Privacy Policy

1. Overview, controller and your choices

This policy explains what information Questoria collects, why we use it, who receives it, how long we keep it, and the choices available to you.

The controller is Aaron-Pascal Sayar, Sayar Digital - Aaron-Pascal Sayar, Wettertalstr. 3, 61231 Bad Nauheim, Germany. Contact: kontakt@sayardigital.com.

You have the right to access, rectification, erasure, restriction of processing, data portability, and, where processing is based on legitimate interests, to object. You may withdraw consent at any time with future effect. You may also lodge a complaint with a data-protection supervisory authority, including the Hessian Commissioner for Data Protection and Freedom of Information. To exercise a right or request a portable copy of your data, email us at kontakt@sayardigital.com.

2. Information we collect and why

To provide Questoria, we process your email address, password if you register via email, account ID, username, time zone, character and companion choices, quests, storylines, progress, rewards, settings, direct messages, companion messages, feedback, reports, and notification identifiers. We process this data to perform our contract with you (Art. 6(1)(b) GDPR) and to secure the service and prevent abuse (Art. 6(1)(f) GDPR).

An email address is required to create and provide an account. You can register with an email address and password or, when available, use Google or Apple sign-in without setting a Questoria password. Push notifications and optional AI categorisation are optional and can be disabled or left unused.

Your account data is kept while your account is active. You can delete your account in the app at any time; live account data is then deleted. Closed abuse reports and their limited evidence snapshot may remain for six months after closure, feedback for 12 months, and backup copies for up to 365 days, as described below.

2a. Optional Google and Apple sign-in

If you choose Google or Apple sign-in, that service confirms your identity and shares your email address and an account reference that lets us recognise you next time. Apple can provide an email address that hides your real address if you choose to hide your email. Our sign-in requests also ask for basic profile information, such as your name; Google may also supply a profile picture. We do not save those names or pictures for sign-in. We do not receive your Google or Apple password.

We use this account reference and email address to create your Questoria account, sign you in, or connect Google or Apple to an existing account after you sign in to it. The legal basis is providing the sign-in method you request (Art. 6(1)(b) GDPR). We also verify sign-in requests to protect accounts against misuse (Art. 6(1)(f) GDPR).

Google or Apple receives the information needed to sign you in to Questoria, including information about your sign-in request, internet connection and device. We do not send your quests, messages, or other app content as part of sign-in. Google and Apple are responsible for how they use your information to provide their sign-in services. Their privacy notices explain their processing, retention, international transfers, and your controls: Google Privacy Policy, Sign in with Apple and Privacy, and Apple Privacy Policy. For users in the EEA, the responsible entities are Google Ireland Limited and Apple Distribution International Limited, respectively. Their processing may take place outside the EEA, including in the United States.

We keep your email address and Google or Apple account reference until you delete your Questoria account, subject to the backup retention described in this policy. You can also manage or remove Questoria's access in your Google or Apple account settings. Removing access there does not delete your Questoria account or the information already stored with it.

3. How we share information

Questoria is hosted by Hetzner Online GmbH. We process technical server data, including IP address, date and time of access, and request data, to provide and secure the service (Art. 6(1)(f) GDPR).

Deleted data may remain in backup copies for up to 365 days.

We use Sentry to receive error and performance reports. These reports help us diagnose and secure the service (Art. 6(1)(f) GDPR).

Our processors include Hetzner (hosting), Amazon Web Services (backup copies), Sentry (diagnostics), Resend (transactional email), Google Cloud Vertex AI when you use AI features, and Google Firebase and Apple for push notifications. A processor may use sub-processors outside the EEA. Where a transfer requires it, we use an adequacy decision or appropriate safeguards such as EU Standard Contractual Clauses. You can request the applicable safeguards at kontakt@sayardigital.com.

4. Account communications and your device

We use Resend to send account verification and password-reset emails. This requires your email address and the content necessary to deliver the email. We process these emails to provide and secure your account (Art. 6(1)(b) and (f) GDPR).

We use necessary cookies and securely stored sign-in information to sign you in and keep you signed in on your device. This sign-in information expires after 30 days unless renewed while you use Questoria. When you log out, the app signs you out and asks our service to end your login; this request requires an internet connection. This device storage is necessary for the service you request (§ 25(2)(2) TDDDG); the related personal-data processing is based on Art. 6(1)(b) and (f) GDPR. We do not use advertising or analytics cookies.

5. AI features

When you use the AI companion, we send your message, any voice recording, recent companion messages, and relevant app context to Google Cloud Vertex AI. This lets the companion respond in context and perform the actions you ask it to. We process this data to provide the feature you choose to use (Art. 6(1)(b) GDPR).

AI quest categorisation is off by default. If you enable it in settings, a quest's title and description are sent to Vertex AI to assign a category. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw in settings with future effect.

Do not enter or speak health, religious, sexual-orientation, or other special-category personal data, or another person's personal data, into AI features. AI responses are generated automatically and do not make decisions with legal or similarly significant effects about you. Voice recordings are used only to process the relevant message and are not added to your companion-message history. Companion messages are deleted with your account.

6. Push notifications and messages

If you allow push notifications, we store a device identifier linked to your account and use Google Firebase and Apple to deliver them. Push notifications can include a sender name and a preview of a direct message, or a streak reminder. You can turn notifications off in your device settings and streak reminders in Questoria. The legal basis is your consent (Art. 6(1)(a) GDPR).

Direct messages and companion updates are delivered only to the intended account.

7. Data retention and deletion

To investigate abuse reports, we may retain a closed report and its limited evidence snapshot of relevant messages for six months after the case is closed, including after either involved account is deleted. Open reports involving a deleted account are deleted. This is necessary to protect users, handle appeals, and establish or defend legal claims (Art. 6(1)(f) GDPR). We delete feedback 12 months after submission.

Application and security logs are retained for up to 30 days. We retain data longer only where necessary for a legal obligation, an ongoing dispute, or a specific legal claim.

8. Changes and contact

We may update this policy when our processing changes or the law requires it. For questions or to exercise your rights, contact us at kontakt@sayardigital.com.