Privacy Policy — Subquest

This policy is a good-faith standard draft. Replace the highlighted placeholders with your legal details and have it reviewed by a qualified adviser before relying on it.

This Privacy Policy explains how Subquest ("we", "us") collects and processes personal data when you use the website at subquest.dev and the game application at app.subquest.dev (together, the "Service"). We process personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and applicable Romanian law.

1. Who we are (data controller)

The data controller is [operator legal name], with its registered office at [registered office address], registration number [registration no. / CUI]. You can reach us about privacy at [email protected].

2. What data we collect

Marketing website (subquest.dev)

The website is designed to be low-data. It sets no advertising or cross-site tracking cookies. It stores a single functional value in your browser (your chosen language) and uses privacy-friendly, cookieless analytics (see section 5). We do not ask you to create an account to browse the website.

Game application (app.subquest.dev)

• Account data — the email address and credentials you provide when you register or sign in.
• Progress data — your quests completed, XP, achievements and related in-game state, so we can save and restore your progress.
• Technical data — limited server logs (such as IP address and request metadata) needed to operate the Service securely and prevent abuse.

3. Why we process it and our legal bases

• To provide the Service — creating your account, authenticating you and saving your progress. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• To keep the Service secure — preventing fraud, abuse and technical faults. Legal basis: our legitimate interests (Art. 6(1)(f) GDPR).
• To understand aggregate usage — cookieless, non-identifying analytics. Legal basis: our legitimate interests in improving the Service (Art. 6(1)(f) GDPR).

4. Cookies and local storage

The website is cookieless. The application uses only strictly necessary cookies for login and session security. For details, see our Cookie Policy.

5. Analytics

We use Umami, a privacy-focused, self-hosted analytics tool, to measure aggregate traffic. Umami does not use cookies, does not create persistent identifiers and does not collect personal data that identifies you individually.

6. Who we share data with

We do not sell your personal data. We share it only with service providers that help us run the Service (for example hosting and infrastructure providers), acting as our processors under appropriate agreements, and with authorities where we are legally required to do so.

7. How long we keep it

We keep account and progress data for as long as your account is active. If you delete your account, we delete or anonymize the associated personal data within a reasonable period, except where we must retain certain records to meet legal obligations. Server logs are kept only for a short period.

8. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict and port your personal data, and to object to certain processing. Where processing is based on consent, you may withdraw it at any time. To exercise your rights, contact us at [email protected]. You also have the right to lodge a complaint with the Romanian supervisory authority, the National Supervisory Authority for Personal Data Processing (ANSPDCP, dataprotection.ro).

9. International transfers

Where personal data is transferred outside the European Economic Area, we rely on appropriate safeguards such as European Commission adequacy decisions or Standard Contractual Clauses.

10. Children

The Service is not directed at children under the age of [16 / applicable age]. If you believe a child has provided us with personal data, contact us and we will take appropriate steps.

11. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date at the top of this page.

12. Contact

Questions about this policy or your data? Email [email protected].