Privacy Policy

Who we are

inQUESTigate (the app and its server) is run by NemCorpIndustries LLC, 8127 Petoskey St, Kalamazoo, MI 49009. In this policy "we" means that operator and "you" means a player using the app.

What we collect

• Account details — your username, email address and password. The password is stored only as a bcrypt hash, never as plain text. We also record when you created the account, when you confirmed you are 13 or older, your distance units setting (metric or imperial), and when your password was last changed.
• Your location, while you play — when you check in at a stop, the app sends your phone's GPS position so the server can check you are within the stop's radius. After a check-in the app keeps sending your position every so often until you have left the stop, so we can measure how long you stayed. The "nearby" features (lunch suggestions, Quick Quest) also send your position to find stops near you. We don't store these coordinates. The server compares them with the stop and then discards them. What we keep is the result: which stop, when you checked in, how long it took you to find it, and how long you stayed.
• QR codes you scan — the scanned code is compared with the stop's code. We keep the result, not the code.
• Gameplay — the hunts you start, your progress through them, check-ins with their times, how many clues you revealed, whether you gave up on a stop, pauses, hunts you left unfinished, completed hunts and how long they took, side quest check-ins, team race results, and your leaderboard standing.
• Your opinions — star ratings, favorites and written reviews you leave on hunts.
• Groups — the private groups you join (for example through an invite code from a school or company) and your role in them.
• Featured hunts — a record, at most once a day per hunt, that a featured hunt was shown to you on the home screen.
• Partner businesses and perks — some stops are local businesses that partner with us. When a partner stop becomes your next target, when you check in there, and when you redeem a perk (with its confirmation code), we record that against your account. This is how we prevent perks from being used more than once.
• Feedback — messages you send us from the app, with up to 5 photos. We remove location and camera details (EXIF and similar metadata) from photos when they are uploaded. Only our admins can view feedback photos.
• Push notifications — if you allow notifications, your device's push token and platform (iOS or Android).
• Crash reports — if the app hits an error, it can send the error message, technical details (a stack trace), your platform and app version, and your account ID if you are logged in.
• Password reset requests — that you asked for a reset and when. Reset codes are stored only in a scrambled (hashed) form.
• Network address — your IP address is used briefly, in the server's memory only, to limit abusive traffic and repeated wrong passwords. It isn't saved to our database, and our error logs don't record it or the content of your requests.

We don't use advertising or analytics services, and we don't track you across other apps or websites.

How we use it

• To run the game: verify check-ins, track your progress, show clues, reveals and results, and keep leaderboards.
• To run private groups and team races.
• To give out partner perks fairly and show partner businesses how many players visited them.
• To send the notifications you allowed, such as an event starting.
• To answer your feedback, reset your password, fix bugs and keep the service secure.
• To improve hunts, using counts and averages such as how many players reach each stop.

Who can see it

• Other players see your username and your standing on leaderboards, and your reviews when they are published.
• Leaders of groups you join see your username, email address, role and join date in that group.
• Other members of your groups see your username and how many stops you've found during a team race, and get a notification when you find one.
• Partner businesses see only totals, such as how many players were sent their way, how many visited on each day and how many perks were used. They never see your name, username or email.
• Our admins can see account details, gameplay, feedback and crash reports so they can run the service and help you.
• Service providers: push notifications go through Expo and then Apple or Google, which receive your push token and the notification text. The server is reached through Tailscale, which carries the encrypted connection but can't read it.
• If the law requires it, or to protect players and the service, we may share information with authorities.

We don't sell your personal information or share it for advertising.

Where it's stored

The server and its database run on a computer we operate in Michigan, United States. If you play from another country, your information is sent there.

How long we keep it

• Your account and gameplay — until you delete your account.
• Backups — the database and uploaded photos are backed up automatically every 6 hours. Automatic backups are kept for up to 30 days, so information you delete can stay in a backup until that backup is removed. A second copy is kept in a separate folder on the same server and is pruned on the same 30-day schedule. Encrypted copies of the database and photos may also be stored in a private GitHub repository, where the 14 most recent are kept.
• Crash reports — kept until we have dealt with them. When you delete your account, the link between a report and your account is removed and the report itself is kept.
• Feedback — kept until we delete it, or until you delete your account.
• Password reset requests — they expire after a short time and are removed with your account.
• Quick Quests — the auto-made hunts, with their check-ins, are deleted a few days after they end.
• Server error logs — kept in size-limited files on the server. Only the current file and one older copy are kept, and older entries are overwritten as new ones are written.

Deleting your account

You can delete your account at any time in the app (Settings, then Delete account), or follow the steps at /delete-account if you can't use the app. Deleting it removes your account, progress, check-ins, ratings, favorites, reviews, group memberships, push tokens, reset requests, feedback and feedback photos, and your partner visit and perk records, straight away. Copies in backups are removed as those backups age out (see above).

Your rights

You can ask us for a copy of your information, ask us to correct it, or ask us to delete it by contacting us (below). This policy is governed by the laws of the State of Michigan. We honor these requests for every player, wherever you live, and respond within 30 days.

Children

The app is not for children under 13, and signing up requires confirming you are 13 or older. If you believe a child under 13 has an account, contact us and we'll delete it.

Security

Connections to the server are encrypted (HTTPS), passwords are stored as bcrypt hashes, admin tools are available only on our private network, and access to your information is limited to the people who run the service. No system is perfectly secure, but we work to protect your information and will tell you if a breach affects you where the law requires it.

Changes to this policy

If we change this policy we'll update the date at the top, and for important changes we'll tell you in the app.

Contact us

Questions or requests about your privacy: [email protected].