📋 Legal Document
Privacy Policy
Last Updated: August 2026 | Effective Date: July 2026
At Questing, your privacy is not an afterthought — it is a design principle. This policy explains what data we collect, why we collect it, and exactly how it is stored and used. We do not sell your personal data. We never will.
1. Information We Collect
We collect only the information you explicitly provide to personalize your experience, along with basic telemetry to improve the app:
- Profile Data: Your name, date of birth, gender, and profile photo (optional). Used to calculate your life countdown and personalize AI responses.
- Quests & Bucket List: Quest titles, descriptions, deadlines, and completion status you enter into the app.
- Daily Reflections: Journal entries, milestones, and notes you write within the app.
- Chat Messages: Messages you send to the Life AI mentor. These are sent to the Gemini API (Google) or your chosen AI provider to generate responses.
- Account Information: If you sign in with Google, we receive your email address and display name from Firebase Authentication.
- Community Identity: If you use community features like Seekers Circle, a specific username you choose will be associated with your posts.
- Anonymous Telemetry: We collect aggregated, anonymous data (such as mood trends, reflection length, or app usage streaks) to improve our features. This data cannot be traced back to your personal identity. You can opt out at any time in Settings → Help Improve Life AI.
- Device & Usage Analytics: Firebase Analytics automatically collects standard metrics including device model, OS version, app version, session duration, and coarse location (country/region level). This data is used solely to understand aggregate app performance.
- Advertising Identifiers: If you watch rewarded ads (to unlock additional AI quota), Google AdMob may collect your advertising identifier (GAID on Android / IDFA on iOS), device fingerprint, and IP address to serve relevant ads. You can reset or limit ad tracking in your device settings.
- Voice Input: When you use the voice-to-text feature for Life AI, audio is processed by your device's native speech recognition engine (Google Speech on Android / Apple SFSpeechRecognizer on iOS). Audio may be transmitted to Google or Apple speech servers. No audio is stored by Questing.
- Font Download Requests: The app uses Google Fonts (Inter, Outfit). On first launch or font update, your device may request font files from Google's servers, which may log your IP address and User-Agent string per Google's standard infrastructure practices.
2. How Your Data Is Stored & Encrypted
🔒 End-to-End Encryption & Offline-First: All your personal data is stored locally on your device by default. If you enable Cloud Backup, your core bond data is End-to-End Encrypted (AES-256) on your device using a custom password before it is ever uploaded. We cannot read your cloud backups.
- Local Storage (Default): All data is stored on-device using Hive. This works fully offline and requires no internet connection.
- Cloud Backup (Optional): If you sign in and enable the Bond Vault backup, your core data is encrypted and saved to our Supabase servers. Because the encryption happens on your device with your personal password, the data is completely unreadable to us or anyone else.
3. AI & Third-Party Services
Questing integrates with the following third-party services:
- Google Gemini API: Messages sent to the Life AI are processed by Google's Gemini models. Your prompts are governed by Google's Privacy Policy.
- OpenAI / Anthropic (Optional): If you configure your own API key, your messages are sent to your chosen provider under their respective privacy terms.
- Supabase: Used to securely store your E2E encrypted Bond Vault backups, host the Seekers Circle community feed, and collect anonymous telemetry (only when you have opted in).
- Firebase Authentication (Google): Used for secure sign-in (Email/Password and Google OAuth). Firebase receives your email address and display name upon sign-in.
- Firebase Analytics (Google): Automatically collects aggregate app usage metrics (screen views, session length, device model, OS version, app version, and country-level location). Used to improve app performance. No personally identifiable information is sent. Governed by Google's Privacy Policy.
- Google Mobile Ads (AdMob): Used to offer rewarded video ads that unlock additional AI quota. AdMob may collect your advertising identifier (GAID / IDFA), IP address, and device information to serve and measure ads. On iOS, this is governed by Apple's App Tracking Transparency (ATT) framework. You may opt out via your device's ad settings. Governed by Google's Privacy Policy.
- Google Fonts: The app uses the Inter and Outfit typefaces hosted by Google Fonts. When font files are downloaded, Google may log your IP address and User-Agent per standard CDN practices. Governed by Google's Privacy Policy.
- Pexels API: Used to fetch landscape images for quest cards. Your search queries (quest titles) are sent to Pexels servers via a Supabase Edge Function proxy.
- Device Speech Recognition: The voice input feature uses your device's native speech engine (Google SpeechRecognizer on Android, Apple SFSpeechRecognizer on iOS). Audio may be processed on Google or Apple servers. No audio is stored or retained by Questing.
- Apple SKAdNetwork (iOS only): Used for privacy-preserving ad attribution as required by Apple's guidelines. No personally identifiable information is involved.
4. Crisis Detection & Mental Health
🛡 This is handled entirely offline. Questing includes a local crisis-detection system that scans your chat input for distress signals using on-device keyword matching. If triggered, no data is sent to any external server. All AI connections are immediately halted and local emergency helplines are displayed alongside a guided breathing exercise.
5. Data Sharing & Community Features
We do not sell, rent, or trade your personal information with any third party for marketing purposes. Data is only shared in the following ways:
- With Google Gemini / your chosen AI provider when you send messages to the AI mentor (required for the feature to work).
- With Supabase for anonymous telemetry and to store your E2E encrypted backups (which we cannot read).
- Seekers Circle (Community Feed): If you choose to post struggles, wins, or bucket list photos to the Seekers Circle, this content will be publicly visible to other users under your chosen specific username. This feature requires your explicit opt-in.
- As required by law or court order, only to the extent legally mandated.
6. Data Retention & Deletion
You are in complete control of your data at all times:
- Local Wipe: All local data can be permanently deleted via Settings → Danger Zone → Delete All Data.
- Cloud Wipe: You can instantly delete all your cloud data (backups and community posts) directly from within the app using the "Delete Cloud Account" option in Settings.
- If you lose access to your device, you can request account deletion by emailing us at teamquesting+help@gmail.com.
7. Children's Privacy & Age Limit (India DPDPA Sec. 9, COPPA & GDPR)
Our App is strictly intended for individuals who are 18 years of age or older. In compliance with Section 9 of India's Digital Personal Data Protection Act (DPDPA 2023), the Children's Online Privacy Protection Act (COPPA), and global child privacy regulations, we enforce a mandatory age gate upon registration. We do not knowingly collect, process, track, profile, or serve targeted advertisements to anyone under the age of 18. If you learn that a user under 18 has provided us with personal information, please contact us immediately, and we will purge all associated cryptographic keys, device databases, and cloud records.
8. Security
We take extreme technical and organizational measures to protect your data. Local data is secured using Hive's built-in AES encryption. Cloud backups are secured using strict Row Level Security (RLS) on Supabase, combined with true Client-Side End-to-End Encryption (AES-256). This ensures that only you can decrypt and restore your personal journey.
9. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date at the top of this page. Continued use of the app after changes constitutes acceptance of the revised policy. We encourage you to review this page periodically.
10. Grievance Redressal & Grievance Officer (India — DPDPA 2023)
In accordance with the Digital Personal Data Protection Act (DPDPA), 2023 and applicable Indian Information Technology rules, the designated Grievance Officer for data protection and privacy concerns is:
- Designation: Grievance Officer, Team Questing
- Department: Privacy & Data Protection Desk
- Email: teamquesting+help@gmail.com (Subject: Data Grievance / Privacy Request)
- Turnaround Time: Grievance acknowledgment within 48 hours; full resolution within 30 days.
Terms of Service (Summary)
By downloading and using Questing, you agree to the following:
- You are at least 18 years of age.
- You will use the app for lawful, personal purposes only.
- The life countdown is a statistical estimate based on population data. It is not a medical or clinical prediction.
- Questing is not a mental health service or medical application. In case of emergency, please contact local emergency services.
- You are responsible for keeping your API keys (if configured) secure, as well as your Bond Vault encryption password.
- We reserve the right to update or discontinue the app or its features at any time.
- We provide the app "as-is" without warranties of any kind, to the extent permitted by law.