Privacy Policy

Information you give us

• Email address. to create and sign you into your account.
• Display name. shown to other players on leaderboards and marketplace listings.
• Password. if you sign up with email. Stored by Firebase Authentication, never by us in readable form.
• Google account identifier. only if you choose “Sign in with Google”.
• Profile picture. optional.
• Feedback and bug reports. only when you send one.

Information created by playing

Your hunts and their progress, scores and XP, QuestCoins balance and transactions, daily streaks, collectibles you earn or trade, marketplace listings and purchases, hunts you create, and promo codes you redeem.

Conversations with your AI sidekick are stored. The sidekick remembers what you have discussed on a spot so the conversation makes sense from one message to the next, and keeps a short summary of your play style between hunts. You can delete these by deleting your account.

Collected automatically

• Crash reports (Firebase Crashlytics). What went wrong, where in the code, and basic device information such as model and OS version.
• Usage analytics (Firebase Analytics). Which screens and features are used, so we know what to improve.
• Device integrity signals (Firebase App Check). Confirms requests come from a genuine copy of the app, not a script. This checks the app, not you.

QuestSpot is a game about physically going places, so it needs your location. It uses it in a deliberately narrow way.

When you check in at a hunt spot, the app sends your current coordinates to our server. The server measures how far you are from that spot, decides whether you are close enough, and then discards your coordinates. What is kept is whether the check succeeded and when.

• We do not keep a history of where you have been. Your coordinates are never written to any record.
• We never access your location in the background. The app requests “while using the app” permission only. When QuestSpot is closed, it cannot see where you are.
• The app also converts a place name you type into map coordinates when you choose where to hunt. That lookup is handled by Google.

You can refuse or revoke location permission in your device settings. The app still works; you will not be able to complete the in-person check-in that some hunts use.

• We do not sell or rent your personal information to anyone.
• We do not show advertising, and there are no advertising SDKs in the app.
• We do not track you across other apps or websites.
• We do not collect your contacts, your photos beyond ones you choose to upload, your microphone input, or your browsing activity.
• The app declares microphone access because the audio framework that plays the sea shanties you earn requires it. QuestSpot does not record audio.

The following are public to other signed-in players:

• Your display name, profile picture, country and total points, on the global leaderboard.
• Your display name as the seller on any marketplace listing you create.
• Your display name to other players in a shared or custom hunt you join.

You can remove yourself from the leaderboard under Settings → Privacy → Show me on leaderboards. Your row is deleted when you opt out and restored if you opt back in. Your display name still appears on marketplace listings and in shared hunts, because those are interactions with specific other players.

Other players cannot see your email address, your location, your sidekick conversations, or your balances.

QuestSpot runs on Google Cloud, and Google processes data on our behalf:

• Firebase Authentication. your sign-in credentials.
• Cloud Firestore. your profile, hunts, collectibles and balances.
• Cloud Storage. collectible artwork, profile pictures, hunt cover images.
• Cloud Functions and Cloud Run. all server logic.
• Google Vertex AI (Gemini). generates hunt clues, powers the AI sidekick, and moderates profile pictures and player-written hunt content.
• Google Places API. finds the real-world locations your hunts are built from.
• Google Cloud Translation. translates the app interface.
• Firebase Crashlytics and Analytics. crash reports and usage statistics.

If you sign in with Google, Google also acts as your identity provider. If you downloaded the app from Apple’s App Store or Google Play, that store has its own relationship with you governed by its own privacy policy.

Content you write may be sent to Google’s AI models for moderation.A custom sidekick personality, a hunt you create, or an image you upload. This is how we keep the game family-friendly.

We use no other third parties. No analytics brokers, no advertising networks, no data enrichment services.

We keep your information while your account exists. When you delete your account it is removed as described below. Crash reports and analytics are retained according to Firebase’s own retention periods and are not tied to your account once it is gone.

You can delete your account from inside the app: Settings → Account → Delete account. This is permanent and immediate.

Deleting removes your sign-in credentials, your profile, your hunts and their progress, your collectibles, your marketplace listings, your sidekick conversations and its memory of you, any custom hunts you created, and your leaderboard row.

One exception: if you are holding QuestCoins that other players have staked on a custom hunt you are hosting, deletion is refused until that hunt is closed and the prize settled. This protects other players’ currency, not ours. Close or settle the hunt and deletion will proceed.

If you would rather ask us to do it, email support@questspot.co from the address on your account.

Depending on where you live, you may have the right to access a copy of your data, correct it, delete it, or object to how it is used. Deletion is available in the app immediately. For anything else, email support@questspot.co and we will respond within 30 days.

QuestSpot is not intended for children under 13. During profile setup the app does not allow an age below 13 to be selected. We do not knowingly collect information from children under 13. If you believe a child under 13 has an account, email support@questspot.co and we will delete it.

QuestSpot’s currency, scores and collectibles can only be changed by our servers. The app itself cannot write them, and database rules enforce that. Requests are verified with Firebase App Check so that only genuine copies of the app can reach our servers. Sensitive records, including the answers to hunts you have not solved yet, are readable only by our servers and never sent to your device.

No system is perfectly secure, and we cannot guarantee absolute security.

If this policy changes materially, we will update the date at the top and notify you in the app before the change takes effect.

support@questspot.co