Privacy Policy

Who we are

Squest is operated by Ignacio Velasco, an individual. This Privacy Policy explains how Squest collects, uses, shares, and protects information when you use the Squest mobile app and website.

For privacy questions or requests, contact us at support@getsquest.app.

Information we collect

Account information: email address, password authentication handled through Supabase, username, country, language, theme, and account settings.

Fitness and game information: quests, routines, exercise logs, self-reported completions, XP, level, rank, stats, achievements, inventory, streaks, PvP results, leaderboard entries, friends, groups, blocks, invitations, and similar app activity.

Device and diagnostic information: push notification tokens, platform, timezone or UTC offset, app errors, crash reports, and basic technical information needed to operate and secure the app.

Purchase information: subscription, entitlement, product, transaction, and restore status from the App Store, Google Play, and RevenueCat. We do not receive full payment card details.

Health data

If you choose to verify cardio quests with Apple Health and Health Connect, Squest asks for permission to read workout-related data such as steps, distance, active energy or calories, workout activity, and activity duration.

Squest uses this health data only to verify cardio quest completion, calculate rewards, and prevent obviously invalid submissions. Squest does not write health data back to Apple Health or Health Connect.

When a health-verified cardio quest is submitted, Squest stores only the summary needed for the quest: completion method, activity type, distance, active minutes, step count, and related reward state. If the network is unavailable, the app may temporarily store that pending summary on your device until it can retry.

You can grant, deny, or revoke health permissions through Apple Health, Health Connect, or your device settings. If you revoke access, Squest will stop reading new health data, but prior quest records may remain until you delete your account or ask us to delete applicable data.

How we use information

We use information to create and secure accounts, operate quests and routines, calculate progress and rewards, provide social features, process purchases, restore entitlements, send requested or permission-based notifications, provide support, fix bugs, prevent abuse, and comply with legal obligations.

Where privacy law asks us to identify a legal basis, we rely on contract necessity to provide the app, consent for optional health and notification permissions, legitimate interests for security and service improvement, and legal obligations where applicable.

When we share information

We share information with service providers that help run Squest, including Supabase for authentication, database, storage, and edge functions; Firebase Cloud Messaging and Firebase Crashlytics for push notifications and crash diagnostics; RevenueCat for purchase entitlement management; and Apple, Google, and app stores for payments and platform services.

Some profile and progress information is visible to other users through product features such as leaderboards, friends, groups, PvP, invitations, and backing. Do not choose a username that includes private information you do not want other users to see.

We may also disclose information if required by law, to protect users and the service, or in connection with a business transfer. We do not sell personal information, and we do not use health data for advertising.

Retention

We keep account, profile, game, purchase, and social data while your account is active or as needed to provide the app, resolve disputes, prevent abuse, and meet legal or accounting requirements.

You can delete your account from Settings. Account deletion removes the Supabase auth user and related account data that is tied to that user through the backend deletion flow. Some records may be retained if required for security, legal compliance, payment records, or backup integrity.

Push tokens that have not checked in are scheduled for cleanup after 30 days. Notification logs and related delivery maintenance records are scheduled for cleanup after 14 days.

Your choices and rights

You can update profile settings in the app, turn off notifications in device settings, revoke Apple Health or Health Connect access in device health settings, restore purchases through the app, and delete your account from Settings.

Depending on where you live, you may have rights to access, correct, delete, export, restrict, or object to certain processing of your personal information. You may also have the right to withdraw consent where processing depends on consent, and to complain to your local data protection authority.

To make a privacy request, email support@getsquest.app. We may need to verify your account before acting on a request.

Children

Squest is not intended for children under 13, or a higher age where local law requires parental consent. If you believe a child has provided personal information without appropriate consent, contact us so we can review and delete it where required.

International transfers

Squest and its service providers may process information in countries other than where you live. When required, we rely on appropriate safeguards provided by our service providers or applicable law.

Changes

We may update this Privacy Policy as Squest changes. If changes are material, we will take reasonable steps to notify users through the app, website, or another appropriate channel.