (birth month + year) before any account can play. If a user appears to be under our local children's privacy threshold (13 in the US, 13-16 in the EU/EEA, 13 in the UK) we collect verifiable parental consent ("VPC") before collecting any personal information from the child. We never sell children's data, never show targeted ads to children, and never build behavioral profiles of children. We do not collect a parent's birthdate.

Parents and guardians can review, withdraw consent, request deletion, or export their child's data at any time by emailing privacy@missionmasters.io or using the "Withdraw approval" control in the player's account settings. Read our full Children's Privacy Notice for the complete details, including jurisdiction-specific rules and 2027 US state-law preparedness (CAADCA, AASA, AB 1949).

9. GDPR Data Subject Rights

If you are located in the EU/EEA or UK, you have the right to access, correct, erase, restrict, port, or object to processing of your personal data. You may also withdraw any consent at any time. Send requests to privacy@missionmasters.io. We respond within 30 days as required by Article 12 of the GDPR.

10. Cookies

We use cookies to keep you signed in, protect forms, and remember your cookie choice. Optional analytics cookies (Google Analytics 4) load only if you say yes. You can change that choice any time from Cookie settings in the footer. The full list, including how long each cookie lasts, is on our Cookies page.

11. Contact Us

If you have questions about this Privacy Policy, please contact us at:

Email: privacy@missionmasters.io
Address: [Your Company Address]