Ninmuya · Privacy policy
Draft. To be checked by a Hong Kong solicitor before launch.
Who we are
FakeGenius Limited ("Ninmuya", "we") runs Ninmuya from Hong Kong and is responsible for your personal data under the Personal Data (Privacy) Ordinance.
This policy is also our personal information collection statement. It explains what we collect, why, who we share it with, and your rights.
What we collect
- Account: email address, display name, and, if you add them, your real name, date of birth, profile photo and phone number. If you sign in with Google, Google gives us your name, email address and profile photo. We check a phone number by text message.
- Quests and applications: titles, descriptions, rewards, time limits and the location you pin.
- Evidence: the photos hunters send, with the location and time they were sent.
- Messages, photos and PDF documents you send in quest chats, and any reports or blocks you make.
- Payments: amounts, status, and your Stripe account reference and payout status, including anything you pay to notify hunters about a quest. Card and bank details go straight to Stripe; we never see full card or account numbers.
- Your hunter tier, from 0 to 5, which we work out from the full rewards of the quests you've been paid for in the last 30 days.
- Ratings: the stars and comments you give and receive after a quest, and when they were given.
- Location, only while you use the app, to show nearby quests and to attach to evidence. If you turn on Quest alerts and choose to use your location, we also keep the rough area you were last in (to about 1 km), so we can send you quests nearby. Turning that off deletes it.
- A record of when you agreed to these terms, which version, and in which language.
- Device and usage data: notification settings, the token your phone gives us so we can send it notifications, crash reports and basic usage, to keep the app working.
- Quest alerts: whether you have them on, when you chose, and how many promoted quests we have sent you today.
We don't ask for your Hong Kong Identity Card. Where a hunter's identity needs checking for payouts, Stripe does it.
Why we use it
- To run your account and the quests you post or do.
- To take payments, pay hunters and make refunds.
- To keep people safe: handling reports and blocks, preventing fraud and enforcing our rules.
- To show ratings, so people can decide who to work with.
- To look into and settle disputes.
- To meet our legal duties, such as keeping tax records and answering lawful requests.
- To send you messages about your account and your quests, in the app and to your phone.
- If you turn on Quest alerts: to send you quests you might want, including ones their givers have paid us to promote (see Direct marketing).
- To fix and improve the app.
We don't sell your data, and we don't show you other companies' advertising. The only promotion we send is Quest alerts, and only if you turn them on.
What you have to give us
An email address is needed to have an account. Givers need a card to hire a hunter, and hunters need to finish Stripe's payout setup to apply for quests. Evidence needs a photo and your location. Everything else is up to you, though some features won't work without it, such as nearby quests without location.
Who we share it with
- Other users: your display name, profile photo, when you joined, your hunter tier (but not the amounts behind it), the quests you post (including the location you pin) and the ones you've completed, the messages, photos and documents you send them, a "phone checked" badge and whether you've set up payouts. Only the giver of a quest sees the evidence and location a hunter sends for it. We don't show other users your email address, phone number or birthday.
- Other users also see the ratings you have received: your average as a hunter and as a giver, and each rating with its stars, any comment and the date, the name of the person who wrote it, whether they were the giver or the hunter, and the quest's title. Givers see your average as a hunter when you apply for their quests, and your quests show your average as a giver. Ratings you write appear in the same way, with your display name at the time, on the other person's profile.
- Stripe, to process payments and payouts and to check hunters' identity. Stripe uses this data under its own privacy policy.
- Google, which hosts our database, sign-in, file storage, phone notifications and crash reports (Firebase) on our behalf. Notifications to an iPhone also pass through Apple. Google Maps is provided under Google's own terms and privacy policy.
- Our professional advisers, where needed.
- The police, regulators or a court, when the law requires it, or when someone's safety is at risk.
- Anyone who takes over Ninmuya's business, who must look after your data in the same way. We will tell you first.
Data outside Hong Kong
Our providers store and process data outside Hong Kong, including in the United States. We choose providers with strong safeguards and have contracts with them to protect your data.
Direct marketing
Quest alerts are the only marketing we send, and they are off unless you turn them on in the Me tab. If you do, we use your alert setting, the language you use, your phone's notification token and, if you allow it, your rough location to send you quests posted on Ninmuya, including quests whose givers have paid us to promote them. Each promoted quest says so. We don't pass your data to the giver or to anyone else for this: the giver is shown only a rough number of hunters, never who they are or where. You can turn Quest alerts off in the Me tab at any time, free of charge, and we will stop. Everything else we send is about your own account and quests.
How long we keep it
We keep your data while your account is open. When you delete your account we delete your profile, your photos (except evidence for paid quests), the photos and documents you sent in chats, your login and your Stripe payout account. Messages you sent stay visible to the people you sent them to, shown as from "Deleted user", and paid quests are kept under "Deleted user" too. Ratings about you are deleted. Ratings you wrote stay on the other person's profile without your name. Records of withdrawals, and reports made by or about you, are kept. Stripe keeps its own records under its privacy policy.
Records of paid quests, and of payments to notify hunters, are kept for seven years after payment, because Hong Kong tax law requires business records to be kept that long. Evidence for paid quests is kept for the same period in case of a claim about the work. Reports and safety records are kept for as long as they are needed to protect users and deal with claims.
Your rights
You can ask to see the personal data we hold about you, and ask us to correct it. Write or email to our Privacy Officer, below. We will reply within 40 days, as the law requires.
We may charge a reasonable fee for a copy of your data, as the law allows. Correcting your data is free. If we can't do what you ask, we will explain why.
Security
Data is encrypted in transit and access is limited to the people who need it. No system is perfectly secure, so tell us straight away if you think your account has been misused.
Cookies and browser storage
The web version of Ninmuya uses browser storage to keep you signed in and remember your settings. We don't use advertising cookies.
Children
Ninmuya is for people aged 18 and over. If we learn that someone under 18 has an account, we will close it.
Changes
If we make an important change to this policy, we will tell you by email or in the app before it takes effect.
Privacy Officer
Privacy Officer, FakeGenius Limited, San Po Kong, Kowloon, Hong Kong. Email: info@fakegeniushk.com.
This policy is in English and Chinese. If the two differ, the English version applies.