The scavenger hunt IT actually approved

Mo from PlayTours

The scavenger hunt IT actually approved
Taduuda taduuda. CC0. Wikimedia Commons.

HR wants a hunt. IT wants no new apps on the fleet. Legal wants a sentence they can paste into the ticket.

I have sat on those calls. The hunt is the easy part. The install is what usually stops it.

PlayTours is a web app. Players click a link or scan a QR. There is nothing to push via MDM. If your phones cannot sideload, they do not need to.

Copy what you need into the ticket. For the longer product argument, see why web-based beats native.

Put this in the first 80 words of your ticket

PlayTours is a browser-based scavenger hunt. No App Store or Play Store download. Free tier: 25 concurrent devices, all features, PlayTours watermark, commercial use allowed. Paid tiers remove the watermark and raise the concurrent device cap. Features do not change between tiers. ISO 27001 certified, externally audited. Data hosted on Google Cloud in Japan, which the European Commission treats as adequate under the EU-Japan adequacy decision.

If the ticket needs URLs: security, privacy, join links on pyts.link.

What “no download” means on the day

Staff open Safari or Chrome. Instant Join QR is pyts.link/qr/.... If you need the PlayTours name off the URL, that is why pyts.link exists.

Locked-down iPhones still have a browser.

If someone is comparing you with a store-listed app, you may lose on brand familiarity and win on MDM. That is a fair trade for a lot of fleets.

Concurrent devices is the only paid axis

Same builder, same AI photo judging, same facilitator dashboard, same live leaderboard. You pay for how many phones can be in a game at once.

A device is one phone or tablet actively playing. Sharing a phone is one device. Cap is account-wide.

Hit the cap and new joins wait. We do not kick active players.

Billing is monthly. Cancel after the offsite. No prorate. Subscribe here: admin.playtours.app/subscription.

Sizing guide: 800 guests, 120 phones.

What we collect, and what to skip in tasks

Teams type a name and play. You can download results from the session screen. Skip tasks that ask for passport numbers. Skip required photos of badges with readable employee IDs if that would break your DLP policy.

The facilitator dashboard can show live team location if you turn that on. If your works council prefers no live GPS, leave it off. The hunt still runs.

ISO 27001 is about how we run the company. It is not a GDPR waiver. You still need a lawful basis for your event. We are the processor for the game data you create. Lawyers can have the DPA conversation from the security and privacy pages.

EU buyers

Adequacy here means Japan is on the Commission’s adequacy list, and that is where this stack lives. It does not mean we store in Frankfurt. If that is a deal-breaker, it is better to know early.

Browser translation and defaultLanguage exist if you run DE/FR/NL sessions. Multi-language guide.

Network and content filters

If corporate Wi-Fi blocks games, whitelist playtours.app, pyts.link, and our Firebase/Google hosts, or ask people to use cell data.

Photo upload needs a connection. Patchy reception is the field version.

Accessibility and BYOD

BYOD is the normal case. Guest devices join the same QR. You do not image them.

If a player needs larger text, that is the phone OS. We are a browser page. Pair people on a team if a task would otherwise be a tiny QR on a shiny floor.

A one-page IT checklist

  • No store install
  • Join via HTTPS link or QR
  • Optional watermark on free
  • Concurrent cap chosen for peak phones, not headcount
  • Live GPS off unless you have a reason
  • Results download after, stored in your own drive
  • Security and privacy URLs attached
  • Named owner at HR who will stop the session from the facilitator dashboard if the timer needs to end (timers do not pause)

Answers from the same call

Camera and location permissions. The browser will ask if a task needs them. Location tasks and live team GPS need location. Photo tasks need the camera. You can design a hunt with neither: QR, typed access codes, multiple-choice, no-answer. If the managed browser blocks camera, those tasks become no-answer. Test one fleet phone.

Cookies / third parties. The player is a web app on our hosting. Security and privacy pages are the source for subprocessors. Legal can ask for the DPA.

SSO. Not the join path for a picnic. Staff tap a link. If you need SSO for builders, that is an admin conversation.

Retention. Download what you need after the event. Put it on your drive. Give someone ownership of any judged-text debrief sitting in a session.

If the checklist is not enough, book a call: TidyCal. Bring IT. Japan hosting is usually the question. The answer is in the ticket paragraph above.

Email us at hello@playtours.app