Privacy Policy
THE4868 is a free treasure hunt in and around Sacramento, California. This policy says what we collect when you use the site, why, and what you can do about it. There are no accounts, and we never sell or share your information for advertising.
What we collect
- Your agreement. When you agree on the "Before you hunt" screen we record a random id, the version of the Terms you agreed to, the time, that you confirmed your age, a one-way hash of your network address and your browser type.
- Claims. When you claim a treasure we record when it happened, which treasure and reward it was, a one-way hash of your network address, your browser type and your agreement record. These keep the hunt fair and let us sort out problems with a reward.
- Visits. A cookie with a random id lets us count visits, scans and steps such as opening a treasure page or revealing a reward. We store a one-way hash of that id with each event, never your name or email. We use no third-party analytics or advertising trackers.
- Email addresses, only if you give us one. "Email me this reward link" sends your reward link once, and we keep the address with your claim so we can send you a replacement link if your reward has to be reissued. "Notify me" puts the address on the next-hunt list with where you signed up. A reply address on a problem report is used only to answer that report.
- Feedback. Feedback answers are anonymous. We don't store your email, network address, browser or visitor id with them.
Cookies
- Agreement (th_consent): remembers that you agreed, for up to 90 days or until the Terms change.
- Visits (th_vid): the random visit id described above, for up to a year.
- Your reward (th_reward): holds your reward link so you can find your reward again on this device, for up to a year.
All three are first-party, sent only to this site and unreadable by page scripts.
Every email has an unsubscribe link. Once you unsubscribe, or if your address bounces or is reported as spam, it goes on a suppression list and we never email it again. Reward emails have open and click tracking turned off.
Who else handles it
- Cloudflare Turnstile checks that forms are sent by a person. Cloudflare sees your network address and browser signals for that check.
- Postmark delivers our emails, so it receives the address and the message.
- Our hosting and database providers store the information above for us.
They handle it only to provide those services to us.
Keeping it safe
Gift card numbers and PINs are encrypted and shown only on your reward page. Reward links and secret codes are stored only as one-way hashes. Organisers sign in through a secure sign-in provider, and every organiser action is logged.
How long we keep it
We keep hunt records as long as we need them to run the hunts, handle problems with rewards and keep the game fair. We keep suppressed addresses so we can keep honouring your unsubscribe.
Your choices
You can unsubscribe from any email at any time. To ask what we hold about you, or to have it deleted, email [email protected]. California residents have these rights under the CCPA, and we don't sell or share personal information.
Children
The hunt is for people 18 and older, or younger hunters with a parent or guardian who agrees for them. We don't knowingly collect information from children under 13.
Changes
If we change this policy, the new version appears here with a new date.
Version 2026-10-08