Privacy policy

Account details. Your name, email address, mobile number and a securely hashed password. We never store your password in readable form.

Profile. Your date of birth, postcode, and gender if you choose to give it. Date of birth confirms the 18+ rule, postcode tells us which parts of Melbourne to run hunts in, and all three are used to write your weekly clue in a voice that suits you. Personalisation only changes wording — never how much the clue tells you, because that would make the game unfair. None of it is shown to other members.

Phone verification. We send a one-time code by SMS when you join, to confirm one account per person. Verification is handled by Twilio.

Precise location while you use the member area. If you allow location access, we record your position when you claim a find, and while you use the member portal and hunt pages. We do this to verify claims are genuine, to run the shared search map, to investigate disputes and suspected cheating, and to understand where hunts are being played.

You control this: your browser will ask before sharing, you can refuse, and you can revoke it later in your browser or phone settings. Refusing means you can't claim a find, because we can't verify you were there — but everything else keeps working. We take a reading when you open a page rather than following you continuously, and the app never tracks you in the background or when it's closed.

Payment information.Memberships are billed by Stripe. Your card details go directly to Stripe and are never seen, transmitted or stored by us. We keep only Stripe's customer and invoice references and the amounts paid.

Website activity. We record the pages visited on hub4.au, the approximate city a visit came from, timestamps, and basic browser and device information. We do this with a first-party cookie that identifies a browser rather than a person. If you later log in from that browser, we associate that browsing history with your member account so we can support you and detect abuse.

Gameplay records. Scans, answer attempts, holds, wins, skill points and referrals — the record of how the game was played.

Selfies (only if you offer one). During a hunt you can send us one photo from the chase, and after a verified find we may invite you to send a selfie with the sticker — both purely so we can share them on our social media. It is entirely optional, plays no part in verifying your claim or awarding your prize, and we only store it if you tick the consent box. You can withdraw that consent at any time under Your photos in your member dashboard, after which we stop using it.

Messages you send us. Anything you submit through our contact form, including your name, email and message.

Location is central to a treasure hunt, so we want to be precise about what happens. With your permission, exact GPS coordinates are recorded when you claim a find and when you use the member portal or a hunt page. They are used to verify claims, resolve disputes, detect cheating, and improve how hunts are run.

On the hunt map, your position is used to tighten the shared search circle — but only the distance to the token is stored for that purpose, and no other member is ever shown where you are.

Separately, for analytics, we record only the approximate city a website visit came from — derived from your IP address by our hosting provider. That is deliberately coarse: we do not build precise location profiles of members from ordinary browsing.

We use a first-party cookie to recognise your browser across visits (retained up to two years), and a session cookie to keep you logged in. We also use Google Analytics, which sets its own cookies and processes data under Google's privacy terms.

You can clear or block cookies in your browser. Blocking the session cookie will prevent you from logging in.

To run your membership and billing; to run the game fairly and verify wins; to pay winners; to send you clues, results and service messages; to keep one account per person; to detect collusion, spoofed locations and other abuse; to improve the site; and to meet our legal obligations.

We do not sell your personal information, and we do not share it for others' marketing.

Only the service providers who make Hub 4 work: Google Cloud (hosting and databases, Sydney), Stripe (payments), Twilio (SMS), Mailgun (email) and Google Analytics. Each receives only what it needs. Some are located overseas, which means your information may be processed outside Australia.

We may also disclose information where the law requires it, or where it's necessary to investigate suspected cheating or protect someone's safety.

Account and gameplay records are kept while you're a member and for seven years after your last payment, to meet tax and financial record-keeping obligations. Website activity logs are kept for two years. You can ask us to delete anything we're not legally required to keep.

You can ask for a copy of the personal information we hold about you, ask us to correct it, ask us to delete it, or complain about how we've handled it. Email us and we'll respond within 30 days. If you're unhappy with our response you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

Data is stored in Google Cloud's Sydney region. Passwords are hashed, credentials are held in a managed secrets service, and traffic is encrypted in transit. No system is perfectly secure, but if a breach ever affected you we would notify you and the OAIC as required by law.

Hub 4 is for people aged 18 and over. We don't knowingly collect information from minors.

If we change this policy we'll update the date above and, for significant changes, tell members directly. Questions or requests: get in touch.