Privacy Policy

Who is responsible

Questroste is run by an individual developer, not a company. Anything on this page — a question, a request to see your data, a request to delete it — goes to privacy@questroste.com.

What is stored, and why

Only what the app needs in order to work. There is no advertising, no tracking across other apps or sites, and nothing is sold or handed to a data broker.

• Your email address, so you can sign in and so the app can send you the emails about your account: password reset, address confirmation, address change, the notices that your address or password has changed, and the confirmation that your account has been deleted.
• Your nickname, which is how other players see you.
• Your first and last name, which stay private — see the next section.
• Your profile photo, only if you sign in with Google. Questroste never uploads one and has no screen to do it.
• Your language, country and unit preference, so the app and the notifications speak to you in the right one.
• Your password, stored only as a hash that cannot be turned back into the password. If you sign in with Google there is no password at all, only the stable identifier Google gives for your account.
• The routes you create in the editor: their texts, the places of their challenges, and what solves them — the answers and the QR codes, which only you can see.
• The hunts you play: your team and its name, the points, the times, the hints you asked for and the challenges you reported as broken.
• Your location, only if you allow it and only while the app is open: to show the routes near you, and to check that you are at a challenge when you try it. The position sent with each attempt is kept for 7 days, so that a score can be reviewed, and then deleted; the attempt stays without it.
• The camera, only while you scan a QR code. The image never leaves your phone: only the code that was read is sent.
• A device identifier from Firebase Cloud Messaging, so a notice can reach your phone. It is not your phone number and it does not identify you outside Questroste.
• Crash reports, if the app closes unexpectedly. These are sent by Firebase Crashlytics and describe the failure, not you.
• Your IP address, while a request is being served, to stop somebody trying thousands of passwords against your account. It is used for that and not kept as a profile.

Your nickname is public. Your name is not.

This is the one distinction worth reading twice, because the whole app is built around it.

Other players see your nickname and your photo, in the teams you play in. Leaderboards show only team names. Your first and last name are yours: they are used to tell you apart on your own screens, and no other player is ever shown them. They are two different fields, served by two different parts of the server, precisely so that one cannot end up on screen in place of the other.

If you signed in with Google, your name and photo come from your Google account. Your nickname is always yours to change.

On what legal basis

Your account, your profile, your routes and the hunts you take part in are processed because they are what you asked Questroste to do — there is no app without them.

Push notifications are sent only if you allow them, and Android and iOS ask you first. You can withdraw that at any time in your phone settings, and everything else keeps working.

Your location and the camera are used only if you allow them, and Android and iOS ask you first. Without the camera you can type the code printed under the QR; without location, the challenges that need you to be there cannot be tried.

Crash reports, the 7 days of attempt positions and the rate limit on sign-in attempts exist to keep the service running, the rankings fair and other people out of your account.

Who else handles it

Questroste uses four external services, each for one job, and none of them receives your data for its own purposes.

• Hetzner — the server, in Helsinki, Finland. This is where the database lives.
• Resend — the emails the service sends, on its European region.
• Google — push notifications, crash reports and the Google sign-in button if you use it (Firebase); and the map (Google Maps).
• Cloudflare R2 — where the encrypted backups are kept. They are encrypted before they leave the server, so what is stored there cannot be read without a key that never leaves its owner.

Where it is, and for how long

The database is in the European Union and stays there. Google processes push, crash and map data under its own terms and may do so outside the EU.

Your data stays for as long as your account does, except the position of your attempts, which goes after 7 days. When the account goes, the rest goes — see the section below.

Backups are the exception, and it is worth being precise: they are encrypted snapshots taken every night and kept for 7 days. A deleted account can still appear inside a backup until that copy expires. Backups are only ever restored whole, after a disaster, and never opened to look somebody up.

What you can ask for

Write to privacy@questroste.com and you can ask to see a copy of everything Questroste holds about you, correct anything wrong, get it deleted, take it elsewhere in a readable format, or object to a particular use of it. You do not have to explain why.

If you live in the European Union and you think this has been handled badly, you can complain to your national data protection authority.

Deleting your account

You can delete your account and everything personal in it. How to do it, what disappears and what survives is on its own page, linked at the bottom of this one.

Children

Questroste accounts are not aimed at children under 13 and are not knowingly created for them; a child can play in the team of an adult who has one. If you believe a child has an account, write to the address above and it will be removed.

If this page changes

The date at the top says when it last did. A change that affects what is stored or who sees it is announced in the app before it applies, not slipped in quietly.