Privacy Policy

Hei Norway · Last updated 28 October 2026

Who we are

Hei Norway is made by Mapheim, which is responsible for your data in the game. Write to us about anything here at jan@mapheim.com.

What we collect, and why

Your account

Your email address and a password, or the id Apple or Google gives us when you sign in with them, and when you made the account. We keep the password only as a scrambled hash, never the password itself. When you sign in with Apple or Google we get only an id and the email address they confirm: not your name or your picture. We use the address to sign you in and to send you a code to confirm it or to set a new password.

Where you are, while you play

While the map is open, the app sends your position to our server: to show the cards around you, to check that you are near a card when you get it, to count your walks toward a rune, and to check how fast you move, so cards aren't got from a car or by faking a location. We keep only your latest position and when it was, replaced as you move, not a trail of where you have been. With each card you get, we keep where you stood and when, which your collection shows as the place you found it.

Where you are, while the app is shut

Only if you allow it (location "Always"), the phone sends your position now and then while the app is shut: to count your walks toward a rune, and to tell you when a card is near. It is kept the same way as above. You can turn it off at any time in your phone's Settings.

Your steps (iPhone)

Only if you allow Motion & Fitness, the app reads your phone's step count for the time a rune is being carved and sends it to count the walk. We don't keep your step counts, only how far each rune got.

Your game

The cards you have, when and where you got each, and your runes and how far each was carved.

Notifications

If you turn notifications on, a token that lets us send them to your phone. It is removed when you turn them off, log out or delete your account.

On your phone

The app keeps on your phone what it needs to work: your sign-in, the cards and their pictures, your settings, and the last place you were, so the map opens there next time. That place stays on your phone and isn't sent anywhere from there.

The early-access list

If you leave your email address on heinorway.com to hear when the app is out, we keep the address, when you left it and that it came from heinorway.com: nothing else. We use it only to tell you when Hei Norway is out, and send nothing else to it. It is not an account in the game. To be taken off the list, write to us at jan@mapheim.com saying which address, and we will take it off.

Technical

Your device's internet address reaches our server with each request. We use it only to limit how often one address can sign in or join the early-access list, and don't store it; our hosting provider keeps short request logs for running and securing the service.

Why we may use it

• To provide the game you signed up for: your account, the map, your collection and runes.
• Our legitimate interest in fair play and security: the speed check, limits on signing in, logs.
• Your consent, given in your phone's settings: location while the app is shut, Motion & Fitness and notifications. You can withdraw it there at any time.
• Your consent, given when you leave your address on the early-access list. You can withdraw it at any time by asking us to take it off.

Who else sees it

Mapheim's staff, to run the game, fix problems and keep play fair: they can see a player's email, latest position and the cards they got and where, and the addresses on the early-access list. We use these services to run the game, each only for its part:

• Vercel: runs our server, in Stockholm.
• MongoDB Atlas: our database.
• Resend: sends our emails (your address and the link in them).
• Expo: delivers notifications and updates to the app.
• Apple and Google: Sign in with Apple and Google, and the phone's notifications.
• Cloudflare: serves the cards' pictures (it sees your internet address, nothing else of yours).
• Mapbox: draws the map, and finds places when you search, near where the map is. Mapbox's map also sends Mapbox anonymous usage data to improve its maps; on a phone you can stop it with Telemetry in the map's credits. See Mapbox's privacy policy.

Some of them are companies in the United States, where your data may be handled. They are bound to protect it by the EU's Standard Contractual Clauses or the EU-US Data Privacy Framework. We don't sell or share your data with anyone else, and we don't use it for ads.

How long we keep it

• Your account, your latest position, your cards and runes: until you delete your account.
• Codes we email: a day at most.
• An address on the early-access list: until we have told you the app is out, unless you ask us to take it off sooner.
• A sign-in on a phone works for a year, unless you log out.
• Request logs: as long as our hosting provider keeps them, a short time.

Deleting your account

In the app: Profile, then Delete account at the foot of the page. It deletes at once your account, your cards and runes, where you got them, your latest position, your sign-ins and your notification tokens. What is left in backups and logs goes as they expire. If you signed in with Apple or Google, you can also remove Hei Norway in your Apple or Google account's settings.

Your rights

You can ask us for a copy of your data, to correct or delete it, to send it to you in a form you can take elsewhere, or to stop or limit a use of it. Write to jan@mapheim.com and we will answer within a month. You can also complain to the data protection authority where you live.

Children

Hei Norway is for people 16 and older. If you think someone younger has an account, write to us and we will delete it.

Changes

If we change this policy, the date at the top changes, and if a change matters to you, we will say so in the app or by email first.

See also the Terms of Use.