Privacy Policy

1. Who we are

Sidequest Journal is operated by Cask Coded, s.r.o. (the “data controller”, “we”, “us”). If you have any questions about this policy or how we handle your data, contact us at studio@caskcoded.com.

2. What we collect

We collect three kinds of information:

• Account data: your email address, display name, and avatar.
• Content you add: quests, ratings, photos, and group memberships you create or join. A quest can optionally be tagged with a place you pick or share (a name and map coordinates) — location is only ever attached by your explicit action, never collected in the background, and is stored with the quest.
• Technical data: data used solely to keep you signed in — an authentication session cookie on the web, or a securely stored authentication token in the mobile apps. If you turn on notifications, we also store a push token for your device so we can deliver them; it is removed when you disable notifications or delete your account.

3. Why we collect it

We use this data for one purpose: providing the Sidequest Journal service to you and the groups you belong to — creating your account, syncing quests and ratings across your group, storing your photos, and calculating your achievements and stats. We do not use your data for advertising, and we do not sell your data to anyone.

4. Where it’s stored

We rely on the following processors to run the service:

• Supabase — database, authentication, and file storage, hosted in the EU (Frankfurt region).
• Vercel — application hosting.
• Google— only if you choose “Sign in with Google” instead of email and password, and Google Maps when you open the place picker or view a quest’s map preview (Google receives the map coordinates and your IP address, as with any embedded map).

Photos you upload are stored privately and are never public — they are only accessible through time-limited, signed URLs generated for members of your group.

5. How long we keep it

We keep your account and content for as long as your account exists. If you delete a quest or a photo, the associated data is removed from our active systems (backups age out on their normal retention schedule). You can delete your account directly in the app (Settings → Danger zone → Delete account, on the web, on iOS and on Android): your login and any groups only you belong to are permanently deleted, and contributions in shared groups are kept but anonymized (“Deleted user”). You can also request deletion by contacting us at studio@caskcoded.com; we will process the request without undue delay.

6. Your rights

Under the GDPR, you have the right to access, correct, export, or erase your personal data, and to object to or restrict how we process it. To exercise any of these rights, email us at studio@caskcoded.com.

You also have the right to lodge a complaint with the Slovak Office for Personal Data Protection (Úrad na ochranu osobných údajov SR) at dataprotection.gov.sk.

7. Changes to this policy

If we make material changes to this policy, we’ll update the effective date above and, where appropriate, notify you directly.