Privacy Policy

1. Who is responsible for your data (Controller)

Dennis Maximilian Thelen
Argelanderstraße 7, 53115 Bonn, Germany
Email: [email protected]

2. What data we collect

SideQuest is designed to collect as little as it needs to work:

• Account data: the email address and password you sign up with (your password is never stored in plain text — it's hashed by our authentication provider, Supabase).
• Profile data: your chosen username and avatar. An avatar can be an emoji (no upload involved) or, if you choose to set one, a photo you take or pick from your library.
• Quest data: the quests you create, send, accept, or complete, including difficulty, category, and timestamps.
• Proof photos: when you complete a quest, you may submit a photo as proof. This is uploaded to our storage provider and is only shown to the people your quest involves (e.g. the friend who sent it, for verification).
• Social/crew data: your friends list and any quests exchanged with them.
• Device-local data: your streak shield status and notification preferences, stored on your device. The one daily reminder notification is scheduled entirely on your device — no push token or device identifier is ever sent to our servers or any third party.
• App update checks: the app periodically asks Expo's update service whether a newer version of SideQuest is available. That request includes basic app/runtime information (like the app version and platform) needed to answer it — no account or quest data is included.

We do not use advertising SDKs, third-party analytics/tracking libraries, or sell any data to third parties.

3. Why we process this data (legal basis)

• Art. 6(1)(b) GDPR — performance of a contract: account creation, authentication, and the core quest/friend features you use the app for.
• Art. 6(1)(a) GDPR — consent: submitting a proof photo, which you choose to do for a specific quest.
• Art. 6(1)(f) GDPR — legitimate interest: basic technical logging needed to keep the service secure and working (e.g. rate-limiting abuse).

4. Who processes data on our behalf (subprocessors)

• Supabase, Inc. — authentication, database, and file storage (proof photos, avatars). Supabase provides a Data Processing Agreement and EU Standard Contractual Clauses for any processing outside the EEA.
• Resend — delivery of transactional account emails only (email confirmation, password reset codes). Resend never sees your password.
• Expo (650 Industries, Inc.) — checks for and delivers app updates. Receives only basic app/runtime information (see "App update checks" above), never your account or quest data.

We do not use any other third-party processors at this time.

5. How long we keep your data

Your account data and quest history are kept for as long as your account exists. Quest proof photos are retained only as long as needed for the quest they belong to, per our storage provider's retention rules, and are removed sooner if you delete the quest or your account.

6. Deleting your account

You can permanently delete your account at any time from Profile → Settings → Delete Account in the app, or by emailing [email protected]. This is a genuine deletion, not deactivation, and happens immediately:

• Deleted outright: your email, username, avatar, any proof photo you ever submitted (including on a quest a friend later sent back for another attempt), and the title/description of any quest you wrote.
• Kept, but no longer tied to you: the bare fact that a quest existed between you and a friend — its difficulty, XP value, category and dates — attributed to "Deleted user" instead of your account. We keep this narrow slice because a friend's own level, badges and quest history are calculated from it; removing it would silently shrink their earned progress for something they did, not something you're owed control over erasing.

7. Your rights under GDPR

As a data subject in the EU, you have the right to:

• Access the personal data we hold about you (Art. 15)
• Correct inaccurate data (Art. 16)
• Request erasure — see "Deleting your account" above (Art. 17)
• Restrict or object to certain processing (Art. 18, 21)
• Receive your data in a portable format (Art. 20)
• Lodge a complaint with a supervisory authority — for Germany/NRW, this is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)

To exercise any of these rights, email [email protected].

8. Children

SideQuest is not directed at children under 16. If you are under 16, please only use the app with the consent of a parent or legal guardian.

9. Changes to this policy

If this policy changes materially, we'll update the effective date above and, where required, notify you in the app.