Privacy Policy

In effect from 10 September 2026

QRWiner is operated by Afra Infotech. This policy covers the QRWiner mobile app and this website. It describes what we collect, why, who we share it with, and what you can ask us to do about it.

What we collect, and why

We collect only what the game needs to work and to stay honest. Each category below exists for a stated reason; nothing here is gathered for advertising.

Your account

Your name, email address, and a hashed password. Optionally a phone number and a profile photo. Your date of birth, which we use once, to check you are old enough to hold an account. Your language, country, city and time zone, so hunts and notifications reach you in the right language and the right local time.

Where you are

Your precise location when you open the map, check in at a shop, or scan a code, together with how accurate that fix was. If you turn on alerts for hunts near you, the location and radius you chose for those alerts. Location is what makes the game work: a prize can only be won inside the shop holding it, and we cannot award one without knowing you were there.

Your device

An identifier the app generates for the handset, the platform, operating system version, app version, device model, device language, the notification token that lets us reach it, and the IP address the request came from. This is what tells one of your phones from another, and what lets us block a device being used to cheat.

How you play

Every check-in and every scan attempt, whether it won or not, including the result, how far you were from the shop, how accurate the fix was, whether the device reported a mock location, and whether the device passed integrity checks. Your wins, the prizes you collected, any disputes you opened, and any ratings you left.

Payments, for shops only

Card details are handled entirely by Stripe and never reach us. We store the Stripe identifiers for a purchase, the amount, the currency, the status, and when it was paid or refunded. Hunters never pay for anything, so hunters have no payment data here at all.

Your camera

The app uses the camera to read a QR code. The image is decoded on your phone and is neither stored nor sent to us.

What shops upload

A shop logo, and a photograph showing a printed code in place. The placement photograph is proof that the code was findable and is never published.

Why we are allowed to hold it

We hold your account, location and gameplay data because it is necessary to provide the service you asked for. We hold scan, device and integrity data because we have a legitimate interest in stopping people from winning prizes they did not earn — without it, one leaked code would be claimed by everyone who saw it. Precise location and notifications are used only with the permission you grant on your device, and you can withdraw either at any time in your phone settings. Payment records are kept because tax and accounting law requires it.

Anti-fraud checks

Every scan is checked automatically before anything is awarded: that the hunt is running, that you are inside the shop, that the location is not simulated, that the device passes its platform integrity check, and that you have not moved impossibly fast since your last scan. Failed attempts are recorded along with why they failed. Repeated abuse can result in a device or an account being blocked. If a check blocks you and you believe it was wrong, write to us and a person will look at it.

Who else sees it

We do not sell personal data, and we do not share it for advertising. It reaches these parties and no others:

• The shop that owes you a prize sees your display name, what you won, when you won it, and which platform you scanned on — enough to recognise you at the counter. It never sees your email address, your phone number, your date of birth, or your location.
• Stripe, which processes payments for shops and holds the card details we never receive.
• Google Firebase Cloud Messaging, which delivers notifications to your device.
• Google Maps, which renders the map and is sent the area being viewed.
• Our hosting and infrastructure providers, who store the data on our behalf and may not use it for anything else.
• Authorities, where the law obliges us to hand something over.

How long we keep it

Your account and its history stay while the account exists. Scan attempts and device records are kept for two years, because a fraud pattern is only visible over time. Payment records are kept for as long as tax law requires, which is generally seven years. When you delete your account we remove your personal details and disconnect your gameplay history from you, keeping only what we must for accounting and abuse prevention.

What you can ask for

You can ask for a copy of what we hold about you, ask us to correct it, ask us to delete it, object to how we use it, or withdraw a permission you gave. Write to sales@afrainfotech.com and we will answer within thirty days. If you are unhappy with our answer you can complain to your local data protection authority.

Deleting your account

You can delete your account from the app, under Profile. You can also ask us to delete it by writing to sales@afrainfotech.com from the address on the account. Deletion removes your name, email, phone, date of birth, saved locations, profile photo and notification tokens. Records of completed payments and of blocked devices are retained as described above.

Age

QRWiner is not for children under 13. We ask for a date of birth at registration and refuse accounts below that age. If you believe a child has an account, write to sales@afrainfotech.com and we will remove it.

Where the data goes

Our providers may process data outside the country you live in. Where that happens we rely on the safeguards those providers offer, including standard contractual clauses.

Security

Traffic is encrypted in transit. Passwords are stored hashed and cannot be read by us. Access to production data is limited to the people who operate the service. No system is perfect, and we will tell you and the relevant authority if a breach affects you.

Changes

If we change this policy in a way that affects you, we will change the date at the top and, for a significant change, tell you in the app before it takes effect.

Contact

Questions about this document go to sales@afrainfotech.com.