Privacy Policy

1. Overview, controller and your choices

This policy explains what information Questoria collects, why we use it, who receives it, how long we keep it, and the choices available to you.

The controller is Aaron-Pascal Sayar, Sayar Digital - Aaron-Pascal Sayar, Wettertalstr. 3, 61231 Bad Nauheim, Germany. Contact: kontakt@sayardigital.com.

You have the right to access, rectification, erasure, restriction of processing, data portability, and, where processing is based on legitimate interests, to object. You may withdraw consent at any time with future effect. You may also lodge a complaint with a data-protection supervisory authority, including the Hessian Commissioner for Data Protection and Freedom of Information. To exercise a right or request a portable copy of your data, email us at kontakt@sayardigital.com.

2. Information we collect and why

To provide Questoria, we process your email address, password, account ID, username, time zone, character and companion choices, quests, storylines, progress, rewards, settings, direct messages, companion messages, feedback, reports, and notification identifiers. We process this data to perform our contract with you (Art. 6(1)(b) GDPR) and to secure the service and prevent abuse (Art. 6(1)(f) GDPR).

Your email address and password are required to create and provide an account. Without them, we cannot provide account functionality. Push notifications and optional AI categorisation are optional and can be disabled or left unused.

Your account data is kept while your account is active. You can delete your account in the app at any time; live account data is then deleted. Closed abuse reports and their limited evidence snapshot may remain for six months after closure, feedback for 12 months, and backup copies for up to 365 days, as described below.

3. How we share information

Questoria is hosted by Hetzner Online GmbH. We process technical server data, including IP address, date and time of access, and request data, to provide and secure the service (Art. 6(1)(f) GDPR).

Deleted data may remain in backup copies for up to 365 days.

We use Sentry to receive error and performance reports. These reports help us diagnose and secure the service (Art. 6(1)(f) GDPR).

Our processors include Hetzner (hosting), Amazon Web Services (backup copies), Sentry (diagnostics), Resend (transactional email), Google Cloud Vertex AI when you use AI features, and Google Firebase and Apple for push notifications. A processor may use sub-processors outside the EEA. Where a transfer requires it, we use an adequacy decision or appropriate safeguards such as EU Standard Contractual Clauses. You can request the applicable safeguards at kontakt@sayardigital.com.

4. Account communications and your device

We use Resend to send account verification and password-reset emails. This requires your email address and the content necessary to deliver the email. We process these emails to provide and secure your account (Art. 6(1)(b) and (f) GDPR).

Questoria uses the information stored on your device that is necessary to keep you signed in and provide the service. We do not use advertising or analytics cookies.

5. AI features

When you use the AI companion, we send your message, any voice recording, recent companion messages, and relevant app context to Google Cloud Vertex AI. This lets the companion respond in context and perform the actions you ask it to. We process this data to provide the feature you choose to use (Art. 6(1)(b) GDPR).

AI quest categorisation is off by default. If you enable it in settings, a quest's title and description are sent to Vertex AI to assign a category. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw in settings with future effect.

Do not enter or speak health, religious, sexual-orientation, or other special-category personal data, or another person's personal data, into AI features. AI responses are generated automatically and do not make decisions with legal or similarly significant effects about you. Voice recordings are used only to process the relevant message and are not added to your companion-message history. Companion messages are deleted with your account.

6. Push notifications and messages

If you allow push notifications, we store a device identifier linked to your account and use Google Firebase and Apple to deliver them. Push notifications can include a sender name and a preview of a direct message, or a streak reminder. You can turn notifications off in your device settings and streak reminders in Questoria. The legal basis is your consent (Art. 6(1)(a) GDPR).

Direct messages and companion updates are delivered only to the intended account.

7. Data retention and deletion

To investigate abuse reports, we may retain a closed report and its limited evidence snapshot of relevant messages for six months after the case is closed, including after either involved account is deleted. Open reports involving a deleted account are deleted. This is necessary to protect users, handle appeals, and establish or defend legal claims (Art. 6(1)(f) GDPR). We delete feedback 12 months after submission.

Application and security logs are retained for up to 30 days. We retain data longer only where necessary for a legal obligation, an ongoing dispute, or a specific legal claim.

8. Changes and contact

We may update this policy when our processing changes or the law requires it. For questions or to exercise your rights, contact us at kontakt@sayardigital.com.