GDPR privacy notice

1. Controller, DPO, and representative

The QuestGlass operator and controller for the processing described in this notice is Oğuzhan Altuner. Privacy requests can be sent to support@questglass.com. QuestGlass has not appointed a Data Protection Officer or an EU or UK representative. The legally valid geographic contact address and the written decision on any representative duty have not yet been published; public launch remains blocked until those details are confirmed and added here.

2. Data categories and sources

• Data you provide: email, username, display name, full date of birth stored privately for age verification, optional private gender selection, profile photo, bio, home country, languages, interests, notification activity preferences, travel dates, posts, comments, quests, meetup plans, reports, and support requests.
• Data created through use: direct messages, reactions, blocks, connections, activity status, read receipts, saved places, route starts, place searches, notification choices, and moderation history.
• Location data: foreground GPS only when permission is granted, manual area selections, temporary chat location shares, route starts, and nearby discovery signals.
• Technical data: IP address, device or browser details, authentication logs, upload metadata, crash logs, rate limits, security events, abuse signals, and staff-access audit logs.
• Third-party data: authentication provider identifiers, app-store or payment records if paid features launch, map/search provider results, and legal or safety reports from other users.

3. Purposes and GDPR legal bases

• Account creation, login, profiles, chats, quests, meetups, saved places, and core app features: contract necessity under Art. 6(1)(b) GDPR.
• Security, fraud prevention, abuse detection, moderation, reports, blocks, rate limits, service debugging, reliability, and product improvement: legitimate interests under Art. 6(1)(f) GDPR, balanced against user rights.
• Legal requests, tax/accounting records if paid features launch, regulatory compliance, and evidence needed for disputes or safety incidents: legal obligation under Art. 6(1)(c) GDPR or legitimate interests under Art. 6(1)(f) GDPR.
• Foreground GPS, temporary location sharing, marketing notifications, and non-essential analytics or advertising cookies: consent under Art. 6(1)(a) GDPR where required, with the right to withdraw consent at any time. Chat translation is not offered in this release.
• Emergency safety escalation, if ever needed to protect someone's life or physical safety: vital interests under Art. 6(1)(d) GDPR.

4. Special category data

QuestGlass is not designed to collect special categories of personal data such as health, biometric identity, religion, political views, union membership, sexual orientation, or precise data about minors. Users should not post that data in profiles, chats, reports, or quests. If a report or safety message contains special category data, we restrict its use to what is necessary for safety, legal claims, explicit consent, or another applicable GDPR Article 9 condition.

5. Recipients and processors

Data may be shared with other users according to your settings and actions, authorized staff and moderators, cloud hosting and database providers, authentication providers, media storage and moderation providers, push notification providers, map/search providers, email/support providers, app-store platforms, payment providers if paid features launch, professional advisers, law enforcement, courts, or regulators where legally required. Chat text is not sent to a translation provider in this release. Contact support@questglass.com for the current provider list.

6. International transfers

Service providers may process personal data outside the EEA or UK, including in the United States and Turkey. Depending on the provider and destination, a transfer may rely on an adequacy decision, Data Privacy Framework certification where applicable, Standard Contractual Clauses, the UK international data transfer addendum or agreement, or another lawful basis. Contact support@questglass.com to request the current mechanism for a provider.

7. Retention

• Account and profile data: kept while the account is active, then deleted or anonymized after account deletion unless needed for legal, safety, or backup reasons.
• Chats, quest content, photos, meetups, notes, and reports: kept while needed for the service, user access, safety review, disputes, legal compliance, and backups.
• Temporary location shares: designed to expire quickly or stop when the feature ends, except where retained in logs, reports, or legal holds.
• Security, audit, fraud, moderation, deletion, and legal hold records: retained as long as needed to protect users, prove compliance, resolve disputes, or meet legal obligations.
• Backups: retained for limited operational periods and then overwritten according to the backup schedule.

8. Your GDPR/UK GDPR rights

• Access, correction, deletion, restriction, portability, and objection where the legal requirements are met.
• Withdraw consent at any time for consent-based processing, without affecting earlier lawful processing.
• Object to direct marketing at any time and object to legitimate-interest processing based on your particular situation.
• Ask for human review where a solely automated decision would produce legal or similarly significant effects.
• Complain to your local data protection supervisory authority if you believe your rights were violated.

9. Right to object

You may object at any time to direct marketing. You may also object to processing based on legitimate interests, including certain safety, analytics, discovery, or improvement processing, based on your particular situation. Send requests to support@questglass.com with the account email or username. We may continue processing only where the law allows, such as compelling legitimate grounds or legal claims.

10. Request handling

Requests can be sent to support@questglass.com. QuestGlass may ask for information needed to verify identity and locate the account. We answer GDPR/UK GDPR requests without undue delay and generally within one month unless the law allows an extension. If a request is refused, we explain why and describe available complaint and remedy options.

11. Cookies, consent, and withdrawals

Strictly necessary storage runs to provide the service. Non-essential analytics, advertising, marketing, or tracking storage does not run for EEA/UK users until they give a clear affirmative opt-in where required. Pre-ticked boxes, silence, inactivity, or merely continuing to use the app are not treated as consent. Consent controls are designed to be as easy to withdraw as they are to give.

12. Automated decisions and profiling

QuestGlass may use ranking, search, safety, spam, abuse, and recommendation signals to operate the app. QuestGlass does not make solely automated decisions that produce legal or similarly significant effects for EEA/UK users. QuestGlass will update this notice and explain the logic, significance, expected consequences, and applicable rights before introducing such a decision.

13. DPIA and launch checks

QuestGlass reviews whether a Data Protection Impact Assessment is required when social, location, moderation, monitoring, profiling, special-category-data, or scale-related risks change. We also review the vendor list, cookies, retention schedule, DPO or representative status, and transfer information before adding processors and at least annually.

Explore QuestGlass