Privacy*

1. Introduction

This Privacy Policy ("Policy") describes how Asterisk Society* ("we," "us," "our"), currently operated by an individual proprietor based in Gurugram, India, collects, uses, discloses, and safeguards personal data of users ("you," "your") of asterisksociety.in and the associated booking and gameplay services (together, the "Services"). This Policy is framed with reference to India's Digital Personal Data Protection Act, 2023 ("DPDP Act"). By using the Services, you agree to the collection and use of your personal data as described in this Policy.

2. Personal Data We Collect

We collect the following categories of personal data:

2.1 Account data. If you sign in with Google, we receive your name, email address, and profile photograph from Google. If you add a phone number to your account, it is verified by one-time password (OTP) before being attached to your account.

2.2 Booking data. When you make a booking, we collect the booking captain's name, email address, OTP-verified phone number, date of birth, team size, the names of any teammates you add, and, where applicable, a promotional code. Where you provide consent, we also record your preference to receive promotional communications.

2.3 Payment data. Payment is processed entirely by Razorpay through its own hosted checkout interface. We do not receive, process, or store your card, UPI, or bank account details. We retain only a payment reference identifier and the transaction's success or failure status.

2.4 Gameplay data. While you are an active participant in a live game, we collect your display name, team assignment, the clue answers your team submits, and your device's GPS location (see Section 5).

2.5 Uploaded content. If you upload a profile photograph, it is stored on our servers and assigned a direct access link. This link is not restricted to your account alone.

2.6 Usage data. We use Google Analytics and PostHog to collect standard web analytics data, including pages viewed, referring source, approximate location derived from IP address, and device/browser type, and to understand how the booking process is used (for example, when a checkout is started or completed). If you are signed in, this activity is linked to your account. On our public and booking pages, PostHog may also record anonymised session replays of page interactions; anything typed into a form field is hidden from these recordings, and nothing is recorded during a game or on your account pages. See Section 7.

3. Purpose of Processing

We process personal data for the following purposes:

(a) to create and administer your account; (b) to process and confirm bookings, including payment verification; (c) to operate live gameplay, including team coordination and clue-unlock mechanics that depend on location; (d) to send transactional communications related to a booking (Section 6); (e) to send promotional communications, where you have provided consent; and (f) to comply with applicable law.

We do not sell personal data, and we do not use personal data for advertising or cross-device tracking.

4. Disclosure to Third Parties

We disclose personal data to third-party service providers only to the extent necessary to operate the Services, for the following purposes: (a) payment processing; (b) delivery of booking- and game-day-related messages, where you have provided consent to receive them; (c) hosting, database, authentication, and file storage infrastructure; (d) delivery of transactional email; and (e) website and product analytics (Google Analytics and PostHog). Each such provider is contractually or otherwise restricted to using personal data solely to perform the relevant service on our behalf.

We do not disclose personal data to any other recipient, except where required by law, regulation, court order, or a lawful request from a governmental authority.

5. Location Data

Location tracking operates only while you are an active participant in a game that is currently live; it does not operate before or after that window. Location data collected during a game is accessible to the event's administrator/handler for the purpose of coordinating gameplay and enabling location-based clue mechanics. It is not disclosed to other players, including your own teammates. Location data collected from October 2026 onward is deleted automatically 30 days after it is collected; you may request earlier deletion under Section 9.

6. Communications

Booking confirmations, event dossiers, match-day reminders, and cancellation notices are transactional communications sent regardless of marketing consent, as they are necessary to deliver the Services you have booked. Promotional communications (e.g., notice of new experiences) are sent only where you have provided consent. To withdraw consent for promotional communications, contact us at the address in Section 12.

7. Cookies

We use a session identifier (via Firebase Authentication) to keep you signed in; this is strictly functional and is not used for tracking. We separately use Google Analytics and PostHog, which set cookies or local storage to measure site traffic and usage. We do not use advertising or cross-site retargeting cookies.

8. Data Retention

We retain personal data for as long as your account remains active, or for as long as reasonably necessary to fulfil the purposes set out in Section 3, including to meet accounting, tax, or other legal obligations. We do not currently operate fixed automated retention periods for most categories of data described in Section 2. You may request earlier deletion under Section 9.

9. Your Rights

Under the DPDP Act, you have the right to: (a) obtain a summary of the personal data we hold about you and the processing activities undertaken; (b) request correction of inaccurate or incomplete personal data; (c) request erasure of personal data that is no longer necessary for the purpose for which it was collected; and (d) file a complaint with us regarding the processing of your personal data (Section 12).

To exercise any of these rights, contact support@asterisksociety.in. We will respond within 30 days. Where deletion of your data would prevent us from fulfilling an existing booking obligation, we will notify you of this before acting on the request.

10. Age Restriction

The Services are restricted to individuals aged 16 years and above. We verify this against the date of birth provided by the booking captain at the time of booking; a booking cannot be completed if this check is not satisfied. A parent or guardian may not book on behalf of a person under the age of 16, and no person under the age of 16 may participate in the Services under any circumstances.

11. Security Measures

We implement reasonable technical and organizational measures to protect personal data against unauthorized access, use, or disclosure, consistent with the requirements of the DPDP Act. We do not collect payment card or bank details directly, and we limit collection to what is necessary for the purposes described in Section 3.

12. Grievance Redressal

In accordance with applicable Indian law, our Grievance Officer for matters relating to this Policy is reachable at support@asterisksociety.in. Complaints will be acknowledged within 24 hours and, where possible, resolved within 15 days. If you are not satisfied with the resolution provided, you may escalate the matter to the Data Protection Board of India under the DPDP Act.

13. Amendments

We may revise this Policy from time to time. Material changes will be reflected on this page with an updated "Last updated" date. Continued use of the Services following any amendment constitutes acceptance of the revised Policy.

14. Contact

For general queries regarding this Policy, contact hello@asterisksociety.in.