1. Scope
This policy explains what we collect, why, legal bases, retention, transfers, and your rights.
2. Data We Collect
Account
Email; social IDs (Google/Apple/Facebook); display name; avatar.
Usage
Quests created/completed, likes, follows, interactions, timestamps.
Device/Diagnostics
App version, OS, device model, IP (truncated/logged), crash logs.
Location (optional)
Approximate or precise (with OS permission) for nearby/geo features.
Media
Images/videos you upload.
3. Sources
Data comes from you; automatically via mobile SDKs; and from social login providers (limited profile data you permit).
4. Purposes & Legal Bases
- Provide and operate the app (contract).
- Security, fraud prevention, anti‑abuse (legitimate interests; legal obligation where applicable).
- Analytics and performance (legitimate interests; consent where required).
- Communications and support (contract/legitimate interests; consent for marketing).
- Geo features (consent via OS permissions).
5. Retention
Account data: until deletion. Support tickets: 24 months. Logs: 12 months. Analytics: up to 26 months. Backups: rolling ~90 days. Minimal data may be retained to comply with law or prevent abuse.
6. Sharing
We use processors for hosting, analytics, crash reporting, email/helpdesk. We do not sell personal data.
7. International Transfers
Data may be processed outside your country. We use safeguards such as Standard Contractual Clauses (SCCs) and industry‑standard security measures.
8. Security
Encryption in transit and (where supported) at rest; access controls; monitoring. No system is 100% secure.
9. Your Rights
GDPR/UK‑GDPR
Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. You may lodge a complaint with a supervisory authority (e.g., ICO or your local authority).
CCPA/CPRA (California)
Right to know/access, delete, correct, opt‑out of sale/share (we do not sell/share for cross‑context behavioral advertising), and limit use of sensitive data (we do not process sensitive data for inferring characteristics).
How to exercise
Email [email protected]; we may ask for verification.
10. Children
We do not knowingly process data of under‑13s. EEA/UK users under 16 require parental consent where permitted.
11. Cookies & Tracking
Mobile SDKs and similar technologies for analytics and crash logs. “Do Not Track” signals may not be recognized consistently across platforms.
12. Communications
You can opt out of marketing emails and push notifications in settings. Transactional/service messages may still be sent.
13. Deletion & Portability
Delete your account in‑app or via [email protected]. We will delete associated personal data except minimal records we must keep by law or to prevent abuse. You can request a machine‑readable export.
14. Changes
We will update this policy as needed and show the new date above. Material changes may be notified in‑app.
15. Contact
Privacy: [email protected]
DPO: [email protected] (not appointed)
Postal (temporary): Pending appointment of our UK service agent, Questly accepts service of notices by email at [email protected]. For a physical mailing/service address, email us and we will provide a UK geographical service address within 2 business days. (Applies from until replaced.)