1. Information We Collect

We may collect information you provide directly, information created when you use our products, and technical information needed to operate, secure, and improve our services.

• Account information: name, email address, username, display name, and login details. Passwords are stored only as a salted hash and never in plain text. If you use Sign in with Apple, we receive the Apple-provided identifier and, if you allow it, your email (which may be Apple’s private relay address).
• Profile information: display name, chosen avatar, and (in TreasureSteps) date of birth, used to confirm you meet minimum-age requirements and to personalize the experience.
• Product activity: progress, sticker collections, submissions, app activity, completed actions, preferences, and feature usage.
• Motion & Fitness data (TreasureSteps): step count and walking/running distance, read or estimated using device motion and fitness signals — see Section 2.
• Location data (with your permission): approximate or precise location used only for location-based features when the app is open — see Section 2.
• Purchase & subscription data: transaction and subscription status, entitlements, and receipt identifiers (we never store full payment-card details — see Section 5).
• Technical data: device type, browser type, IP address, operating system, app version, crash reports, logs, and diagnostic data.
• Support data: messages you send us, screenshots, account details you choose to include, and issue history.

2. Product-Specific Information

Different Quest23 products may use different types of information depending on what the product does.

3. How We Use Information

We use information to operate Quest23 products, provide support, improve features, personalize experiences, keep accounts secure, process requests, and understand how our services are used.

• To create, secure, and manage accounts and authenticate you.
• To operate app features — including converting your steps/activity into companion progress, fuel, coins, and league standings in TreasureSteps — and to run sticker collections, customizations, quests, submissions, and content access.
• To place and validate on-map sticker packs and “find nearby places” features.
• To process in-app purchases and subscriptions and deliver entitlements and virtual items.
• To provide customer support and respond to messages.
• To improve performance, safety, reliability, design, and user experience.
• To detect, prevent, and investigate abuse, fraud, cheating, spam, technical issues, or security problems.
• To send service-related updates, product notices, or optional communications.
• To comply with legal obligations.

We do not sell your personal information.

4. Legal Bases (EEA / UK Users)

Where the GDPR or UK GDPR applies, we process personal data on the following bases: performance of a contract (providing our products), consent (e.g., location, tracking, and permission-based activity features, which you may withdraw at any time), legitimate interests (security, anti-fraud, and product improvement), and legal obligation.

5. Payments and Subscriptions

If you purchase subscriptions, digital products, virtual items, or other paid features through an app store or third-party payment provider, your payment is processed by that provider. We do not directly store your full payment card details.

For TreasureSteps, purchases and subscriptions are billed by Apple through your Apple ID and validated via RevenueCat; subscriptions are auto-renewable and can be managed or cancelled in your Apple ID settings. We may receive limited transaction information, such as purchase status, subscription status, product purchased, receipt identifiers, refund status, or billing-related support information.

6. Sharing of Information

We do not sell your personal information. We may share limited information only when needed to operate our services, comply with law, protect users, or work with trusted providers.

• Apple — Sign in with Apple, App Store purchases/subscriptions, App Tracking Transparency, and iOS permission frameworks used by TreasureSteps.
• RevenueCat — purchase validation and entitlement management.
• Map & places providers — to render maps and return points of interest for location-based features.
• Google AdMob — to serve and measure ads for non-premium users (see Section 2).
• Service providers: hosting, analytics, email, support, storage, security, and infrastructure partners.
• Legal requirements: when required by law, legal process, or government request.
• Safety and protection: to protect Quest23, our users, our products, or the public.
• Business transfers: if Quest23 is involved in a merger, acquisition, financing, or asset transfer.

We do not share Motion & Fitness data with any third party for their own purposes.

7. Cookies and Similar Technologies

Our website may use cookies and similar technologies to keep the site working, remember preferences, understand traffic, and improve performance. You can control or disable cookies through your browser settings.

8. Data Retention

We keep information only as long as needed to provide services, operate our products, comply with legal obligations, resolve disputes, prevent abuse, and maintain accurate records. We retain certain records (such as purchase and transaction records) longer where required for accounting, fraud-prevention, or legal compliance. When data is no longer needed, we delete or anonymize it. Retention periods may vary depending on the type of information and the product involved.

9. Security

We use reasonable administrative, technical, and organizational measures designed to protect information, including encryption in transit (HTTPS/TLS) and hashed passwords. No system is perfectly secure, but we work to reduce risk, protect accounts, and respond to security issues when they arise.

10. Your Rights and Choices

Depending on where you live (including under Canada’s PIPEDA, the GDPR/UK GDPR, and U.S. state privacy laws), you may have rights to access, correct, delete, export, or restrict certain uses of your personal information. You may also be able to object to certain processing or withdraw consent where consent is used. We will not discriminate against you for exercising your rights.

• In-app account deletion (TreasureSteps): you can delete your account and associated personal data from within the app at Profile → Settings → Delete Account, or by emailing the address below. Some records may be retained as described in Section 8.
• Permissions: you can grant or revoke Location, Motion & Fitness, and Tracking permissions at any time in iOS Settings.
• Marketing: you can opt out of promotional emails where available.

To make a request, contact us using the email listed below. We may need to verify your identity before completing certain requests, and we will respond within the time required by applicable law.

11. Children and Age Requirements

Quest23 products are not intended for children under 13, and we do not knowingly collect personal information from anyone under 13. If we learn that we collected personal information from a child under 13 without appropriate consent, we will take steps to delete it.

Virtual items only: TreasureSteps does not offer real-world prizes, cash, or gift cards. All in-game items — including stickers, sticker packs, coins, Wish Tokens, and Lumen customizations — are virtual, have no monetary value, and cannot be cashed out or exchanged for anything outside the app. Purchases of Wish Tokens and subscriptions are handled by Apple and are subject to Apple’s age and parental-control settings. Any use of Wish Tokens, coins, sticker packs, or Lumen customizations inside TreasureSteps is virtual-only.

12. International Users

If you access Quest23 from outside the country where our systems or providers operate, your information may be processed in other countries, including the United States. We take steps designed to protect information according to this Privacy Policy and applicable law.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If changes are significant, we may provide notice through our website, app, or other communication channels. The effective date above shows when this policy became effective; your continued use after changes take effect constitutes acceptance.

14. Contact Us

For privacy questions, support, data requests, or account-related requests, contact us at contact@quest23.com.

You can also visit our support page at quest23.com/support.

Quest23 Inc., Vancouver, British Columbia, Canada.