QuestHat Privacy Policy

Information we collect

• Account and identity: email address, user ID, authentication method, login metadata, and account status.
• Profile and social information: name, username, profile photo, bio, city or region, friend relationships, blocks, and the visibility choices you make.
• Content and communications: quests, comments, direct messages, join requests, reports, photos, videos, audio, and other content you submit.
• Meetup and location information: city or region, meeting links, exact meetup locations and optional meeting instructions you submit, and event check-in status and time. Meeting instructions use the same visibility control as the exact address. When you grant location permission, precise device location is ordinarily processed and cached on your device to calculate distance and apply location-based safety controls rather than stored in your QuestHat profile. When you check in, your current coordinates are transmitted securely and used transiently to verify that you are within the permitted radius; we store the check-in status and time, not the coordinates submitted for that verification. Exact meetup locations and protected meeting instructions are stored and limited according to the host's selected access controls.
• Device and usage information: IP address, browser or user-agent, device and operating-system type, app version, timestamps, security events, local preferences, crash or diagnostic information, and interactions needed to operate and protect the service.
• Notifications: push token, notification preferences, delivery information, and Live Activity token or state when you enable those features.
• Support and safety: correspondence, reports, evidence you submit, moderation decisions, and records used to investigate abuse, fraud, or safety incidents.

Social sign-in

If you choose Apple, Facebook, Google, or X to sign in, that provider sends us an account identifier and the profile information you authorize, which may include your name, profile photo, and email address. A provider may not supply an email address. We use this data to authenticate you and create or connect your QuestHat account. We do not receive your provider password. Consumer sign-in does not authorize QuestHat to publish on your behalf.

Optional social publishing

If we offer and you use an optional feature to connect a Facebook Page, Instagram professional account, or X account, we may receive the connected account or Page ID, display name, username, granted permissions, authorization tokens, token-expiration information, and publishing results such as a post or media ID, status, timestamp, and error message. We use this information only to show your available destinations, perform actions you expressly request, maintain or troubleshoot the connection, prevent abuse, and comply with the connected platform's rules.

• Connecting an account is not permission to publish.
• Before publishing, QuestHat must show what will be posted and where. Publishing requires a separate, informed action from you.
• We send the selected text and media to Meta or X only when you request that destination. We do not add hashtags, location data, or other content without showing it to you first.
• We do not use connected-platform data for surveillance, sensitive-trait inference, advertising profiles, or training artificial-intelligence models.
• Content published to an external platform is also governed by that platform's terms and privacy policy and may remain there until you delete it through that platform.

How we use information

• Provide accounts, discovery, maps, meetup coordination, messaging, media, notifications, safety controls, and support.
• Personalize nearby results and settings based on choices you make.
• Authenticate requests, secure accounts, detect bots, spam, fraud, unsafe behavior, and policy violations.
• Moderate content, investigate reports, enforce our Terms, and protect users, QuestHat, and the public.
• Send transactional messages and, only when you opt in, marketing messages.
• Comply with law and the rules of app stores and connected platforms.

Depending on where you live, we rely on performance of our contract, your consent, our legitimate interests in operating and protecting QuestHat, and compliance with legal obligations. You may withdraw consent for optional permissions or marketing at any time; withdrawal does not affect earlier lawful processing.

When we share information

We do not sell personal information. We share it only in these circumstances:

• Other users: according to the feature and privacy settings you select. Private messages and restricted meetup details are shown only to authorized participants. Approved quest participants may see that you checked in and when, but they do not receive the precise coordinates used to verify your arrival.
• At your direction: with Meta or X when you expressly choose to publish or perform another disclosed action.
• Service providers: with vendors that provide authentication, database hosting and storage, email, notifications, maps and geocoding, media delivery, bot protection, security, and app distribution. They may use data only to provide services to us and must protect it consistently with this policy and applicable platform rules.
• Legal and safety: when reasonably necessary to comply with law, protect rights or safety, investigate abuse, or enforce our agreements.
• Business changes: as part of a merger, financing, acquisition, or sale, subject to appropriate confidentiality and notice where required.

Maps and address search

Address search runs only when you press Search. QuestHat sends the address search text and limited context, such as country, city, and an approximate location when available, to Apple's Maps service. QuestHat does not send the optional meeting-instructions field with an address search. We record your account ID, provider type, and search time to enforce anti-abuse limits, but not the search text in that quota record. Apple search results are used temporarily to help you identify a place. When you confirm a result, QuestHat retains its stable Apple Place ID so the same location can be retrieved later. Apple states that Place IDs are exempt from its Map Data storage restriction. QuestHat does not persist Apple's formatted address or returned coordinates. You may instead expressly choose your device's one-time current-location pin.

Permissions and local data

Camera, microphone, photo-library, location, and notification access are requested only when relevant to a feature. You can deny or revoke them in iOS, Android, or browser settings, although the related feature may stop working. Some preferences and a recent location used for distance estimates may be stored locally on your device. Enabling notifications does not itself share your precise location. A feature that shares live or precise location with another user would require a separate, clear choice before that sharing begins. Cloudflare Turnstile processes technical and interaction signals on protected forms to detect automated abuse.

Retention, disconnection, and deletion

We keep account information and user content while your account is active and as needed to provide the service. We retain limited security, fraud-prevention, moderation, transaction, and legal records only as long as reasonably necessary for those purposes. Backup copies are isolated from ordinary use and removed through our normal backup cycle, unless preservation is legally required.

• You can disconnect a connected provider through that provider's settings. Disconnection stops future access but does not delete content already published there.
• When a social connection or QuestHat account is deleted, we delete or disable the associated authorization credentials and connected-account data unless retention is legally required.
• When X content is deleted, restricted, or changed, we will update or remove any copy we are required to maintain as soon as reasonably possible and within 24 hours after a valid request or notice when X's rules require it.
• You can permanently delete your QuestHat account in Settings → Account. You can also use our public account-deletion page.

Your choices and rights

• Review or update profile, privacy, notification, location, and marketing choices in Settings.
• Revoke device permission through your device settings and connected-platform permission through the provider.
• Request access, correction, deletion, restriction, objection, or a portable copy where applicable law provides those rights.
• Appeal to your local data-protection authority where applicable.

We may verify your identity before fulfilling a request. We will not discriminate against you for exercising a privacy right.

Security and international processing

We use reasonable administrative, technical, and organizational safeguards, including access controls and encrypted network transport. No system is completely secure. QuestHat and its providers may process data in the United States and other countries, subject to applicable transfer protections.

Children

QuestHat is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided information, contact us so we can investigate and delete it. Additional minimum-age rules may apply where you live.

Third-party policies

Your use of a connected service is also governed by that service's policy: X, Facebook, Instagram, Apple, and Google.

Changes and contact

We may update this policy as QuestHat changes. We will update the date above and provide additional notice when required. For privacy questions or requests, contact Anlvio LLC at support@questhat.com.