Privacy Policy

1. Data controller

QUEST is created and operated by Bojan Stanimirović, who is the controller of your personal data. For any privacy request, email bstanimir10@gmail.com.

2. What we collect

• Account data: email address, username, display name, avatar, and — if you sign in with Google — the basic profile Google shares.
• Content you create: quests, completion notes, games, movies and series, memories, photos and reviews.
• Activity data: XP, levels, achievements, joined and completed quests.
• Reports: content you report and the reason you give.
• Technical data: data needed to keep you signed in and keep the service secure.

We do not use advertising trackers, we do not sell your data and we do not build marketing profiles.

3. Why we use it and legal basis

• Running your account and the game — performance of a contract (Art. 6(1)(b) GDPR).
• Safety, moderation and abuse prevention — legitimate interest (Art. 6(1)(f)).
• Showing content publicly when you switch it to Public — your consent (Art. 6(1)(a)), which you can withdraw anytime by switching it back to Private.
• Legal obligations — Art. 6(1)(c), where applicable.

4. Who can see your data

Journey entries and memories are private by default. Profiles, activity and badges are visible only to signed-in members. Quests you publish are public. Reports are visible only to administrators.

5. Processors

We use trusted service providers to host the app, database, file storage and sign-in (including Google, if you choose Google sign-in). They process data only on our instructions and under GDPR-compliant agreements. Where data is transferred outside the EU/EEA, this is covered by Standard Contractual Clauses or an adequacy decision.

6. How long we keep it

We keep your data while your account exists. When you delete your account, your personal data is deleted or anonymised within 30 days, unless the law requires us to keep it longer.

7. Your rights

Under GDPR you have the right to:

• access your data and get a copy of it;
• correct inaccurate data;
• delete your data ("right to be forgotten");
• restrict or object to processing;
• data portability;
• withdraw consent at any time;
• lodge a complaint with your national data protection authority (in Croatia: AZOP, azop.hr).

We answer requests within one month.

8. Security

Access to data is enforced in the database itself, not only in the app. Others cannot edit your profile, read your private entries or change your XP. Connections are encrypted.

9. Children

QUEST is not intended for children under 16. If you are under 16, you need consent from a parent or guardian.

10. Contact and changes

For privacy questions or requests, contact Bojan Stanimirović at bstanimir10@gmail.com. If we change this policy in a meaningful way, we will let you know in the app.