QuestHat Privacy Policy

Information we collect

• Account and identity: email address, user ID, authentication method, login metadata, and account status.
• Profile and social information: name, username, profile photo, bio, city or region, birthday or age information, optional gender description, friend relationships, blocks, and the visibility choices you make. In-app friend relationships do not give us access to your phone's address book.
• Content and communications: quests, comments, direct messages, join requests, reports, photos, videos, audio, and other content you submit.
• Meetup and location information: city or region, meeting links, exact meetup locations and optional meeting instructions you submit, and event check-in status and time. Meeting instructions use the same visibility control as the exact address. When you grant location permission, precise device location is ordinarily processed and cached on your device to calculate distance and apply location-based safety controls rather than stored in your QuestHat profile. When you check in, your current coordinates are transmitted securely and used transiently to verify that you are within the permitted radius; we store the check-in status and time, not the coordinates submitted for that verification. Exact meetup locations and protected meeting instructions are stored and limited according to the host's selected access controls.
• Optional People discovery: if you enable this feature, we store your selected birthday, optional gender description, and latest submitted coordinates in private discovery settings to calculate rounded distance and apply your filters. Other users receive rounded distance, not those coordinates. Turning discovery off clears its stored coordinates. This is separate from city usage reports and does not authorize location-based analytics.
• Device and usage information: IP address, browser or user-agent, device and operating-system type, app version, timestamps, security events, local preferences, crash or diagnostic information, and privacy-limited product interactions.
• Notifications: push token, notification preferences, delivery information, and Live Activity token or state when you enable those features.
• Support and safety: correspondence, reports, evidence you submit, moderation decisions, and records used to investigate abuse, fraud, or safety incidents.

Optional analytics and diagnostics

If you allow optional analytics, PostHog receives feature-use events, such as screens viewed, discovery loading, quest creation, join requests, sharing outcomes, and host decisions. Events include app/browser and operating-system information, timestamps, sanitized page or screen names, and pseudonymous account, installation or session identifiers. These records can be linked to your account or device; they are not anonymous just because a report shows totals. Our analytics is for improving QuestHat, not targeted advertising, cross-app tracking or selling personal information.

Optional product analytics is off until you choose to enable it. You can turn it off in Settings on each browser or device without losing app features. We exclude message text, quest titles, addresses, search text, precise location and session recordings from the intended analytics payload. Analytics services necessarily receive a network connection; older web analytics records may contain an IP address and provider-derived approximate location. Updated clients request that the provider not derive location from IP. City usage reports described below never use those fields or device GPS.

Sentry separately processes crash, error and performance diagnostics to help us fix reliability problems, even when optional product analytics is off. This can include app version, device/operating-system information, code stack frames, timestamps and limited navigation context. We configure diagnostics to limit identity and content, and session replay is off. Diagnostic processing is not permission to use messages or precise location for product analytics.

Optional selected-city usage reports

Where this setting is available, you may separately choose a city to help us understand where QuestHat is useful. We use the city you enter for reports, not a city inferred from your IP address, GPS, meetup address or messages. City contributions require this separate account-level choice and optional analytics enabled on the device sending the contribution. You do not need to participate to use QuestHat.

QuestHat stores your selected city, account ID, choice time, and daily counters for a fixed set of discovery, creation, join and host-review actions. We do not store event content, quest IDs, precise event times, IP addresses or device coordinates in these counters. These internal records are account-linked, not anonymous, and stay in our database rather than being sent to PostHog. Existing MFA-verified administrators can see only fixed weekly reports: each city and metric needs at least five consenting accounts, and counts are rounded down to groups of five. Reports omit smaller groups and offer no individual drill-down.

City counters are removed after 30 days at the next hourly cleanup, within 31 days. The city choice remains until you change or remove it. Changing the city clears your previous city counters; turning city reports off removes your choice and stored counters. Account deletion also removes them. Turning optional analytics off stops new contributions from that device; the account-level city setting lets you remove contributions across devices.

Social sign-in

If you choose Apple, Facebook, Google, or X to sign in, that provider sends us an account identifier and the profile information you authorize, which may include your name, profile photo, and email address. A provider may not supply an email address. We use this data to authenticate you and create or connect your QuestHat account. We do not receive your provider password. Consumer sign-in does not authorize QuestHat to publish on your behalf.

Optional social publishing

If we offer and you use an optional feature to connect a Facebook Page, Instagram professional account, or X account, we may receive the connected account or Page ID, display name, username, granted permissions, authorization tokens, token-expiration information, and publishing results such as a post or media ID, status, timestamp, and error message. We use this information only to show your available destinations, perform actions you expressly request, maintain or troubleshoot the connection, prevent abuse, and comply with the connected platform's rules.

• Connecting an account is not permission to publish.
• Before publishing, QuestHat must show what will be posted and where. Publishing requires a separate, informed action from you.
• We send the selected text and media to Meta or X only when you request that destination. We do not add hashtags, location data, or other content without showing it to you first.
• We do not use connected-platform data for surveillance, sensitive-trait inference, advertising profiles, or training artificial-intelligence models.
• Content published to an external platform is also governed by that platform's terms and privacy policy and may remain there until you delete it through that platform.

How we use information

• Provide accounts, discovery, maps, meetup coordination, messaging, media, notifications, safety controls, and support.
• Personalize nearby results and settings based on choices you make.
• Authenticate requests, secure accounts, detect bots, spam, fraud, unsafe behavior, and policy violations.
• Moderate content, investigate reports, enforce our Terms, and protect users, QuestHat, and the public.
• Send transactional messages and, only when you opt in, marketing messages.
• Comply with law and the rules of app stores and connected platforms.

Depending on where you live, we rely on performance of our contract, your consent, our legitimate interests in operating and protecting QuestHat, and compliance with legal obligations. You may withdraw consent for optional permissions or marketing at any time; withdrawal does not affect earlier lawful processing.

When we share information

We do not sell personal information. We share it only in these circumstances:

• Other users: according to the feature and privacy settings you select. Private messages and restricted meetup details are shown only to authorized participants. Approved quest participants may see that you checked in and when, but they do not receive the precise coordinates used to verify your arrival.
• At your direction: with Meta or X when you expressly choose to publish or perform another disclosed action.
• Service providers: with vendors that provide authentication, database hosting and storage, email, notifications, maps and geocoding, media delivery, bot protection, product analytics, crash diagnostics, security, and app distribution. They may use data only to provide services to us and must protect it consistently with this policy and applicable platform rules.
• Legal and safety: when reasonably necessary to comply with law, protect rights or safety, investigate abuse, or enforce our agreements.
• Business changes: as part of a merger, financing, acquisition, or sale, subject to appropriate confidentiality and notice where required.

Maps and address search

Address search runs only when you press Search. QuestHat sends the address search text and limited context, such as country, city, and an approximate location when available, to Apple's Maps service. QuestHat does not send the optional meeting-instructions field with an address search. We record your account ID, provider type, and search time to enforce anti-abuse limits, but not the search text in that quota record. Apple search results are used temporarily to help you identify a place. When you confirm a result, QuestHat retains its stable Apple Place ID so the same location can be retrieved later. Apple states that Place IDs are exempt from its Map Data storage restriction. QuestHat does not persist Apple's formatted address or returned coordinates. You may instead expressly choose your device's one-time current-location pin.

City autocomplete in existing profile and listing forms may send the text you type and a selected country to Open-Meteo's geocoding service to suggest city names. The separate city-usage-report field does not call a geocoder. Maps, tiles, social sign-in and links you open also involve the selected service's normal network processing.

Permissions and local data

Camera, microphone, photo-library, location, and notification access are requested only when relevant to a feature. You can deny or revoke them in iOS, Android, or browser settings, although the related feature may stop working. Some preferences and a recent location used for distance estimates may be stored locally on your device. Enabling notifications does not itself share your precise location. A feature that shares live or precise location with another user would require a separate, clear choice before that sharing begins. Cloudflare Turnstile processes technical and interaction signals on protected forms to detect automated abuse.

Retention, disconnection, and deletion

We keep account information and user content while your account is active and as needed to provide the service. We retain limited security, fraud-prevention, moderation, transaction, and legal records only as long as reasonably necessary for those purposes. Backup copies are isolated from ordinary use and removed through our normal backup cycle, unless preservation is legally required.

• You can disconnect a connected provider through that provider's settings. Disconnection stops future access but does not delete content already published there.
• When a social connection or QuestHat account is deleted, we delete or disable the associated authorization credentials and connected-account data unless retention is legally required.
• When X content is deleted, restricted, or changed, we will update or remove any copy we are required to maintain as soon as reasonably possible and within 24 hours after a valid request or notice when X's rules require it.
• You can permanently delete your QuestHat account in Settings → Account. You can also use our public account-deletion page.
• Turning analytics off stops future optional capture; it does not automatically erase older PostHog or Sentry records. Provider records follow their configured retention and deletion processes. Contact support@questhat.com for an access or deletion request so we can address account-linked provider records as well as QuestHat data.

Your choices and rights

• Review or update profile, privacy, notification, location, and marketing choices in Settings.
• Revoke device permission through your device settings and connected-platform permission through the provider.
• Request access, correction, deletion, restriction, objection, or a portable copy where applicable law provides those rights.
• Appeal to your local data-protection authority where applicable.

We may verify your identity before fulfilling a request. We will not discriminate against you for exercising a privacy right.

Security and international processing

We use reasonable administrative, technical, and organizational safeguards, including access controls and encrypted network transport. No system is completely secure. QuestHat and its providers may process data in the United States and other countries, subject to applicable transfer protections.

Children

QuestHat is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided information, contact us so we can investigate and delete it. Additional minimum-age rules may apply where you live.

Third-party policies

Your use of a connected service is also governed by that service's policy: X, Facebook, Instagram, Apple, and Google.

Changes and contact

We may update this policy as QuestHat changes. We will update the date above and provide additional notice when required. For privacy questions or requests, contact Anlvio LLC at support@questhat.com.