Your data,
your terms.

CitiQuest ("we", "our", "the app") is a real-world quest platform built to help people run real-world sidequests, explore their cities, and earn XP for showing up in real life. We take your privacy seriously. This policy explains what data we collect, why we collect it, and how you can control it.

We will never sell your personal data to third parties. Full stop.

We share data only in these narrow circumstances:

• Service providers: infrastructure partners (Supabase, Vercel, Resend) who process data on our behalf under strict data processing agreements.

• Legal obligation: if required by law, court order, or to protect the safety of users.

• Business transfer: if CitiQuest is acquired, your data would transfer under the same privacy commitments described here, and you would be notified in advance.

We do not share data with advertisers or data brokers.

Active account data is kept for as long as your account exists. If you delete your account:

• Your profile, username, and email are deleted immediately.

• Quest submissions are anonymised (not deleted) so leaderboards and neighborhood rivalry scores remain accurate.

• Anonymised usage telemetry may be retained for up to 12 months for aggregate analysis.

We use only essential cookies (session tokens required to keep you logged in). We do not use advertising cookies, cross-site trackers, or third-party analytics that sell your data.

We use privacy-preserving first-party analytics (aggregated, not tied to individual identities) to understand general usage patterns.

Data is encrypted in transit (TLS 1.3) and at rest (AES-256). Access to production databases is restricted to named engineers via audited credentials. We run regular security reviews and apply patches promptly.

If you discover a security vulnerability, please report it to security@citiquest.app (we take all reports seriously and will respond within 48 hours).

CitiQuest is not intended for users under 16. We do not knowingly collect data from minors. If you believe a child has created an account, contact us at privacy@citiquest.app and we will delete it promptly.

We will notify you of material changes via in-app notification and email at least 14 days before they take effect. The "last updated" date at the bottom of this page reflects the most recent revision.

Questions, requests, or concerns? Reach us at:

privacy@citiquest.app

We aim to respond to all privacy-related requests within 5 business days.