LitterQuest Privacy Policy
Last updated: 8 October 2026
LitterQuest is a litter-cleanup game. This policy describes exactly what data the app collects, why, and what happens to it. It is written to be readable by players of any age — if anything is unclear, ask an adult to read it with you.
What we collect
| Data | Why | Detail |
|---|---|---|
| Photos of litter you submit | To verify cleanups and award XP, and to train the app's litter recognition (see below) | Photos are re-encoded on our server. All hidden metadata (EXIF), including the exact GPS position embedded by your camera, is destroyed before storage. Photos are never shown to other users and are never public. |
| Approximate location of a submission | To place your cleanup in a map zone | Your exact GPS position is never stored. Before saving, it is blurred by roughly 100 metres using a one-way process. Nobody — including us — can recover where exactly you stood. |
| Litter pin and bin locations | To show them on the shared map | These are exact locations you deliberately choose to publish by dropping a pin. They mark litter or bins, not you. |
| Display name and avatar | Shown on leaderboards | Optional; you pick them. Do not use your real full name. |
| Play statistics | XP, streak dates, medals, zones, daily quiz answers, buddy bond and daily buddy visits | Derived from your submissions and from what you do in the app (answering the daily quiz, saying hello to a buddy). Used only to run the game; deleted with your account. |
| A player identifier | To keep your account's data together | An opaque ID. We do not collect your email, phone number, real name, or contacts. |
| Username and PIN (optional) | So you can sign back in on any device | If you create a sign-in, you pick a username (checked against a profanity filter; it becomes your default display name) and a 4-digit PIN. The PIN is stored only as a salted cryptographic hash. Still no email or phone. |
| Labels you draw (optional, 18+) | To train the app's litter recognition | Only if you opt in to labelling: the boxes and litter types you draw on your own photos, and any new litter type you suggest. |
| Consent records | Evidence of what you agreed to | When you accept the safety rules or opt in to labelling, we record the time and the version you accepted, and — for labelling — your confirmation that you are 18 or older. |
| Step count (on your device only) | To show how far you walked while cleaning | Read from your phone's built-in step sensor while the app is open. It is displayed to you and never sent to our servers — it is not stored, shared, or linked to your account. |
What we do NOT collect
- No exact GPS history — ever. Blurring happens before anything is stored.
- No advertising identifiers, no analytics trackers, no third-party SDKs that profile you.
- No contacts, no photos other than the ones you explicitly submit.
- No email address, phone number, real name, or date of birth. (For labelling we ask you to confirm you are 18 or older; we never ask for your age or birthday.)
Teaching the app to recognise litter
LitterQuest uses a litter-recognition model to check that a submitted photo really shows litter. Three things you should know:
- Your submitted photos may be used to improve that model. A photo you send us can be reviewed by us and used as a training example so the app gets better at telling litter from everything else. Photos used this way are still never shown to other players and never published. Photos that show people, faces, number plates or private property are rejected for training when they are reviewed.
- Labelling is optional, for players 18 and over, and separate. You can choose to draw boxes around litter in your own photos. You have to confirm you are 18 or older and accept a clear consent screen first. Every label is reviewed by a person before it is used, you earn no XP or reward for it, and a new litter type you suggest is seen by no other player until we have reviewed it.
- You can stop at any time. Settings → Help train the litter spotter → Stop helping deletes every label you have made, and they are not used in any future training.
Where training happens. Training runs on private systems we control and on Google Colab, a cloud computing service provided by Google (see The companies involved). Training copies of photos are kept in our private training storage, never on any public service, and are uploaded to Colab only for the length of a training run. The encrypted second copy described in Where data lives includes them, and is replaced every week, so a training copy we delete leaves it within a week.
The honest limit of deletion. When you delete your account — or stop labelling — your photos and labels are deleted from our servers straight away, and the training copies are deleted from our private training storage before the next training run, and in any case within 30 days. A model that has already been trained cannot have one photo removed from what it learned — but the photo itself is gone, and it is never used in any future training.
The companies involved
Weather (the only thing shared from your device). To warn you about dangerous conditions before a cleanup, the app sends an approximate location — rounded to about 11 km — directly from your device to a weather provider, Open-Meteo (open-meteo.com). It is rounded before it is sent, never includes your photos or identity, and never passes through the LitterQuest server. Open-Meteo is a free service that needs no account and, per its terms, does not sell or retain the request. Weather data is provided by Open-Meteo under a CC BY 4.0 licence.
Maps. Map tiles come from Google Maps on Android and Apple Maps on iOS, the same way they do in any map app. Those providers see the map area you are looking at, under their own privacy policies. Your cleanups, photos, and account are never sent to them.
Our service providers. These companies process data on our behalf; they are not allowed to use it for their own purposes:
| Provider | What it handles |
|---|---|
| Railway (United States, San Francisco) | The server, the game database, and the private photo storage |
| Sentry | Server error reports — stack traces only. Configured to send no request bodies, no photos, no coordinates, and no personal data. |
| Google (Google Colab; servers in the United States and other countries) | Model training runs. Photos used for training — with their litter labels, and no account details — are uploaded for the length of a run. |
| Microsoft (OneDrive; servers may be outside Australia) | Storage for the encrypted second copy of backups and training photos. Encrypted before upload; Microsoft cannot read it. |
Age and children
LitterQuest is intended for people aged 16 and over, and labelling is only for people aged 18 and over. It is not directed at children, and we do not knowingly collect data from a child — indeed we collect no name, email, phone number, or date of birth from anyone, so we hold nothing that could identify a minor. Before first play, everyone must accept a safety screen confirming they are 16 or older, or accompanied by an adult.
We still design defensively, because a younger player might use the app anyway: hazardous litter (needles, chemicals, broken glass) earns no rewards — the app tells you to report it and not touch it — location data is blurred for everyone, and there are no purchases, subscriptions, or advertising of any kind. If you are a parent and want your child's data removed, use the deletion options below.
Where data lives
Your data is stored overseas, in the United States. LitterQuest is an Australian game, but the servers that run it are not in Australia. Both the game database (a managed PostgreSQL database) and your photos (a private disk volume) are hosted by Railway in its San Francisco region, in the United States, and training runs use Google Colab, which may run in the United States or other countries. The database is protected by encrypted connections and credentials that only the LitterQuest server holds, and photos are not served publicly by any endpoint — but by using LitterQuest you consent to your data being handled outside Australia, where Australian privacy law may not apply to it and foreign law may.
Where backups are kept. Once a week, a complete copy of the game database and the photo storage is made, so that LitterQuest can be restored if something fails. Backups are kept in private storage we control, in Australia, and are used for nothing except restoring LitterQuest after a failure. We keep the eight most recent weekly backups and delete each older one automatically, so no backup is more than about eight weeks old. The one exception is a single archival copy made on 12 September 2026, which is kept separately, in the same private storage, and is not used for anything except restoring LitterQuest.
An encrypted second copy. So that one failure cannot destroy both LitterQuest and its backups, a second copy of the two most recent weekly backups, and of the training copies of photos, is stored with Microsoft OneDrive. It is encrypted (AES-256) before it leaves our systems and only we hold the key, so Microsoft cannot read it. Microsoft may store it outside Australia. Older copies are deleted automatically, so this copy is never more than about two weeks old.
The game database moved to Railway on 5 August 2026. Until 16 September 2026 this section still named the previous provider and described the database as being in an Australian data centre, which no longer matched where the data actually was. Until 24 September 2026 this policy also did not name Google Colab, where the litter-recognition model is trained, although photos used for training had been uploaded to it for training runs. We have corrected both.
Retention and deletion
Data is kept while your account is active. You can delete everything yourself, at any time, in two ways:
- In the app — Settings → Danger zone → Delete my account. After two confirmations, the server permanently deletes your photos, blurred locations, XP, streak, medals, zones, pins, bins, labels, display name and sign-in, and immediately invalidates your session. Training copies are deleted as described above. This cannot be undone.
- Without the app (for example if you have already uninstalled it) —
follow the instructions at
/data-deletionon the LitterQuest server, or in DATA_DELETION.md. Requests are actioned within 30 days.
Backups, the second honest limit. Deleting your account removes your data from the live service straight away, but a copy may still exist inside backups made before you deleted it, until those backups expire: at most about eight weeks (and, if your account existed on 12 September 2026, in the archival copy described above). Backups are never used to look up, recover or re-create a deleted account. If we ever had to restore LitterQuest from a backup, we would first re-apply every account deletion we have a record of, before the service came back.
A new litter type you suggested that we approved, and that other players now use, stays — with your name and ID removed from it.
The one thing we keep is your acceptance of the safety rules (a timestamp and a rules version against your now-deleted anonymous ID). We retain that as evidence that the safety warnings were shown, as our Terms describe; it contains no personal information.
If something goes wrong
If we become aware of a security incident that is likely to cause serious harm to anyone whose data we hold, we will tell the people affected and explain what happened and what to do, as quickly as we can.
Changes
If this policy changes, the "Last updated" date changes with it, and the
current version is always available at /privacy on the LitterQuest server.