Privacy Policy
Privacy Policy
Last updated: 30 September 2026
How Stampy collects, uses, shares and protects personal data
Operator Untangled Media Limited (company number C 44674)
Contact info@stampy.mt
Effective Date From Stampy's public launch
This notice applies to the StampyMalta app and stampy.mt, which use the same account service.
1. Who controls your data
1.1 Untangled Media Limited (company number C 44674), operating from Level 2, Office 4, Mallia Buildings, Commerce Street, Mriehel, CBD 3010, Malta, is the controller of personal data processed through StampyMalta and https://stampy.mt. Contact info@stampy.mt for privacy requests.
2. Data we collect
2.1 Account data: name, surname, display name, email address and authentication information. For direct email registration, the password is stored only in hashed form. If you sign in with Google or Apple, we receive the permitted name, email address and authentication identifier, not your Google or Apple password.
2.2 Game data: tile identifier, account identifier, claim date and time, scores, rank, anti-abuse signals and competition records. Your public display is limited to your display name or nickname, score and leaderboard position. Your email address is not displayed publicly. Final leaderboards may be published in Stampy and on stampy.mt.
2.3 Location and claim data: while Stampy is open and after you grant device permission, a live reading is used to decide whether a claim is within an eligible tile. Location is used only while Stampy is open; there is no background tracking. For each claim we retain the coordinates, user ID, tile ID, points, season code, reported location accuracy and timestamp. Exact claim coordinates are retained for 12 months and then deleted.
2.4 Technical data: browser or device information, login information, cookie or similar identifiers, consent choices (on the website) and information required to operate and secure the service. On the Stampy iOS app only strictly necessary cookies are used. We do not currently retain users’ IP addresses or a separate dataset specifically for fraud detection.
2.5 Prize data: correspondence, evidence reasonably requested to confirm identity, age, eligibility or guardianship, and bank or Revolut details supplied by a winner when needed for payment.
3. Why we use data and our legal bases
3.1 We use account, claim and competition data to provide Stampy, calculate scores, verify winners and fulfil prizes because this is necessary to perform our contract with you. We use security, technical and anti-fraud data for our legitimate interests in protecting users, competitions and the service. We process records where necessary to comply with accounting, tax, court, regulatory and other legal obligations.
3.2 We rely on consent for device location access, non-essential analytics or advertising storage on the website, and optional use of a winner’s real name, photograph or video. On the Stampy iOS app, analytics and advertising cookies are not used. Consent can be refused or withdrawn without affecting earlier lawful processing, although a tile cannot be verified without a live location reading.
4. Children and young people
4.1 Stampy is for users aged 13 or over. A user under 18 must have permission from a parent or legal guardian. Malta permits a child aged 13 or over to consent to relevant online-service processing, but parental permission is also part of Stampy’s participation rules. We collect only the limited account and game information described here and do not use behavioural advertising for children.
4.2 If we reasonably believe an account belongs to a child under 13 or that required permission was not obtained, we may suspend or delete it and forfeit points or prizes. A parent or guardian may contact info@stampy.mt.
5. Advertising and analytics
5.1 On the website, Stampy is free with advertising and may use Google advertising services. Depending on the service configuration, the user’s consent choices and applicable law, advertisements may be personalised, non-personalised or limited. Advertising cookies or identifiers requiring consent will not be activated unless that consent has been given.
5.2 On the website, we use Google Analytics to understand use of the service. Analytics is disabled unless and until the user gives consent through the cookie controls. Advertising and analytics choices may be reopened and changed or withdrawn at any time through the website’s privacy or cookie controls. Google acts under its own applicable privacy terms when it receives data through these products.
5.3 On the Stampy iOS app, no analytics or advertising cookies are collected or enabled. Because these categories are not used, a cookie preference centre is not shown in the iOS app.
6. Sharing
6.1 We share data only as needed with service providers that host, secure, authenticate, analyse, advertise, support or administer Stampy, including Amazon Web Services, Google, Apple, and (on the website only) Google Analytics and Google Mobile Ads. MapLibre displays mapping and OpenStreetMap supplies base-map data. Stampy serves the map tiles through its own infrastructure and does not currently retain users’ IP addresses from map-tile requests.
6.2 Sponsors receive aggregate or anonymised information. We do not give them identifiable player data for marketing. If a winner’s details must be sent to a prize supplier for fulfilment, we explain this first and seek consent where required. We may disclose data to police, regulators, courts or professional advisers where required by law or reasonably necessary for safety, fraud prevention or legal claims. We do not sell personal data.
6.3 If Stampy or its business is sold or reorganised, relevant data may transfer subject to this notice, confidentiality and applicable law.
7. International transfers and hosting
7.1 Stampy is hosted using Amazon Web Services infrastructure in London, United Kingdom. This means some personal data may be stored or processed outside Malta and the European Economic Area. Other providers, including Google and Apple, may also process data internationally. Where required, we rely on an adequacy decision, approved contractual safeguards or another lawful transfer mechanism.
8. Retention
8.1 Account and lifetime game history are retained while the account is active. An account may be removed after three years without login following reasonable advance email notice. When a user deletes an account, the account’s personal data, claimed-tile records (including associated coordinates), badges, season results and other game records are removed from active systems immediately and may remain in routine backups for up to seven days. If the deleted player held a displayed leaderboard position, the entry may remain solely to preserve the leaderboard result and will appear as “Deleted User”.
8.2 We retain exact claim coordinates for up to 12 months, unless the account is deleted sooner. Prize, payment, accounting and tax records are retained for legally required periods. We may retain limited ban, dispute and legal-claim records for as long as reasonably necessary.
9. Security
9.1 We use reasonable technical and organisational measures designed to protect personal data, including access controls, secure authentication, logging and proportionate data minimisation. No online system can be guaranteed completely secure. Keep account access secure and contact us if you suspect misuse.
10. Your rights
10.1 Subject to GDPR conditions and exceptions, you may ask for access, correction, erasure, restriction, objection or portability, and may withdraw consent. You may also object to processing based on legitimate interests. Email info@stampy.mt; we may request enough information to verify identity and normally respond within one month.
10.2 Anti-fraud systems may flag activity, but enforcement can be reviewed by a person through the seven-day appeal process in the Terms. Stampy does not make solely automated decisions producing legal or similarly significant effects without the safeguards required by law.
10.3 You may complain to Malta’s Information and Data Protection Commissioner at idpc.org.mt, or to another competent supervisory authority.
11. Changes and contact
11.1 We may update this notice when Stampy, its providers or the law changes. Material changes will be highlighted in the app or website where appropriate. The English version governs. Contact info@stampy.mt or write to the operating address above.