Ninmuya · Privacy policy
Who we are
FakeGenius Limited ("Ninmuya", "we") runs Ninmuya from Hong Kong and is responsible for your personal data under the Personal Data (Privacy) Ordinance.
This policy is also our personal information collection statement. It explains what we collect, why, who we share it with, and your rights.
What we collect
- Account: email address, display name, and, if you add them, your profile photo and phone number. If you sign in with Google, Google gives us your name, email address and profile photo. If you sign in with Apple, Apple gives us your email address (or, if you choose to hide it, a stand-in address Apple creates for you) and the name you choose to share. We check a phone number by a text message, which Google sends for us. If you sign up with an email address, your password is kept by Google's sign-in service in a form we cannot read.
- Quests and applications: titles, descriptions, rewards, time limits and the location you pin.
- Evidence: the photos hunters send, with the location and time they were sent. We remove the hidden location data that phone cameras store in photos; the place and time a photo was sent as evidence are recorded separately.
- Messages, photos and PDF documents you send in quest chats, and any reports or blocks you make.
- Payments: amounts, status, and your Stripe account reference and payout status, including anything you pay to notify hunters about a quest. Card and bank details go straight to Stripe; we never see full card or account numbers.
- Your hunter tier, from 0 to 5, which we work out from the full rewards of the quests you've been paid for in the last 30 days, and whether you have chosen to hide it from others.
- Ratings: the stars and comments you give and receive after a quest, and when they were given.
- Location, only while you use the app and never when you are not using it: to show quests near you on the map, to set the place of a quest you post when you tap "Use my location", and to attach where you are to the evidence you send. Your position on the home map is only used to draw the map; we don't store it. If you turn on Quest alerts and choose to use your location, we also keep the rough area you were last in (to about 1 km), so we can send you alerts about quests nearby. Turning that off deletes it.
- A record of when you agreed to these terms, which version, and in which language. If you are a hunter, also when you confirmed that you may lawfully do paid work in Hong Kong, and which version of that statement you confirmed.
- Device and usage data: your language and notification settings, the token your phone gives us so we can send it notifications, and performance data, to keep the app working. Performance data means how quickly the app starts and reaches our servers and how much of the phone's resources it uses, together with your phone's model, system version, app version, network type and carrier, an identifier for this installation of the app, and your IP address, which shows roughly which country or region you are in.
- Quest alerts: whether you have them on, whether you want them on your phone, when you chose, and how many promoted quests we have sent you today.
We don't ask for your Hong Kong Identity Card. Where a hunter's identity needs checking for payouts, Stripe does it.
Why we use it
- To run your account and the quests you post or do.
- To take payments, pay hunters and make refunds.
- To keep people safe: handling reports and blocks, preventing fraud and enforcing our rules.
- To show ratings, so people can decide who to work with.
- To look into and settle disputes.
- To meet our legal duties, such as keeping tax records and answering lawful requests.
- To send you messages about your account and your quests, in the app and to your phone.
- If you turn on Quest alerts: to send you quests whose givers have paid us to promote them (see Direct marketing).
- To fix and improve the app.
We don't sell your data, and we don't show you other companies' advertising. The only promotion we send is Quest alerts, and only if you turn them on.
What you have to give us
An email address is needed to have an account. Givers need a card to hire a hunter, and hunters need to confirm that they may lawfully work in Hong Kong and finish Stripe's payout setup to apply for quests. Evidence needs a photo and your location. Everything else is up to you, though some features won't work without it, such as nearby quests without location.
Who we share it with
- Other users: your display name, profile photo, when you joined, the quests you post (including the location you pin) and the ones you've completed, the messages, photos and documents you send them, a "phone checked" badge, whether you've set up payouts, and your hunter tier, which shows roughly what you were paid in the last 30 days (Tier 2 from HK$2,000, 3 from HK$10,000, 4 from HK$50,000, 5 over HK$100,000), unless you hide it with the switch in the Me tab. Only the giver of a quest sees the evidence and location a hunter sends for it. We don't show other users your email address or phone number.
- Other users also see the ratings you have received: your average as a hunter and as a giver, and each rating with its stars, any comment and the date, the name of the person who wrote it, whether they were the giver or the hunter, and the quest's title. Givers see your average as a hunter when you apply for their quests, and your quests show your average as a giver. Ratings you write appear in the same way, with your display name at the time, on the other person's profile.
- Stripe, to process payments and payouts and to check hunters' identity. Stripe uses this data under its own privacy policy. When you set up payouts we give Stripe the email address and display name on your account. With each payment we give Stripe the quest's title, and reference numbers for the quest and for the two accounts.
- Google, which hosts our database, sign-in, file storage, phone notifications and performance monitoring (Firebase) on our behalf, and sends the text message that checks a phone number, after an automatic check that a person and not a program is asking (on the website, Google's reCAPTCHA). The map is Google Maps, which receives your IP address, details of your phone and how you move the map, under Google's own terms and privacy policy. The app's display fonts come from Google Fonts: your phone or browser fetches them from Google the first time they are needed. Notifications to an iPhone also pass through Apple.
- Our professional advisers, where needed.
- The police, regulators or a court, when the law requires it, or when someone's safety is at risk.
- Anyone who takes over Ninmuya's business, who must look after your data in the same way. We will tell you first.
Data outside Hong Kong
Our providers store and process data outside Hong Kong, including in the United States. Our database is in Google's Hong Kong region; most of our server code runs in the United States. Google (Firebase) handles data for us under its data processing terms; Stripe and Google Maps also use data under their own privacy policies.
Direct marketing
Quest alerts are the only marketing we send, and they are off unless you turn them on in the Me tab. If you do, we use your alert settings, the language you use, whether you have set up payouts, how many alerts we have sent you today, your phone's notification token and, if you allow it, your rough location to send you quests posted on Ninmuya whose givers have paid us to promote them. Each one says so. They come to your Updates in the app and as notifications on your phone, unless you keep them off your phone; then we don't use its notification token for them. We don't pass your data to the giver or to anyone else for this: the giver is shown only a rough number of hunters, never who they are or where. You can keep them off your phone, or stop them altogether, at any time, free, with the switches in the Me tab; you can also stop them by emailing us. Everything else we send is about your own account and quests.
How long we keep it
We keep your data while your account is open. When you delete your account we delete your profile, your photos (except evidence for paid quests, which is deleted as described below), the photos and documents you sent in chats, your login and your Stripe payout account. Messages you sent stay visible to the people you sent them to, shown as from "Deleted user", and paid quests are kept under "Deleted user" too. Ratings about you are deleted. Ratings you wrote stay on the other person's profile without your name. Records of withdrawals, and reports made by or about you, are kept for the periods below. Stripe keeps its own records under its privacy policy.
We keep the payment record of a paid quest (amounts, dates, Stripe references and the two accounts) for seven years after payment, as Hong Kong tax law requires, then delete it. Records of payments to notify hunters, and of withdrawals, are kept and deleted in the same way. Evidence photos, with their place and time, are deleted six months after the reward is released or refunded, unless a report, dispute or claim is open. Reports are deleted two years after they are closed.
Your rights
You can ask to see the personal data we hold about you, and ask us to correct it. Write or email to our Privacy Officer, below. You can use the Privacy Commissioner's data access request form (OPS003) if you wish.
We will give you a copy, or tell you in writing why we can't, within 40 days, and answer a request to correct your data within the same time. Any fee will not be excessive, covers only our direct costs, and we will tell you it first. Correction is free. We may ask you to confirm who you are.
If you are unhappy with how we handle your personal data, you can complain to the Privacy Commissioner for Personal Data.
Deleting your account: you can delete your account in the app (Me → Edit profile → Account → Delete account) or by emailing us at info@fakegeniushk.com; ninmuya.com/delete-account explains both. If a reward is still held, or money in your Stripe account is still clearing, that has to finish first, and the app tells you so.
Changing your mind: you can stop Ninmuya using your location, camera, photos or notifications at any time in your phone's settings (or your browser's, if you use the website). Without your location the map can't show where you are and you can't send evidence; the rest of the app still works. You can turn Quest alerts off in the Me tab at any time, or stop them using your rough location; the area we saved is then deleted. You can also keep them off your phone and see them only in the app. You can change your name, phone number and profile photo under Me → Edit profile; to have a phone number, a photo or any other detail you chose to give us removed altogether, email us.
Security
Data is encrypted in transit and stored with Google. No system is perfectly secure, so tell us straight away if you think your account has been misused. If a data breach puts you at real risk of harm, we will tell you and the Privacy Commissioner as soon as we can.
Cookies and browser storage
The web version of Ninmuya uses browser storage to keep you signed in and remember your settings. We don't use advertising cookies.
Children
Ninmuya is for people aged 18 and over. If we learn that someone under 18 has an account, we will close it.
Changes
If we make an important change to this policy, we will tell you by email or in the app before it takes effect. If a change would let us use data we already hold for a new purpose, we will ask for your consent first.
Earlier versions of this policy are kept on our website: the previous one (version 2026-10-01, last updated 5 October 2026) is at ninmuya.com/privacy-2026-10-01.
Privacy Officer
Privacy Officer, FakeGenius Limited, Flat K, 2/F, Wing Lok Mansion, 22A Tseuk Luk Street, San Po Kong, Kowloon, Hong Kong. Email: info@fakegeniushk.com.
This policy is in English and Chinese. If the two differ, the English version applies.