Privacy Policy

1. Introduction

QuestRunner ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our application. By using QuestRunner, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Account Information

• Email address (required for account creation)
• Password (stored in hashed form, for accounts created with email and password only; we never see your plain-text password)
• Display name (from your email, or from your Apple or Google profile where provided)

Sign in with Apple's Hide My Email produces a relay address. An account created that way is a separate account from one created with your real address — we cannot link them, because we never see the underlying address.

2.2 Quest Data

• Quest titles, descriptions, and locations you create
• Due dates, start dates, and completion status
• Quest categories, types, difficulty levels, and XP rewards
• Sub-tasks within quests
• Recurring quest patterns and completion history

2.3 Information We Do NOT Collect

• We do not use analytics, tracking, or advertising services. This will change when in-app analytics is introduced; this policy will be updated before it ships.
• We do not collect device location data
• We do not use advertising cookies

2.4 Sign-in Providers

You can create and access your account with email and password, Sign in with Apple, or Sign in with Google.

If you sign in with Apple or Google using an email address that matches an existing verified account, the two are linked into one account.

3. How We Use Your Information

• To provide and maintain the QuestRunner service
• To authenticate your account and manage sessions
• To store and sync your quest data
• To generate quests from prompts you write, and from the onboarding answers and quest history that form your generation profile

4. Third-Party Services

4.1 Supabase

We use Supabase for authentication, database hosting, and session management. Your account data and quest data are stored on Supabase's infrastructure. Supabase's privacy policy is available at supabase.com/privacy.

4.2 Google

We use Google OAuth for sign-in only. When you sign in with Google, Google shares your email and basic profile information with us. Google's privacy policy is available at policies.google.com/privacy.

4.3 OpenAdapter

AI quest generation is performed by OpenAdapter, a third-party AI provider we pay for, which routes requests to open-weight language models. What is sent: the prompt you write, your onboarding answers, and your generation profile (your recent quest titles — active, completed and abandoned — any free-text context you provided, and a difficulty calibration derived from how you've been completing quests, showing which attributes are being made easier or harder for you). For daily quests, the prompt is app-authored rather than something you write, and it includes how many quests you've completed per attribute over the last 30 days. What is not sent: your email address, your password, or your account identifier.

OpenAdapter states that it does not store, log, or retain the content of prompts or model responses — requests pass through its infrastructure only to be routed onward. It retains request metadata (timestamps, endpoints, response codes) for 90 days. OpenAdapter's privacy policy is available at openadapter.dev/privacy.

OpenAdapter routes requests onward to third-party inference providers. Its policy names Chutes, 0G and OpenRouter, and states that these providers operate under their own privacy policies and may use anonymized or aggregated data for their own purposes, including model improvement. We never use your data to train anything, and OpenAdapter states that it does not either — but we cannot make that promise on behalf of the inference provider that ultimately runs the model. If that matters to you, do not put anything in a quest that you would not want a third party to process.

5. Cookies

We use only essential cookies managed by Supabase to maintain your authentication session. We do not use tracking cookies, advertising cookies, or third-party analytics cookies. No cookie consent banner is required as we do not use non-essential cookies.

6. Data Retention

You can delete your account at any time from Profile → Danger Zone inside the app. Deletion is immediate and permanent: your profile, every quest, all completion history and your generation usage records are destroyed. There is no grace period and no recovery.

7. Your Rights

• Access: You can view all your quest data within the app at any time.
• Deletion: You can delete individual quests at any time.
• Revocation: You can revoke Google's access to your account at myaccount.google.com/permissions.
• Account deletion: delete your account yourself, from inside the app, at any time — Profile → Danger Zone.

8. Data Security

We implement appropriate technical and organizational measures to protect your data. Authentication is handled by Supabase with industry-standard encryption. All data in transit is encrypted via HTTPS. Your password is never stored in plain text. However, no method of transmission over the Internet is 100% secure.

9. Children's Privacy

QuestRunner is not intended for children under 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected data from a child under 13, we will take steps to delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. Your continued use of the service after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy, please contact us at support@questrunner.net or visit our support page.