Last updated: November 2026
Storytowns respects your privacy. This Privacy Policy explains how information may be collected, used and handled when you purchase or participate in the Storytowns Christmas Scavenger Hunt.
1. Information We May Collect
When you use the Christmas Scavenger Hunt, limited information may be collected to operate the game, including:
- Payment details you enter into Square’s secure payment form (handled by Square, not by Storytowns)
- Your email address (and, in the demo, the number of players), if you enter it on a Christmas Hunt page such as the welcome/practice page or the sign-up page, or if you choose to sign up to our hunts newsletter on the finish page
- If you choose to enter the prize draw by posting a photo on social media and tagging Storytowns, we can see your public post and account name on that platform (see section 5)
- Information you send to Storytowns when you contact us
- Technical information required to provide and manage access to the game
- If you use a promo code, a record of the code used and when (see section 3A)
- Which clues you have completed, so your reindeer collection is saved against your game access record and you can see it again if you return while your access is valid
- Website usage and analytics information (see section 4)
We aim to collect only information reasonably necessary to provide and improve the service.
2. Payments
Payments for the Christmas Scavenger Hunt are processed securely through Square.
Payment information required to process your transaction is handled by Square in accordance with Square's own privacy and security practices.
Storytowns does not directly store your full credit or debit card details.
3. Game Access
The Christmas Scavenger Hunt uses technology to confirm that a valid purchase has been made and to provide access to the game for the applicable access period.
This may involve storing technical information on your device or within our systems so the website can recognise valid game access and determine when that access expires.
This information is used to operate and protect the paid game and is not intended to identify you unnecessarily.
3A. Promo Codes
If you enter a promo code to unlock the hunt, we check it on our server and record which code was used, the time it was redeemed, and a link to the 48-hour access record it created. We do not ask for your name, email address or location to redeem a code.
To protect against people guessing codes, when a code attempt fails we briefly store a scrambled (hashed) form of your device’s network (IP) address, along with the time of the attempt. We never store the address itself, and the scrambled version cannot be turned back into it. These temporary records are automatically deleted within about an hour.
Promo-code redemption records are kept with our other hunt access records (see “14. How Long Information Is Kept”).
4. Website Analytics and Cookies
We use Google Analytics on parts of the website, including the welcome page. Google Analytics may use cookies or similar technologies to collect information about website visits and usage. This may include:
- Pages visited
- Browser and device information
- Approximate location derived from technical information, such as your IP address, where applicable
- Date and time of visits
- Website interaction and usage information
We use this information to understand how people use the hunt, identify technical problems and improve the experience. Google processes this information under its own privacy policy. You can usually manage or block cookies through your browser settings.
Other technical information, such as your IP address, browser type and the date and time of requests, may also be received by the providers that host and deliver the website and its content (see section 11).
5. Email Address
When you enter your email address on a Christmas Hunt page (the welcome/practice page, the game sign-up page or the demo) and continue, it is sent to our server and stored securely in our database, which is hosted by Supabase. In the demo we also record the number of players you select. On the “You’re In” page we also ask how many kids and adults are playing; we store these two numbers against your 48-hour access record, together with the email address you entered earlier in the same browser session, if any. We use them to understand who plays the hunt. The Christmas Hunt forms do not use Formspree.
Separately, the general Storytowns Contact form and the quote/enquiry form on our website are processed through Formspree, a form-processing service, and the details you enter are provided to Storytowns.
We use it for the purpose described on the page and for operating the scavenger hunt.
A copy of the email address may also be held temporarily in your browser’s session storage while you use the website, and is removed when that browser session ends. If you continue to the hunt in the same session, it may be sent to us with your player numbers.
Prize Draw Entry
At the end of the Christmas Hunt, you may choose to enter the prize draw by taking a photo, posting it publicly on Instagram or TikTok, and tagging Storytowns. Entry into the prize draw is optional and is not required to complete the Christmas Hunt.
We do not collect your email address or any other details through our website for the prize draw. We can see your public post and your account name on the social media platform, and we use them only to run the prize draw and to contact winners through that platform. What you post is also subject to that platform’s own terms and privacy policy.
Prize draw entries are subject to the Prize Draw Terms & Conditions displayed on the Christmas Hunt website.
Newsletter
On the Christmas Hunt finish page you may choose to sign up to our hunts newsletter by entering your email address and ticking the box. The box is not ticked for you, and we only add your email address to the newsletter if you tick it. Your email address and your choice are stored securely in our database, which is hosted by Supabase, and sent to HubSpot, our email marketing provider, so we can send you news about Storytowns hunts, including future games and seasonal hunts. You can ask us to remove you at any time by contacting us, and every newsletter email will include a way to unsubscribe.
6. Location
The Christmas Scavenger Hunt requires participants to travel to physical locations to find clues and reindeer.
The web-based hunt does not currently use your device’s precise location (such as GPS), and purchasing or playing it does not mean Storytowns tracks or stores your precise physical location.
Approximate location may be derived from technical information, such as your IP address, by analytics and other services described in sections 4 and 11.
7. Prizes
Prizes may be offered in connection with the Christmas Scavenger Hunt. If a prize-entry process is provided, the information collected and the purpose for collecting it will be explained at the point of entry.
Prize-entry information will only be used for purposes connected with administering the prize unless you separately consent to another use.
8. Children
The Christmas Scavenger Hunt is designed to be enjoyed by families, but purchases and any submission of personal information should be completed or supervised by a parent, guardian or responsible adult.
We do not intentionally require children to provide unnecessary personal information to play the game.
9. How We Use Information
Information collected through the Christmas Scavenger Hunt may be used to:
- Process and verify purchases
- Provide access to the game
- Maintain the 48-hour access period
- Operate the scavenger hunt, including the practice run
- Provide customer support and respond to messages
- Troubleshoot technical problems
- Protect the game against unauthorised access or misuse
- Administer any prize process, if one is provided
- Understand and improve the game and website, including through analytics
- Meet legal and regulatory obligations
10. Sharing Information
Storytowns may use trusted service providers to operate parts of the website and game, including payment processing, website hosting, database services, form and email processing, and analytics.
Information may be processed by these providers where necessary to provide their services.
We do not sell your personal information.
We may also disclose information where required or authorised by law.
11. Third-Party Services
The Christmas Scavenger Hunt website uses the following third-party services:
- Square – payment processing
- Supabase – database, game-access management and storage of Christmas Hunt email sign-ups (including newsletter sign-ups)
- HubSpot – sending our hunts newsletter to people who opted in
- Instagram and TikTok – if you choose to enter the prize draw by posting a photo there (their own terms and privacy policies apply)
- Google Analytics – website analytics
- Formspree – processing of the Contact form and the quote/enquiry form
- Omny – audio hosting
- Google Fonts – website fonts
- Tailwind CDN – website styling and resources
- GitHub Pages – website hosting
When these services are loaded or used, technical information such as your IP address, browser and device information or request information may be received by those providers as necessary to deliver their services. Which services are used depends on the page you are viewing. For example, Square’s payment form is only loaded when you make a payment.
These providers may process information under their own privacy policies and terms.
Links to external websites are provided for convenience, and Storytowns is not responsible for the privacy practices of third-party websites.
12. Overseas and Third-Party Processing
Some third-party service providers used by the website may process or store information outside Australia.
These providers may process information in accordance with their own privacy policies and infrastructure arrangements.
13. Data Security
Storytowns takes reasonable steps to protect information from misuse, interference, loss and unauthorised access, modification or disclosure.
However, no internet-based service can guarantee absolute security.
14. How Long Information Is Kept
Access to the game. Your access to the game lasts for 48 hours from the time of purchase or successful promo-code redemption. This is the period during which you can play. It is separate from how long technical and database records may be kept.
Access records. When a purchase is made or a promo code is redeemed, a technical record is created to verify and manage your access. It includes a scrambled (hashed) version of your access code, the Square payment reference (for purchases) and the times your access starts and expires. This record may remain in our database after your 48-hour access period has ended. It is not automatically deleted when the 48 hours end. The access code saved in your browser may also remain on your device until you clear your browser data.
Promo-code redemption records. If you redeem a promo code, we keep a record of which code was used, the time it was redeemed and a link to the access record it created. As with access records, this is not automatically deleted when your 48-hour access ends.
Reindeer collection records. To save your reindeer collection, we keep a record of which clues you completed and when, linked to your access record. We do not store your answers. As with access records, this is not automatically deleted when your 48-hour access ends.
Why records may be kept. Access, promo-code redemption and reindeer collection records may be retained where reasonably necessary for security, troubleshooting, transaction and access verification, record keeping, or legal and business purposes.
Temporary rate-limit records. When a promo code attempt fails, a scrambled (hashed) form of your network (IP) address and the time of the attempt are stored to limit repeated guessing. These records are automatically deleted within approximately one hour.
Other information. Email addresses submitted through the Christmas Hunt pages, and messages sent to Storytowns, are kept for as long as reasonably necessary for the purposes described in this policy. Newsletter email addresses are kept until you unsubscribe or ask us to delete them. Information held by third-party providers is retained under their own policies.
15. Access and Correction
You may contact Storytowns if you would like to request access to personal information we hold about you or ask us to correct information that is inaccurate.
There may be circumstances where access cannot be provided, including where permitted or required by law.
16. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to the game, technology, service providers or legal requirements.
The latest version will be made available on the website.
17. Contact Storytowns
If you have a question, concern or privacy request relating to the Christmas Scavenger Hunt, please contact Storytowns at xmas@storytowns.com.au.