Privacy Policy

1. Who we are

Sidequest Journal is operated by Cask Coded, s.r.o. (the “data controller”, “we”, “us”). If you have any questions about this policy or how we handle your data, contact us at studio@caskcoded.com.

2. What we collect

We collect four kinds of information:

• Account data: your email address, display name, and avatar.
• Content you add: quests, ratings, photos, and group memberships you create or join. A quest can optionally be tagged with a place you pick or share (a name and map coordinates) — location is only ever attached by your explicit action, never collected in the background, and is stored with the quest.
• Technical data: data used solely to keep you signed in — an authentication session cookie on the web, or a securely stored authentication token in the mobile apps. If you turn on notifications, we also store a push token for your device so we can deliver them; it is removed when you disable notifications or delete your account.
• Diagnostic data: when the app or the website hits an unexpected error, we receive a crash report: the error itself, where in the app it happened, your device model and operating system version, and opaque identifiers such as your account id. It never carries your quests, ratings, photos, or anything you typed.

3. Why we collect it

We use this data for one purpose: providing the Sidequest Journal service to you and the groups you belong to — creating your account, syncing quests and ratings across your group, storing your photos, and calculating your achievements and stats. We do not use your data for advertising, and we do not sell your data to anyone.

4. Where it’s stored

We rely on the following processors to run the service:

• Supabase — database, authentication, and file storage, hosted in the EU (Frankfurt region).
• Vercel — application hosting.
• Sentry — crash and error reporting, on its EU (Germany) region.
• Google — if you choose “Sign in with Google” instead of email and password; Firebase Cloud Messaging, which delivers push notifications to Android devices and to Chrome; and Google Maps, which the website embeds for the place picker and a quest’s map preview (Google receives the map coordinates and your IP address, as with any embedded map).
• Apple — MapKit, which the iOS app uses for the place picker and a quest’s map preview; the Apple Push Notification service, which delivers notifications to iPhones; and Apple’s media servers, which serve the cover art and the 30-second preview when a quest has a song attached, on every platform. Apple receives your IP address in each case.
• OpenStreetMap — map tiles and place search in the Android app, and the website’s map fallback. Their servers receive the map coordinates and your IP address.

Photos you upload are stored privately and are never public — they are only accessible through time-limited, signed URLs generated for members of your group.

5. How long we keep it

We keep your account and content for as long as your account exists. If you delete a quest or a photo, the associated data is removed from our active systems (backups age out on their normal retention schedule). You can delete your account directly in the app (Settings → Danger zone → Delete account, on the web, on iOS and on Android): your login and any groups only you belong to are permanently deleted, and contributions in shared groups are kept but anonymized (“Deleted user”). You can also request deletion by contacting us at studio@caskcoded.com; we will process the request without undue delay.

6. Your rights

Under the GDPR, you have the right to access, correct, export, or erase your personal data, and to object to or restrict how we process it. To exercise any of these rights, email us at studio@caskcoded.com.

You also have the right to lodge a complaint with the Slovak Office for Personal Data Protection (Úrad na ochranu osobných údajov SR) at dataprotection.gov.sk.

7. Changes to this policy

If we make material changes to this policy, we’ll update the effective date above and, where appropriate, notify you directly.