Privacy Policy

1. Who is responsible for your data (Controller)

Dennis Maximilian Thelen
Argelanderstraße 7, 53115 Bonn, Germany
Email: [email protected]

2. What data we collect

SideQuest is designed to collect as little as it needs to work:

• Account data: the email address and password you sign up with (your password is never stored in plain text — it's hashed by our authentication provider, Supabase).
• Profile data: your chosen username and avatar (an emoji you pick — no photo upload is required for a profile picture).
• Quest data: the quests you create, send, accept, or complete, including difficulty, category, and timestamps.
• Proof photos: when you complete a quest, you may submit a photo as proof. This is uploaded to our storage provider and is only shown to the people your quest involves (e.g. the friend who sent it, for verification).
• Social/crew data: your friends list and any quests exchanged with them.
• Device-local data: your streak shield status and notification preferences, stored on your device. The one daily reminder notification is scheduled entirely on your device — no push token or device identifier is ever sent to our servers or any third party.

We do not use advertising SDKs, third-party analytics/tracking libraries, or sell any data to third parties.

3. Why we process this data (legal basis)

• Art. 6(1)(b) GDPR — performance of a contract: account creation, authentication, and the core quest/friend features you use the app for.
• Art. 6(1)(a) GDPR — consent: submitting a proof photo, which you choose to do for a specific quest.
• Art. 6(1)(f) GDPR — legitimate interest: basic technical logging needed to keep the service secure and working (e.g. rate-limiting abuse).

4. Who processes data on our behalf (subprocessors)

• Supabase, Inc. — authentication, database, and file storage (proof photos, avatars). Supabase provides a Data Processing Agreement and EU Standard Contractual Clauses for any processing outside the EEA.
• Resend — delivery of transactional account emails only (email confirmation, password reset codes). Resend never sees your password.

We do not use any other third-party processors at this time.

5. How long we keep your data

Your account data and quest history are kept for as long as your account exists. Quest proof photos are retained only as long as needed for the quest they belong to, per our storage provider's retention rules, and are removed sooner if you delete the quest or your account.

6. Deleting your account

You can permanently delete your account and its associated data at any time from Profile → Settings → Delete Account in the app, or by emailing [email protected]. This is a genuine deletion, not deactivation.

7. Your rights under GDPR

As a data subject in the EU, you have the right to:

• Access the personal data we hold about you (Art. 15)
• Correct inaccurate data (Art. 16)
• Request erasure — see "Deleting your account" above (Art. 17)
• Restrict or object to certain processing (Art. 18, 21)
• Receive your data in a portable format (Art. 20)
• Lodge a complaint with a supervisory authority — for Germany/NRW, this is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)

To exercise any of these rights, email [email protected].

8. Children

SideQuest is not directed at children under 16. If you are under 16, please only use the app with the consent of a parent or legal guardian.

9. Changes to this policy

If this policy changes materially, we'll update the effective date above and, where required, notify you in the app.