Your adventure. Your choices.
Version 2026-09-08.1· Updated 8 September 2026
Legal notice
DE SOTO CREATIONS, LLC
United States
248 Bermuda Rd., Marco Island, FL 34145
Florida Division of Corporations · L16000068922
AR Guardians is a walking adventure for iPhone with optional camera effects and virtual rewards. The website provides your account, profile, journey history, collection and coupons. Sign in with your verified email and password. It is not an emergency, surveying or road-navigation service.
Privacy notice
What the app stores and why
To provide your account and adventure, we store your email, account identifier, username, session records, journeys, departure and destination coordinates, dates and times, GPS arrival accuracy, coins, guardians and coupons. Supabase manages password verification and email recovery; the game database does not store your password. We use the route and estimated visit time to choose relevant local rewards. We do not sell your location history or insert route coordinates into merchant links.
We process essential account and journey data to provide the service you request. Session protection and proportionate abuse prevention support our legitimate interest in keeping accounts and rewards secure. Optional affiliate measurement uses your consent and stays off by default. Camera/location permission is a device permission, not blanket consent for unrelated tracking.
You may add a private display name and profile photo. A selected photo is cropped and resized on your device before upload. It is stored with your account, included in your personal-data export, and removed when you remove the photo or delete your account. Live AR camera frames are not used as profile photos.
Camera, location and voice
Camera frames, detected planes and hand interactions are processed on the device by this app; this code does not upload those images. Location observations are sent to the game server to check proximity and record departure or arrival while playing. Background location tracking is not implemented. You can stop camera/location access in your browser or phone settings. Optional spoken stories use the device's speech service, whose processing depends on the voice and operating system.
In the iPhone app, some encounters use gentle movements or an optional blow into the microphone. Motion readings and short audio buffers are processed only on your device, without recording files or uploading them. The microphone starts only after you touch its ripple and allow access, and stops when the interaction ends. You can use touch gestures instead in AR settings.
In the iPhone app, address suggestions use Apple Maps as you type. Apple receives the search text needed to return suggestions. Only the destination you select is sent to the game server to plan your route.
Providers and external shops
Cloudflare hosts the website and game API. Supabase provides email sign-in, the game database and private profile-photo storage; this project uses its Ireland region. Resend delivers verification and recovery emails. These providers process the requests, account data or delivery details needed for their services. The app uses OpenStreetMap tiles, Nominatim search, OpenStreetMap.de walking routes and Overpass building data. Map and search providers receive the necessary map areas, coordinates or queries; direct tile requests also disclose your IP address. Shops receive data when you choose to visit their websites and apply their own privacy notices.
If you opt into affiliate measurement, we record coupon copy/click events and use a random reference in supported affiliate links. That reference can link an attributed sale to a coupon chest inside this app. It is pseudonymous, not proof that the data is anonymous. Without that consent, the app records no optional copy/click events and opens the merchant's official website without adding an affiliate reference. A copied merchant code may still attribute a sale according to the store's own agreement.
Merchant editors may store contact details, campaign agreements and manually reported sales within their own account. The operator is based in the United States. The database region does not mean every provider processes all requests only in Ireland. Contact info@arguardians.com for information about providers, international processing and the safeguards applicable to your data.
Native iOS opens shops without optional affiliate measurement. Rewards still work.
Retention and your rights
Journey and reward history remains available until you delete your account. Export your data or delete your account from Privacy & settings. Deletion removes active game records and closes access. Profile-photo and Supabase account removal are retried automatically if a provider is temporarily unavailable. Restricted migration archives and backups are not erased by this immediate action; contact info@arguardians.com for requests concerning those copies. Migration archives are restricted to preserving and verifying transferred records while the original account transfer remains unresolved. Backup erasure is handled separately from active-account deletion; there is currently no automatic deletion deadline for these restricted copies. Contact us to request their review or erasure. Outside merchants keep records under their own policies. Sign-in cookies can remain for up to 400 days after renewal, but a cookie does not keep a revoked server session valid; signing out removes the session cookies.
You may request access, correction, erasure, restriction and, where applicable, portability or objection. You can withdraw optional measurement consent in settings without losing gameplay or affecting past lawful processing. Contact info@arguardians.com for requests beyond the in-app controls. You may complain to your local data protection authority; in Spain, the AEPD. Location matching does not set prices, award credit or make decisions with comparable legal effects.
Terms of use
Account holders must be aged 16 or over. Do not create an account if you do not meet that age condition. Keep your password and email verification or recovery links private. Use only your own account for lawful personal exploration. Do not falsify location or reward claims, interfere with the service or access another person’s records.
Stay on accessible public paths, obey closures and traffic rules, and stop somewhere safe before interacting. Do not play while driving, cycling or crossing a road. Camera objects, ground estimates, building occlusion and GPS arrival are approximate and may be incomplete. A hidden obstacle or virtual arrow never confirms a safe physical route.
Coins and guardians are virtual game items, not money or a promised financial return. Demonstration coupons cannot be redeemed. Real coupons depend on the merchant's eligibility rules, stock, dates and exclusions. Two local offers cannot be guaranteed when suitable inventory is unavailable. A coupon saved in the wallet is not proof of a completed purchase or a guarantee that a merchant will accept it.
We may receive a commission where a merchant attributes a purchase to an agreed code or link. Affiliate status is disclosed with the coupon. The merchant supplies the goods, checkout and purchase terms; the game does not process checkout payments. No commission is inferred from merely copying or clicking a code.
Downloading the app and playing are free. Canceling a journey preserves already collected rewards. Deleting your account removes active app records as described in the privacy notice. The service may change or be temporarily unavailable. Nothing in these terms excludes mandatory consumer rights or liabilities that cannot legally be excluded. Each merchant provides the terms for its own offers and purchases. The terms version you accept is recorded in your account; material changes require a new acceptance.
Security & safe play
Supabase manages password hashing and account authentication. The server checks that your email is verified and your session remains active. Essential session cookies are HttpOnly, Secure in production and SameSite=Lax. Account-bound queries, journey revisions and request limits protect saved rewards. These controls reduce risk; they are not a guarantee of absolute security.
Use a unique password of at least 12 characters. If you suspect someone has access, use Sign out on all devices and recover your password by email. Report security issues to info@arguardians.com without sending passwords, verification or recovery links, or other users’ data. Do not test against other people’s accounts.
References: AEPD cookie guidance · European Commission: your data rights · OWASP security headers