Last updated: October 21, 2026
Larpmaxx ("we," "our," "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, retain, and safeguard your personal information when you use the Larpmaxx website, dashboard, applications, and related services (collectively, the "Service").
By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Service.
2.1 Information You Provide
2.2 Information Collected Automatically
/r/:code, without the code.2.3 Wallet Configuration You Provide
The Service stores the fictional wallet you configure — display name, avatar, cash balance, token names, symbols and amounts, and related display settings — so that it persists across your sessions and devices. These are values you type in for entertainment purposes; the Service does not connect to any blockchain, exchange or real financial account, and none of these figures represents real money or real holdings. You can see everything held for you by exporting your data, and it is deleted with your account.
2.4 Information We Do Not Collect
We do not collect: biometric data; precise geolocation; content from other applications on your device; or any credential, key or balance belonging to a real wallet, exchange account or financial institution. Our usage analytics do not record keystrokes, or video or screen recordings of your visit, and the record of what you click never includes the words on the page or what you type into a field.
2.5 LarpLocation Desktop App
To use LarpLocation, our desktop app, you link your computer to your account with an activation code from your dashboard. Before you can generate a code you accept the LarpLocation End-User Licence Agreement, and we record on your account which version of the agreement you accepted and when. The code works for 10 minutes and is not single-use: until it expires, anyone who has it can use it to link a computer to your account, so do not share it. When you link a computer, the app sends us the code, a random identifier the app creates for that computer (the device ID), the computer's name, its operating system family (macOS, Windows or Linux) and the app's version. We check that your account exists and that your plan includes access, then send the app a device token. The app keeps the token on your computer, encrypted with your operating system's secure storage (Keychain on a Mac, Windows data protection, or the Linux desktop's keyring) where that is available. Where it is not, as on a Linux desktop without a keyring, the token is stored unencrypted in the app's settings folder, and the app's Account panel says so.
While your computer is linked, the app checks with us when it starts, shortly after the computer wakes from sleep, and about every six hours while it runs, sending the device token, the device ID and the app's version. At each check we confirm that your account still exists and still has access and, if it does, replace the device token with a new one.
We do not keep a record of linked computers: nothing about them is stored in our database. The computer's name is not stored or logged. The device ID is not logged, but it is written, in readable form, inside the device token on your computer. Our server logs record your account ID and the outcome when a code is created, a computer is linked or the app checks in, together with the app's version for links and checks and the operating system family for links. These requests are rate-limited using your IP address and account ID (see Upstash in section 4). Because we keep no record of linked computers, we cannot end one computer's link from our side: Unlink this computer, in the app, deletes the device token from that computer only, and a linked computer keeps working while your account exists and has access. If you delete your account, the next check each linked computer makes is refused and the app forgets its link.
The app also contacts other services directly from your computer, under their own terms and privacy policies, and each of them sees your computer's IP address:
tiles.openfreemap.org, run by Hyperknot Software Kft. in Hungary and served through Cloudflare), which therefore sees the area of the map you are looking at. A search sends only the text you submit to Photon (photon.komoot.io, run by komoot GmbH in Germany); coordinates and map links you paste are read on your computer and are not sent. This version of the app has no routing service and sends your routes to no one. Each of these requests also carries the app's name and version and your computer's operating system and processor type. If you choose another place-search server in the app's Settings, your searches go to that server instead.dl.google.com) only if you choose Download for them, which means agreeing to Google's terms.deviceboxhq.com, a third party that mirrors Apple's image, and for iOS 12 to 16 from a repository on GitHub. For iOS 17 and later, preparing also asks Apple's signing service (gs.apple.com) to personalize that image for the iPhone, which sends Apple the iPhone's unique chip identifier (ECID), its board and chip identifiers and a one-time number the iPhone generates. This happens again after every restart of the iPhone, the next time the app prepares it, sets a location on it or restores it.LarpLocation has no telemetry or analytics, and it does not send us the locations you set, your searches or your saved places. Phone names and serial numbers, saved places, the history of places you have used and the app's recovery record stay on your computer.
2.6 Referral Program
If you use the referral program, we record which code or link brought each customer and which payments earned rewards (amounts, dates and plan). If you choose cash rewards, we also record your legal name, country, payout method and payout account, a phone number or handle we can text, any message you add to a cash request, and your confirmation that you are at least 18 and have reached the age of majority where you live. We use the phone number or handle and your messages only to arrange your payouts with you by text message, never for marketing. To detect self-referral we keep coded (hashed) versions of the network addresses you used and of the cards that paid, and we compare the card that paid with the cards saved on the referrer's account without storing either. We never store your raw IP address or card number for this purpose, and we never ask for a tax number in the app. People you refer appear to you only as "Referral 1", "Referral 2" and so on, with their plan, payment amounts and dates, and never by name or email. They never see your name or email either.
If you use the Ambassador posting streak, we also keep the TikTok and Instagram usernames you add, the links to the posts you add, the day each post counts on and your time zone (from your browser), to show your streak and to check that the posts are yours. We may open those public posts to check them. We do not sign in to your accounts or read anything that is not public.
We collect and use personal information for the following purposes:
We will not use your personal information for purposes other than those identified above, except with your consent or as required or permitted by law.
The Service relies on third-party providers that process your data:
The LarpLocation desktop app also contacts some services directly from your computer; section 2.5 names them.
We do not control these third-party services. Your data is processed by them pursuant to their own privacy policies and terms. We encourage you to review their policies. Larpmaxx is not responsible for the privacy practices of third-party services.
Your personal information may be processed and stored in countries where our service providers operate, which may have different data protection laws than your own. By using the Service, you consent to the transfer of your information. We ensure that our service providers are contractually obligated to protect your information with appropriate safeguards.
We do not sell, rent, or trade your personal information. We may disclose your information: (a) to service providers who assist us in operating the Service, subject to contractual obligations to protect your data; (b) when required by law, regulation, legal process, or governmental request; (c) to protect our rights, your safety, or the safety of others; (d) in connection with a merger, acquisition, or sale of assets (with notice to you); or (e) with your express consent. If you request a cash reward, we share the amount and your payout account with the payout service you chose (PayPal, Wise, Cash App, Venmo, Zelle, your bank through Interac, or the service you asked us to use) to pay you, and we send the text messages that arrange it through our own phone or messaging app.
We use essential cookies for authentication, session management, and security. These cookies are strictly necessary for the Service to function and cannot be disabled. We do not use third-party advertising cookies, or any cookie for behavioral advertising. You may control cookies through your browser settings; disabling essential cookies may prevent the Service from functioning properly.
We also set one first-party cookie (lmx_ft, 90 days) the first time you arrive, recording how you found us: the campaign parameters in the link, the domain that referred you, and the page you landed on. It stores the referring domain only, never the full referring address, and never the query string of the page you landed on. It is not shared with anyone and is not used to show you advertising elsewhere. Today we only set it: nothing stores its contents in our database or uses them, and our servers read it only to check whether it is already there. If we start recording where an account came from, it will be read once, when you create an account, to do that.
When you open someone's referral link, we set one more first-party cookie, larpmaxx_ref (30 days). It holds only the code from that link, so that the person who shared it can be credited if you become a customer. It never fills in a code or changes a price, it is not shared with anyone, and it is not used to show you ads.
If you skip the setup on the demo page, we set a first-party cookie (lmx_build_skipped_v2, one year, sent only to the demo page) so the setup is not shown to you again. It holds an opaque code derived from your account, never your account ID or any other personal detail, and it is not shared with anyone or used for advertising.
While you set up your wallet on the demo page, we set a second first-party cookie (lmx_build_stage, 30 days, sent only to the demo page) that records how far through the setup you are, so the page can show the right first screen before it has finished loading. It holds the same opaque code, the step you are on and whether the page is laid out for a phone or a larger screen, and nothing else. It is not shared with anyone or used for advertising.
If you open the personal offer link we emailed you, we set a first-party cookie (lmx_offer, 30 days) that holds only the offer code from that link, so the discount is waiting for you when you sign in, and a second (lmx_offer_hint, 30 days) that holds no code and only lets our pages say an offer is saved. The code applies only to the account it was made for. When the offer restarts your setup on the demo page, a third cookie (lmx_offer_onb, 30 days) records the same opaque code as the demo cookies above, so the setup restarts once. None of them is shared with anyone or used for advertising.
We also keep two analytics identifiers in your browser's local storage. They are not cookies, and they are sent only to our own servers, with the usage information described in section 2.2. larpmaxx_analytics_session is a random identifier for this browser. It lets us tell a returning visitor from a new one, and it is how activity recorded while signed out becomes linked to an account: whenever this browser records activity while you are signed in, any activity it recorded in the previous two hours that is not already linked to an account, and that came from the same IP address, is linked to yours. That includes activity after you sign out, if you sign in again within two hours. Older activity, and activity from a different IP address, is not linked this way. If you share a browser, this can include pages someone else viewed in it during those two hours. It does not expire on its own. larpmaxx_analytics_visit is a random identifier for your current visit, which is replaced after 30 minutes without activity; it is stored with when the visit started, when it was last active and how many pages it has included. Neither contains your name, email address or account ID, neither is shared with anyone or used to show you advertising elsewhere, and you can remove both at any time by clearing this site's data in your browser.
If your browser sends a Global Privacy Control or Do Not Track signal, we do not record where you click.
We implement reasonable administrative, technical, and organizational measures to protect your information against unauthorized access, alteration, disclosure, or destruction, including encryption in transit (TLS/SSL), secure authentication, access controls, and secure hosting. However, no method of transmission or storage is completely secure. We cannot guarantee absolute security. You use the Service at your own risk.
In the event of a breach of security safeguards involving your personal information that creates a real risk of significant harm, we will notify you and any relevant supervisory authority as required by applicable law, and will describe the nature of the breach, the information involved, and steps you can take to protect yourself.
We retain your personal information only as long as necessary to fulfill the purposes for which it was collected: account data while your account is active and for a reasonable period after deletion for legal, tax, security, and fraud prevention purposes; and billing records as required for accounting and tax compliance (typically up to seven years where required by law). When you request account deletion, we will delete or anonymize your personal information within thirty (30) days, except where longer retention is required by law.
Ninety days for anything that identifies a device. Sign-in session records — including the IP address, browser user agent, device type and approximate location we show you on your account page — are deleted ninety (90) days after that session was last used. Usage and analytics events are kept beyond that so we can understand how the product is used over time, but at the same ninety-day mark we erase the IP address and full browser user agent attached to them, together with any copy of the user agent and any query string in the page address recorded inside the event. Records of which controls you clicked and roughly where are erased at the same ninety-day mark; we keep only the counts (how many clicks, repeated clicks and clicks that did nothing a page view had). What is kept is the approximate location (country, region and city) and the device type, browser and operating system that were derived when the event was recorded. This runs automatically, once a day. Events linked to your account stay linked to it while your account exists. When you delete your account, every one of them is detached from it, and from each we remove the IP address and browser user agent recorded with it, the browser and visit identifiers described in section 7, and the identifier of any Stripe checkout you started; if that cannot be completed, your account is not deleted and you are asked to try again. The rest of each event is kept, including what it records about how the Service was used and the approximate location (country, region and city) and device type, browser and operating system derived when it was recorded; anything else the ninety-day erasure above removes is still removed at the ninety-day mark. Activity your browser recorded that was never linked to your account is not changed by deletion: it keeps the browser identifier it was recorded with, and its IP address and user agent are erased at the ninety-day mark like every other event's.
Referral records are financial records. We keep them for as long as tax law requires us to keep books (in Canada, six years after the end of the tax year they relate to). If you delete your account, we delete the usernames and post links you added for the posting streak, erase your payout details (including the phone number or handle you gave us and the messages you added to cash requests) and coded network data, cancel any cash request that has not been paid, disable your codes, and any unused rewards end. For cash we have already paid you, we keep your legal name, country, payout method, the amount, the date and the transfer reference, because tax law requires them; the payout account itself is erased. The remaining referral records stay linked to your anonymised account, to support those financial records. Each cash request also sends us a notification email, through our email provider (Resend), with your legal name, payout account, phone number or handle and message, so that we can arrange the payment. Deleting your account does not erase that email automatically: we delete it from our own mailbox by hand after your account is deleted, and the email provider keeps its own copy in its logs for its retention period.
Depending on your jurisdiction, you may have the right to:
To exercise these rights, contact us at team@larpmaxx.com. We may need to verify your identity before processing your request. We will respond within thirty (30) days as required by applicable law.
The Service is not intended for individuals under eighteen (18) years of age. We do not knowingly collect personal information from children. If we learn that we have inadvertently collected information from a child without proper parental consent, we will take steps to delete that information promptly. If you believe we have collected information from a child, please contact us immediately.
We may update this Privacy Policy from time to time. When we do, we will post the updated policy on this page and change the "Last updated" date at the top. Changes take effect when they are posted. We are not required to give advance notice or to email you about a change, except where the law requires it; where it does, we will give that notice and ask for your consent if the law requires that. Your continued use of the Service after an update is posted constitutes your acceptance of the updated Privacy Policy.
For privacy-related inquiries, to exercise your rights, or to submit a complaint, please contact us at team@larpmaxx.com.