Privacy Policy

Information you provide:

• Account details: email address, username, password, and account type (personal or business).
• Phone number, which we verify by text message.
• Profile information you choose to add, such as a bio and profile photo.
• Identity and payout details you provide to our payment partner when you cash out (handled by Stripe — see below).
• Messages you send us through the Help Center or contact forms.

Information we collect automatically:

• Location data. To show nearby drops and verify claims, we process your device’s GPS location while you use the app. Claims are verified using your location at the time of the claim.
• Basic usage and device information, and activity such as drops you claim.

• To operate the game: show drops, verify claims by location, and track winnings.
• To create and secure your account, and verify your phone number.
• To process cashouts through our payment partner.
• To send you service messages and notifications (for example, when your drop is found or claimed).
• To prevent fraud, cheating, and abuse, and to enforce our Terms.
• To comply with legal and tax obligations.

GeoStash needs your location to function. We use your GPS location to display nearby drops and to confirm you are physically present when you claim a drop. You can turn off location access in your device or browser settings, but you will not be able to find or claim drops without it. We do not sell your location data.

We do not sell your personal information. We share it only as needed to run GeoStash:

• Service providers that power the app: Stripe (payments and payouts), Twilio (phone verification), Mapbox (maps), Supabase (accounts, database, and storage), and Resend (email). These providers process data on our behalf under their own terms.
• Other users: your username, profile photo, bio, and public activity (such as appearing on the leaderboard or feed) are visible to others. Your email, phone number, and payout details are not shown publicly.
• Legal reasons: when required by law, or to protect the rights, safety, and security of GeoStash and its users.

Payments and payouts are handled by Stripe. When you cash out, you provide identity and debit-card information directly to Stripe, and Stripe processes it under its own privacy policy. GeoStash does not store your full card number or bank credentials.

We keep your information for as long as your account is active and as needed to provide the service, comply with our legal and tax obligations, resolve disputes, and enforce our agreements. We may retain certain records after account closure where required by law.

We take reasonable measures to protect your information, and we rely on trusted providers such as Supabase and Stripe. No system is completely secure, however, and we cannot guarantee absolute security. Keep your password confidential.

• You can edit your profile information at any time in the app.
• You can turn off location access in your device or browser settings (this disables finding and claiming).
• You can request access to, correction of, or deletion of your personal information by contacting us through the Help Center. We will respond as required by applicable law.

GeoStash is not intended for children. You must be at least 18 years old to cash out winnings, and the app is not directed to anyone under 13. We do not knowingly collect personal information from children under 13; if you believe a child has provided us information, contact us and we will delete it.

We may update this Policy from time to time. When we do, we will update the “Last updated” date above. Continued use of GeoStash means you accept the updated Policy.

Questions about your privacy or this Policy? Reach us through the Help Center or by email at support@geostash.app.