YOUR ESCAPE

Privacy

Your Escape is the app escape room venues use to check players in and share their results. This page explains what we keep about you and why, in plain English.

Who is responsible

For players, the venue you played at decides what happens with your game details, and we look after them on its behalf. The same goes for venue staff: the venue you work for decides. For the early-access list and My escapes, Your Escape is responsible. Players don’t have accounts with us, so we never ask for your email to play.

What we collect

Players

  • When you join a game: the name you give, your team name, that you accepted the venue’s house rules, and whether you watched the briefing.
  • Your results: times, hints, rankings, ratings and comments you leave, and the team photos the venue adds.
  • A random code that remembers you on the phone you joined on, and makes your own link back to the game. We store it only scrambled (as a hash).
  • If you keep your escapes on your phone (My escapes): your list of games, encrypted on your phone with a key only your link holds. We store the encrypted list but can’t read it, so we never know which games are yours or who you are.
  • Booking details the venue gives us (the booker’s name, email and phone number), so we can link your booking to your game and the venue can contact you about it.
  • If the venue has us email booking confirmations: a copy of each email, so staff can check or resend it.
  • Notes the game master writes about your game.

Venue staff

  • Your name, email, password (stored only as a secure hash), two-factor and passkey details, and what you do in the admin.
  • Your IP address, for a day at most, to slow down repeated sign-in attempts. Cloudflare, which hosts us, also keeps its own short-lived request logs.
  • If you turn on notifications: each device’s notification address and a name for it, like “iPhone · Safari”. Notifications travel through your browser’s push service (Apple, Google, Mozilla or Microsoft) encrypted, so it can’t read them.

Early-access list

  • Your name, email, venue, town, number of rooms, how people book now, anything you tell us, and how you found us.
  • We use it only to contact you about Your Escape.

How long we keep it

As short as we can. A daily clean-up deletes each thing when its time is up:

The booker’s email address and phone number, and our copy of the emails sent to them
7 days after the game
Game master notes
30 days after the game
Team photos
30 days after the game (a photo a player shares stays while it’s shared)
Players’ names, the house rules they accepted and the booker’s name
3 years after the game, in case of a claim about it
The link between a rating and the player who left it
12 months; the stars and comment stay, anonymously
Venue staff accounts
While you’re on a venue’s team; then 12 months after you last sign in
Booking holds that were never paid
1 day after they expire
Rota shifts and managers
12 months after the shift
Day-off requests
12 months after the last day off
Rota calendar links
Until a new link replaces them, or the person leaves the team
Staff notification devices
Until you remove the device, it stops taking notifications, or you leave your last venue team
Sign-ins, password-reset codes and staff invites
Until they expire or are used
My escapes lists (encrypted; we can’t read them)
3 years after the last change, or straight away if you delete your list
The early-access list
12 months, or until we launch
Times, hints and team names on leaderboards
Kept: they don’t name anyone

Deleted data stays in our database backups for up to 30 days. It is never restored or used, and is then gone for good. A venue can ask us to delete its players’ data sooner.

What is public

Leaderboards show times and hints, never players’ names. A team’s name appears only when the venue chooses to show it; otherwise the team is “A team of 4”. A result only becomes a shareable link when a player in the team chooses to share it, and anyone in the team can turn it off again. Join links and private pages are kept out of search engines.

Where it is kept and who helps us

Everything runs on Cloudflare (hosting, database, photo storage and sending emails), with the database and photos stored in Europe. We don’t sell your data or share it with anyone else.

Cookies

Only the ones needed to remember which games you joined on this phone, and to keep venue staff signed in. If you keep your escapes, your phone also remembers your escapes link in its own storage, which is never sent to us. No analytics or advertising cookies, so there’s no cookie banner.

Your rights

You can ask to see, correct or delete what we hold about you, or to be removed from the early-access list. Email hello@your-escape.link. For a game at a venue, you can also ask the venue. We reply within a month.

If you’re unhappy with how we handle your data, please complain to us at the same address first: we’ll acknowledge it within 30 days and tell you what we’ve done. You can also complain to the Information Commissioner’s Office (ico.org.uk).

Last updated 15 October 2026.