Privacy Policy

• Account. A username you choose and a PIN. We store the PIN only as a salted hash, never as readable text. If you set up a passkey (Face ID, Touch ID or a device screen lock), we store the passkey's public key; your fingerprint or face never leaves your device. We do not ask for your real name, email address or phone number to play.
• Venue membership and game activity. Which venues you have joined, your points, leaderboard standing, answers, picks, bingo cards, fantasy lineups, rewards progress and prizes. Your username and points are visible to other players at the same venue on leaderboards.
• Location. To confirm you are at a venue, the game asks your phone for its precise location, only after you allow it. Your phone sends the reading to our server, which compares it with the venue's boundary and then discards it: we do not store your coordinates. We keep only the result of the check (whether you were in range, roughly how far you were from the venue, and how accurate your phone said the reading was). We also record the ZIP code, city and state of the venues you join, to produce aggregate reports for venues and advertisers.
• Prizes. Coupons you win, when you redeem them, and the venue where you redeemed. If a venue connects a point-of-sale system, a gift-card prize may be created with the venue's payment provider; we do not receive or store your payment card details.
• Usage and device data. Session start and end times, which games you open, ad views and taps, your IP address and your browser or device type. If you use the share-to-story feature we record that you opened it and whether camera permission was granted; photos you take stay on your phone and are not uploaded to us.
• Notifications. In-app notifications about prizes and games are saved to your account. If we offer phone push notifications, we will ask first, and we will store a device token to deliver them.
• Camera. If a version of the app offers a QR scanner, the camera is used only to read the code you point it at. Nothing is recorded or stored.

• Your email address, password (handled by our sign-in provider), venue name, street address and the map boundary you draw around your venue.
• Subscription and billing details held by Stripe. We receive your plan status, invoices and the last digits of your card, not the full card number.
• If you connect Square or Clover, an access token that lets us apply prizes at your register. Tokens are stored encrypted.
• Names, emails and phone numbers you give us through the contact and advertising forms.

• To run the games, keep scores and leaderboards, award and redeem prizes, and verify you are at a venue.
• To keep the service safe: preventing cheating, moderating usernames and answers, and rate-limiting abuse.
• To measure and improve the games, and to show venue partners and advertisers aggregate results.
• To show advertising. Ads in Hightop Challenge are chosen and served by us, not by an outside ad network, and we do not sell your personal information or use it to track you across other companies' apps and websites.
• To bill venue partners and to answer your questions.

We use service providers who process data for us under their own terms: Supabase (database and sign-in), Vercel (hosting), Stripe (partner billing), Google (address search and maps for partners), Resend (email), and Anthropic (to judge whether a Category Blitz answer fits its category and to screen answers for hateful or explicit content before they appear on a venue screen; only the answers and their categories are sent, never your username or account details). Venue partners who connect Square or Clover share prize and redemption information with that provider. If we add phone push notifications we will also use Google Firebase Cloud Messaging and Apple's notification service.

We show the venue where you play your username, points and prize redemptions so it can run the competition and honor prizes. We may disclose information if the law requires it or to protect people's safety and our rights. If we are acquired, your information may transfer to the new owner under this policy.

We keep account and game data while your account is active. You can delete your account at any time from the menu in the game ("Delete my account"); it takes effect immediately and removes your account, your profile at every venue and the data tied to them, including your scores, which leave every leaderboard, and any prizes you have not used. We keep only records a venue needs that no longer identify you: that a reward's prize was given out, and a venue's gift-card ledger entry. If you can't sign in, email support@hightopchallenge.com with your username and we will delete it for you. Details are on the Delete Your Account page.

You can turn off location permission in your phone settings (you will not be able to join venues that require a location check). You can ask to see, correct or delete your information by emailing support@hightopchallenge.com. Depending on where you live, including California and other states with privacy laws, you may have additional rights to know what we hold, to delete it, and to not have it sold or shared for cross-context advertising. We do not sell personal information or share it for cross-context behavioral advertising, so there is nothing to opt out of. For the same reason we do not track you across other companies' sites or apps, and the service works the same whether or not your browser sends a "Do Not Track" or Global Privacy Control signal.

Hightop Challenge is not directed to children under 13 and we do not knowingly collect their information. If you believe a child has created an account, email us and we will delete it. Venues serving alcohol may set their own age rules.

We protect data with encryption in transit, hashed PINs and limited internal access, but no system is perfectly secure. We may update this policy; the date at the top shows the latest version, and we will highlight material changes in the app or on this page.

Questions or requests: support@hightopchallenge.com.