Legal

Privacy Policy

This policy explains what personal information Quest & Keep collects, why we use it, how we protect it, and the choices available to you.

Last updated: August 11, 2026

1. Who we are

Quest & Keep is a project published by Gato Chico Publishing. We provide adventure-journal content, user accounts, book and quest unlocking, XP progress, private quest-photo storage, and optional email updates.

For privacy questions or requests, contact us at hello@questandkeep.com.

2. Scope of this policy

This policy applies to questandkeep.com, its localized pages, account features, and communications that link to this policy. Third-party websites and services have their own privacy practices.

3. Information we collect

We collect only the information reasonably needed to operate and secure Quest & Keep and to provide the features you choose to use.

Account and authentication data: name, email address, profile image, account identifier, selected language, sign-in method, session data, and encrypted authentication tokens.
Adventure activity: unlocked books and quests, QR claims, XP transactions, progress, and related timestamps.
Quest photos: images you choose to upload, their technical metadata, and the book or quest they relate to. Images are normalized to a private WebP file; embedded metadata such as EXIF and location data is not copied to the normalized file.
Newsletter data: email address, language, subscription source, consent and confirmation dates, delivery status, and unsubscribe or suppression status.
Communications: messages and information you send when requesting support or exercising a privacy right.
Technical and security data: IP-derived request identifiers, browser or device information, request timestamps, rate-limit records, and error or security events.

4. Google sign-in and Google user data

If you choose Continue with Google, we request only the basic account information displayed on Google's consent screen, such as your Google account identifier, name, email address, and profile image. We use this information to authenticate you, create and secure your Quest & Keep account, display your basic profile, and send essential service messages.

We do not receive your Google password and do not request access to Google Drive, Contacts, Calendar, Gmail, or other unrelated Google services. Authentication tokens needed for sign-in are stored encrypted.

We do not sell Google user data, use it for targeted advertising, or add you to the newsletter without a separate opt-in. Our use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.

Review the Google API Services User Data Policy

5. How we use information

We use personal information to provide the service you request, fulfill choices you make, protect the platform, and comply with applicable obligations.

Create, authenticate, maintain, and protect your account.
Unlock books and quests, award XP, preserve progress, and prevent duplicate or fraudulent claims.
Process, store, retrieve, replace, or delete the private photos you upload.
Send sign-in links, account notices, security messages, and support replies.
Send newsletter and product updates only after separate consent and email confirmation.
Diagnose errors, enforce limits, prevent abuse, and improve user-facing features.
Meet legal, regulatory, tax, accounting, or security requirements when they apply.

6. Legal bases

Where data-protection law requires a legal basis, we rely on performance of our agreement with you for account and adventure features; your consent for newsletter marketing and other optional processing; our legitimate interests in security, fraud prevention, support, and service improvement; and compliance with legal obligations. You may withdraw consent at any time without affecting earlier lawful processing.

8. Private quest photos

Quest photos are stored in private object storage and delivered through authenticated Quest & Keep routes. They are not published in a public gallery or used for marketing unless you separately and expressly authorize that use.

Temporary upload files are deleted after processing or cleanup. Replacing or deleting a quest photo removes the active stored file, subject to short-lived operational backups or recovery copies where applicable.

9. Data retention and deletion

We keep account, progress, and photo records while your account is active or as reasonably needed to provide the service. If you request account deletion, we delete or de-identify associated personal information within a reasonable period, except where retention is required for security, fraud prevention, legal compliance, dispute resolution, or backup rotation.

After newsletter cancellation, we may retain a minimal suppression record so we can honor your opt-out. Pending subscription records expire, and temporary upload records are removed through automated cleanup.

To request account or data deletion, email hello@questandkeep.com from the address associated with your account. We may need to verify your identity before completing the request.

10. Your choices and rights

Depending on where you live, you may have rights to access, correct, export, delete, restrict, or object to certain processing of your personal information, and to appeal or complain to a data-protection authority. You may also disconnect Quest & Keep from your Google Account permissions page; doing so does not automatically delete information already stored by Quest & Keep.

Update your available profile information from your account.
Unsubscribe through the link in any marketing email without affecting your account.
Request access, correction, export, or deletion at hello@questandkeep.com.
Withdraw optional consent at any time.

11. Cookies and security

Quest & Keep uses essential cookies or similar storage to maintain secure sessions, language preferences, and protection against abuse. We do not use Google sign-in data for advertising cookies or targeted advertising.

We use measures designed to protect information, including encrypted connections, secure cookies in production, encrypted OAuth tokens, private photo storage, access controls, file validation, and rate limiting. No method of storage or transmission is completely secure, so absolute security cannot be guaranteed.

12. International processing

Our providers may process information in countries other than yours. Where required, we use contractual or other recognized safeguards for international transfers and limit processing to what is necessary for the service.

13. Children's privacy

Quest & Keep is not directed to children who cannot lawfully consent to an online account in their jurisdiction. If you are below the applicable age, use the service only with permission and supervision from a parent or legal guardian. If we learn that personal information was collected without required consent, we will take reasonable steps to delete it. A parent or guardian may contact hello@questandkeep.com.

14. Changes and contact

We may update this policy when our service, providers, or legal obligations change. We will post the revised date here and provide additional notice when a change materially affects your rights or how we use information.

Questions, complaints, and privacy requests may be sent to Quest & Keep at hello@questandkeep.com.