Privacy Notice

Who is responsible

The controller is Wittenberger Industries S.R.L., registered in Romania with registration number (CUI) 48987950 and registered office at Strada Lazăr Gheorghe nr. 7, Scara 3, Etaj 4, Ap. 48, Cluj-Napoca, Cluj County, Romania.

For anything about your data, use in-app feedback from Family settings, or write to contact@wittenberger.io or to the registered address.

Who this notice covers

Guardians — the adults who sign in and run a Keep — and the children whose adventurer profiles a guardian creates. It also covers anyone a guardian invites by email.

Visitors who do not sign in only get the cookies described in our Cookie Policy and leave the basic technical traces any website receives.

What we hold about a guardian

When you sign in: your email address, the name your sign-in account supplies (if any), and a pseudonymous identifier from our sign-in provider. When you set up the Keep: the family name, country, language, timezone, and currency, and — if you turn the weather on — the city you pick and its coordinates. While you use QuestKeep: the quests, rewards, approvals, and settings you create, the devices you have claimed for the family, and the email address of anyone you invite. If you write to us: what you wrote. If you subscribe: your Stripe customer and subscription identifiers, plan, and subscription status — never your card.

To stop abuse, we also keep short-lived rate-limit counters keyed to a one-way keyed hash of your IP address, never the address itself. We do not ask for your postal address, your phone number, or your date of birth.

What we hold about a child

A display name, an avatar picked from a small set of drawings we ship, and a PIN stored only as a hash. Then the family's game itself: the quests the child claims and has approved, their coins and what they spend them on, Hero's Code marks, expedition progress, ranks, and the messages in their in-app inbox.

There is no email address, no phone number, no photo, no location, and no contact detail for a child anywhere in QuestKeep. The PIN is hashed with argon2id and never stored as digits, and the cookie that keeps a child signed in on the family device carries internal identifiers only — never a name, an avatar, or a PIN.

Why we process it, and on what legal basis

To run the family's Keep: signing guardians in, showing each adventurer their quests and coins, keeping each family's data apart, taking payment, and sending account emails. The legal basis is the contract with the guardian (GDPR Article 6(1)(b)).

To keep QuestKeep secure and working: rate limits, error reports, and an audit record of sensitive actions such as account deletion and staff access. The legal basis is our legitimate interest in a safe, working service (Article 6(1)(f)).

To keep payment and invoice records for as long as accounting and tax law requires. The legal basis is our legal obligation (Article 6(1)(c)).

For a child's data, the basis is the contract with the guardian who holds parental responsibility and chose to add the child.

Children and parental responsibility

QuestKeep is offered to adults, not to children. A child cannot create an account, sign up, or enter an email address; a child's profile exists only because a guardian created it. In Romania the age of digital consent is 16, the GDPR default, so a service that relied on a child's own consent would need a parent's consent for anyone younger. QuestKeep never asks a child for consent: the parent sets everything up.

By adding a child, a guardian confirms that they hold parental responsibility for that child or have the permission of someone who does. A guardian can correct, deactivate, or delete an adventurer profile at any time from Family settings.

No ads, no tracking

There is no advertising in QuestKeep, no behavioural profiling, and no third-party tracker or analytics SDK — not on the guardian surfaces and certainly not on the children's. We make no automated decisions that have legal or similarly significant effects on anyone. If we ever add product analytics, it will be cookieless and privacy-first, and this page will say so before it ships.

Where your data lives

Your family's data is stored in the European Union. The database runs in Microsoft Azure's North Europe region (Ireland), and the application and its error reports run in the West Europe region (the Netherlands).

Some providers may handle data outside the EU. Stripe may process payment data in the United States, and if staff file a Feedback note internally, a short reference — the category and an opaque ticket id, not the message you wrote — may be stored in GitHub's engineering tracker in the United States. These transfers rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

Who processes it for us

These companies process data on our behalf, under data-processing terms with each of them.

Microsoft: Microsoft Entra External ID handles guardian sign-in, email verification, and password reset — children never touch it. Azure App Service runs the application. Azure Database for PostgreSQL stores your family's data. Azure Communication Services sends QuestKeep's emails. Azure Application Insights records application errors, without names, email addresses, or IP addresses.

Stripe (Stripe Payments Europe, Limited, Ireland) runs checkout, takes payments, and keeps the subscription and its invoices. For some purposes, such as fraud prevention and its own legal duties, Stripe acts as a separate controller under its own privacy policy.

GitHub, Inc. holds a staff-only stub (category, ticket id, and app version) when an operator files a Feedback note to our private engineering tracker — the message itself stays in our EU database and is not posted there.

That is the whole list. If it changes, this page changes first.

Payments

Payments run through Stripe. A guardian subscribes on Stripe Checkout and manages the subscription — card, invoices, cancellation — in the Stripe Customer Portal, both on Stripe's own pages, so card numbers never reach QuestKeep. Stripe receives your email address, your card or other payment details, the billing details its checkout asks for, and technical data from those pages. We receive back identifiers, the plan, the subscription status and its dates, and the invoices and payments we can see in Stripe's dashboard. We use them to know whether the family's subscription is active and to handle refunds and support.

Public data we fetch from other services

Some features show public data from other services. Our server makes these requests, not your device, and they carry no name, email address, or family identifier.

The weather on the Hero's Code board comes from Open-Meteo: if a guardian turns it on, our server sends the coordinates of the chosen city, rounded to about a kilometre. Share prices in the Royal Treasury come from Twelve Data or Alpha Vantage, which receive only the ticker symbols being tracked. Exchange rates come from Frankfurter, which receives only currency codes.

Emails we send

QuestKeep sends a few account emails and never marketing: an invitation when a guardian invites another adult, and billing messages to the family's owner, for example when a payment fails or a subscription ends. They come from an address on our mail.questkeep.ro domain and are sent through Azure Communication Services. Stripe may send its own payment receipts.

How long we keep it

We keep a family's data while the account exists. Delete an adventurer profile and its data goes with it. When the family's owner deletes the family account from Family settings, its data, including every Feedback message, is removed from our live database straight away. When another guardian leaves the family, their guardian profile and the Feedback messages they sent are removed straight away; the children's data and the rest of the family stay.

Some things last longer. Database backups roll over every 14 days, so deleted data leaves them within 14 days. Error reports are kept for 90 days. A short audit record of sensitive actions — for example that a family was deleted, that a guardian left, or that someone other than the owner tried to delete the family, with the family's internal id and the guardian's sign-in identifier — is kept after deletion so we can account for what happened. A non-message staff stub on GitHub may remain after a wipe; it cannot by itself identify the family once the ticket is gone. Invoices and payment records are kept by Stripe and by us for as long as Romanian accounting and tax law requires. Account emails may sit in our email provider's logs for a short while.

If a subscription ends and the family never comes back, the locked Keep is kept so it can be reopened.

What deleting the family does not remove

Deleting the family account, which only the family's owner can do, removes the family from QuestKeep. It does not delete your sign-in account with Microsoft Entra External ID, or those of the other guardians, and neither does leaving a family. That account holds your email address and password, and you can still sign in with it — you would simply start a new, empty Keep. To have it deleted too, ask us through the contact details under Who is responsible.

It does not delete your customer record at Stripe either. Deleting the family cancels the subscription immediately, but Stripe keeps the customer, payment, and invoice records that it and we are required to keep. If cancelling the subscription fails, the deletion stops and nothing is deleted, so you are never left paying for a Keep that no longer exists.

The backups, audit record, error reports, and GitHub stub described above also remain for the periods given there.

Your rights

Under the GDPR you can ask for access to your family's data and a copy of it, ask us to correct it, ask us to delete it, ask us to restrict how we use it, object to processing based on our legitimate interests, and receive the data you gave us in a portable format. We answer within one month. A guardian exercises these rights for the children in their Keep.

You can also complain to a supervisory authority. In Romania that is the National Supervisory Authority for Personal Data Processing (ANSPDCP), at dataprotection.ro.

What you can do in the app

In the app a guardian can log every family device out remotely, reset a child's PIN, deactivate or delete an adventurer profile, and change the family's settings.

From Family settings a guardian can also download a copy of the family's data, and the family's owner — the guardian who set up the Keep — can delete the whole family account. Any other guardian can leave the family instead, which removes their own guardian profile and the Feedback messages they sent, but never the children's data. That download is the data QuestKeep holds; it is not a dump of GitHub, and it does not include Stripe's records, which you can see in the Stripe Customer Portal from Billing.

From Family settings a guardian can also send us a message.

Security

Guardian sign-in is handled by Microsoft Entra External ID, so we never see or store a guardian password. Guardian admin pages lock again after 15 minutes without use on a shared device. Child PINs are stored as argon2id hashes, with a pause after repeated wrong guesses. Every family's rows are kept apart both in the application and by PostgreSQL row-level security in the database, and the application connects to that database as a restricted, non-owner role. Traffic runs over HTTPS.

No system is perfect. If a breach puts your family's data at risk, we will notify the supervisory authority within 72 hours and tell you without undue delay when the law requires it.

Changes to this notice

When QuestKeep changes what it does with data, we change this page and the date at the top first. For a change that matters — a new processor, a new kind of data, or a new purpose — we will tell you in the app before it takes effect.