Privacy Policy
Last updated: May 2026
This policy explains how Haunts collects, uses, and protects your personal data. Haunts is intended for users aged 18 and over. By using Haunts you confirm you are at least 18 years old.
1. Who we are
Haunts is a product of KARNWORKS LTD trading as The Margate App Company, a company registered in England and Wales (company number 17165615). We are in the process of registering with the Information Commissioner’s Office (ICO).
References to “we”, “us”, or “our” in this policy mean KARNWORKS LTD trading as The Margate App Company.
Contact us about privacy:
Email: support@haunts.app
2. What data we collect and why
2.1 When you browse without an account (web only)
| Data | Purpose | Legal basis |
|---|---|---|
| Anonymised usage data (pages visited, clicks, session duration) collected via PostHog | Understand how the site is used and improve it | Legitimate interests (Art. 6(1)(f) UK GDPR) |
| IP address (processed by PostHog and Vercel, not stored by us directly) | Security, fraud prevention, approximate location for local content | Legitimate interests |
2.2 When you create an account
To access the full Haunts app you must create an account. We collect:
| Data | Purpose | Legal basis |
|---|---|---|
| Email address | Account creation, login, service communications | Contract performance (Art. 6(1)(b)) |
| Password (hashed — we never see it in plain text) | Authentication | Contract performance |
| Display name (if provided) | Personalise your experience | Contract performance |
| Saved places, preferences, and in-app activity | Deliver the core service | Contract performance |
| Device type and app version | Debugging and compatibility | Legitimate interests |
2.3 Business owners and curators
If you have a business owner or curator account, we additionally collect:
| Data | Purpose | Legal basis |
|---|---|---|
| Business name, address, and contact details | Display your listing on Haunts | Contract performance |
| Name and email of the account holder | Account management and communications | Contract performance |
| Listing edits and publishing history | Audit trail and quality control | Legitimate interests |
3. Cookies and tracking
We use PostHog for product analytics. PostHog may set cookies on your device when you visit the site via a web browser. On your first visit, a cookie consent notice will be shown and you can withdraw or update your preferences at any time via the cookie settings link in the footer. On the native app, PECR cookie rules do not apply; your data choices are governed by UK GDPR as described in this policy.
You can also control cookies through your browser settings. Disabling analytics cookies will not affect your ability to use Haunts.
We do not use advertising cookies or sell data to advertisers.
4. How we share your data
We do not sell your personal data. We share it only with the following data processors who act on our instructions:
| Processor | Purpose | Location |
|---|---|---|
| Supabase | Hosting our database and authentication | EU (Ireland) |
| Vercel | Hosting the web application | EU / USA (Standard Contractual Clauses apply) |
| PostHog | Product analytics | EU (PostHog Cloud EU) |
We may also disclose data if required to do so by law or to protect our legal rights.
5. How long we keep your data
| Data | Retention period |
|---|---|
| Account data | For as long as your account is active, plus 12 months after deletion |
| Analytics data | 12 months rolling (PostHog) |
| Business listing data | For as long as the listing is active, plus 12 months |
| Server logs | Up to 30 days |
When the retention period expires, data is permanently deleted or anonymised.
6. Your rights under UK GDPR
You have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Eraseyour data (“right to be forgotten”)
- Restrict how we process your data
- Object to processing based on legitimate interests
- Portability — receive a copy of your data in a machine-readable format
To exercise any of these rights, email support@haunts.app. We will respond within one calendar month.
You also have the right to lodge a complaint with the ICO at ico.org.uk or by calling 0303 123 1113.
7. Data security
We use industry-standard measures to protect your data, including:
- Encrypted connections (HTTPS/TLS) for all data in transit
- Hashed and salted passwords — we never store them in plain text
- Access controls limiting which team members can access personal data
- Regular security reviews of our infrastructure
No method of transmission over the internet is 100% secure. If you become aware of a security issue, please contact support@haunts.app immediately.
8. Changes to this policy
We may update this policy from time to time. If we make material changes we will notify registered users by email or via an in-app notice. The “Last updated” date at the top of this page will always reflect the most recent version.
The updated policy will take effect from the date shown at the top of this page.
9. Contact
For any privacy-related questions or requests:
Email: support@haunts.app