Privacy Policy
The Hero’s Data Sanctum
“Your data is sacred, hero. Here you command what is shared and what remains hidden.”
Sage Aurelia
Version 7.4
•
Effective: September 30, 2026
Table of Contents
1. Information We Collect
2. How We Use Information
3. Information Sharing
4. Data Security
5. Safety Scanning and Human Review
6. Data Retention
7. Your Rights
8. Regional Privacy Rights
9. Consumer Health Data
10. Data Use Restrictions
11. Children's Privacy
12. International Transfers
13. Policy Updates
14. Contact Us
1. Information We Collect
We collect only what the Service needs to run your hero’s journey. Some of it is required to have an account at all. The last two groups are entirely optional, and Questria works without a single figure from either.
•
Account information: the email address, display name, and hero profile you provide when you create an account, together with your realm and Sage selections.
•
Usage data: how you use Questria: quests created and completed, progress and streak statistics, XP and achievement records, skill-tree activity, and which features you interact with.
•
Sage conversations: the messages you exchange with a Sage, which we process to generate the response and to maintain continuity across your sessions.
•
Device information: device type, operating system, and app version, for compatibility and troubleshooting.
•
Safety records: where the safety check in Section 5 matches something you wrote, a record of that match: the labels describing what matched, a confidence level, and the session it came from, but never the message itself.
•
Camera, photo library, microphone, and voice: if you grant permission, the video clips you record and the photographs you take or choose from your library to share with other heroes, an image you attach to a support message, and the audio you dictate when you speak instead of typing, to a Sage, to Selene or the Council, in a quest reflection or in a mentor conversation. We reach the camera, the library and the microphone only while you are recording, choosing or dictating, and you can withdraw the permission at any time in your device settings. A photograph you attach to a quest or a post is uploaded to our servers. A progress photograph, described in Section 9, never is.
•
Transaction records: your subscription tier, billing status, and payment history. Full card numbers are handled by our payment processor and are never stored on Questria’s systems.
•
Health and wellness information (optional): figures you choose to record about your body and your habits: body weight, body fat, waist measurement, resting heart rate, best lifts, training sessions a week, sleep hours, a dietary pattern, staple and avoided foods, and any injury you are working around. Every field is optional, every field can be cleared, and clearing one deletes the value. Section 9 is the full policy for this category and it has its own page.
•
Financial information (optional): an income band and a savings rate, as a band and a percentage. Never an account number, never a balance, never a national identity number, and never a document. There is no field anywhere in Questria that could hold one.
Every optional figure above is stored as a number inside a checked range or as a key from a fixed list. There is no free-text health or financial field, which is a constraint on the shape of the data rather than a rule we ask anyone to follow.
2. How We Use Information
We use the information described above to:
•
Provide, maintain, and improve the Questria service
•
Personalise your hero journey, quest recommendations, and Sage guidance
•
Process payments, subscriptions, and add-on purchases
•
Send service communications such as receipts, security notices, and account alerts
•
Analyse usage patterns in aggregate to improve features
•
Detect, investigate, and prevent fraud, abuse, and security incidents
•
Check messages for signs of crisis or serious harm, and alert our team so a person can respond, as described in Section 5
•
Comply with legal obligations and enforce our Terms of Service
We do not use your Sage conversations to train any AI model, ours or anyone else’s, and our model provider does not train on them either. We do not sell your personal information.
What we keep from a model call is an operational record: which model answered, how long it took, how many tokens it used, and a one-way fingerprint of the prompt. Never the prompt itself and never the reply. Those records are deleted after 180 days and with your account, and they are included in your data export so you can read what is held rather than take our word for it.
3. Information Sharing
We do not sell your personal information, and we have not done so in the preceding twelve months. We do not share it for cross-context behavioural advertising. What we do is narrower, and we would rather write it plainly than hide it inside the word private: personal data is disclosed only to processors acting on our instructions under a written contract, and to the three other recipients listed below.
•
Processors: named individually on our sub-processor page, with what each one receives and why. Three are worth knowing about. Anthropic, whose Claude models generate every Sage reply, every month of quests and every skill tree: your message to a Sage reaches them, along with any optional figures you have recorded that the Sage is allowed to see. OpenAI, which turns a recording into text when you speak instead of typing, and draws the future-self pictures you ask for: it receives the recording, or the one photograph you choose, for that request alone. And Google, which receives a copy of your hero’s record only if you choose Export to Google Docs in the Data Vault.
•
Other heroes: whatever your Profile Visibility and Activity Sharing settings permit. A victory you write yourself gets its room chosen each time: a story can go to the whole Gathering, to your friends only, or stay with you alone, and a quest you reflect on can go to the Gathering or to your friends, or not be shared at all. The Gathering also keeps its own record of victories such as a level gained, a legend earned, a streak kept or a path of your skill tree completed. Those take your default room, and there is no room to choose on each one: the default is the Gathering, where every Dreamer can read it, and turning Activity Sharing off, or setting your profile to Private, makes friends the default instead. Any of those records can be removed from the Gathering at any time by opening the victory and choosing Remove this victory. Your health and financial figures are outside this entirely: they reach no other hero, no mentor and no guild, ever.
•
Legal requirements: when required by law, subpoena, or court order, or where disclosure is necessary to protect our rights, safety, or property.
•
Business transfers: in connection with a merger, acquisition, or sale of assets. We will give notice before your data becomes subject to a different privacy policy.
4. Data Security
We implement industry-standard security measures, including:
•
Encryption of data in transit (TLS) and at rest
•
Secure authentication with hashed credentials and optional two-factor authentication
•
Row-level access controls so heroes reach only their own records
•
Access controls limiting employee access to production data
•
Regular security review and monitoring
No system is perfectly secure. We cannot guarantee absolute security, and you are responsible for keeping your account credentials confidential.
5. Safety Scanning and Human Review
Questria checks what you say to a Sage for signs that you may be in danger, and a person may be told when it finds them. This section sets out exactly what that involves, because it concerns your conversations.
5.1 What is checked
Messages you send to a Sage are checked against a list of language patterns, both in the app and again on our servers when the message is processed. The same check runs on conversations with Selene, Zion, and the Council, and on captions you attach to a social video. We do not send your messages to an outside moderation company for this.
The check looks for language suggesting suicide or self-harm, requests involving illegal activity, violence, hate, child sexual abuse, or malware, and attempts to manipulate a Sage’s instructions.
5.2 What happens when something matches
If the language suggests a crisis, the Sage responds with crisis support resources, and Questria shows you a support banner in the app for the next 48 hours. Other matches may cause a Sage to decline a request.
A crisis match also does the following, so that a person can respond:
•
Creates a flag for review, marked critical
•
Creates a review task for our team, and an automatic follow-up task 24 hours later
•
Sends an alert to our administrators by in-app notification, push notification, and email
•
Adds a note to your hero record saying the crisis protocol ran
5.3 What is recorded, and what is not
A flag, an alert, and a note record your hero identifier, the conversation session, which product the message came from, a confidence level, the time, and short labels describing what matched. Those labels are fixed descriptions such as “self-harm intent” or “despair language”. Your display name appears in the alert so our team knows who needs help.
None of these records contains your message. We do not copy the text you wrote into a flag, an alert, a note, or an email, and the labels are not quotations from you. Where a flag stores a reference to the message at all, it stores a one-way hash, which cannot be turned back into what you wrote.
5.4 Who reviews it, and what they can see
Administrators at Questria, Inc. review flags in an internal console. They see what Section 5.3 describes, record a note about what they found and did, and may resolve, dismiss, or escalate the flag. They may also act on your account under our Terms of Service.
They cannot read your Sage conversations. Access to conversation content is restricted to your own account in the database itself, and no administrator or staff role can read it. A reviewer sees that something matched and what kind of thing it was, not what you said.
5.5 Why we do this, and how long it is kept
We do it to protect people using Questria, and in a crisis to protect life. Flags, review tasks, and the note on your record are kept while your account is open and are deleted with it, as described in Section 6.
This scanning is not a monitoring service and not an emergency service. It runs on patterns, so it misses things and it raises false alarms. Nobody watches your conversations in real time, and a review may not happen immediately. If you are in danger, contact your local emergency number or a crisis line.
6. Data Retention
We keep personal data only as long as it serves the purpose it was collected for, or as long as the law requires.
•
Active accounts: we retain your account information, quest history, progress, and Sage conversations for as long as your account remains open, because they are what the Service is.
•
Deleted accounts: deleting your account removes your data immediately and permanently, and every photograph and clip you posted is queued for deletion at the same moment and removed from our storage shortly afterwards, normally within the hour. This action cannot be reversed and there is no recovery window. Please export anything you want to keep first. A Google Doc you made with Export to Google Docs in the Data Vault is not removed with your account: it lives in Google Drive, and to have it deleted you write to privacy@questria.io.
•
Backups: residual copies may persist in encrypted backups for a short rolling period after deletion, after which they are overwritten in the ordinary course.
•
Analytics: usage analytics are retained in aggregated or de-identified form that is no longer linked to you, and may be kept indefinitely in that form.
•
Safety records: flags, review tasks, and crisis notes created under Section 5 are kept while your account is open and are deleted with it.
•
Legal and financial records: transaction and tax records are retained for the period required by applicable law, typically seven years, even after account deletion.
•
Model call records: the operational record described in Section 2, which holds no prompt and no reply, is deleted after 180 days or with your account, whichever comes first.
•
Documents you upload: zero seconds. A document is read in a single pass, in memory, and is never written to storage, never written to a database row, never written to a temporary file on our servers, and never attached to a log entry. Only the small set of figures you confirm is kept, and only because you confirmed them. Section 9 sets this out in full.
•
Recordings you dictate: none on our servers. A recording goes to OpenAI once, in the request that turns it into text, and is never written to our storage, to a database row or to a log. The text comes back to the box you were typing in and is kept only if you send it, like anything you type.
•
Photographs and clips you post: a clip leaves the feed about 48 hours after it appears there. A photograph is shown for as long as its post exists, and deleting the post takes it out of the feed at once and removes the file from our storage shortly afterwards. Until a person has reviewed a photograph, only you can see it, and the same hold applies to a clip if you have told us you are under 18.
7. Your Rights
Wherever you live, you may:
•
Access: request a copy of the personal data we hold about you.
•
Correction: update inaccurate or incomplete information, from your profile settings or by contacting us.
•
Deletion: delete your account and its associated data.
•
Portability: export your data in a structured, machine-readable format.
•
Opt out: set your profile visibility, activity sharing, usage analytics, and marketing email from the data controls on this page. An analytics opt-out takes effect immediately and follows your account to any device.
You can exercise the first four directly from the app: Download My Data and Delete My Account are on this page for signed-in heroes. Otherwise write to privacy@questria.io and we will respond within the time the applicable law allows. We will not discriminate against you for exercising any of these rights.
8. Regional Privacy Rights
8.1 European Economic Area and United Kingdom (GDPR)
If you are in the EEA or the UK, Questria, Inc. is the controller of your personal data. In addition to the rights above, you may object to or request restriction of processing, and you may lodge a complaint with your local supervisory authority.
We rely on these legal bases:
•
Contract: to provide the Service you subscribed to, including your quests, progress, and Sage guidance.
•
Consent: for product analytics, for activity sharing with other heroes, and for marketing email where the law requires opt-in. You may withdraw consent at any time from the data controls on this page.
•
Legitimate interests: to secure the Service, prevent fraud, and receive crash reports so that faults can be found and fixed, weighed against your rights.
•
Vital interests: to act on language suggesting your life or health may be at risk, as described in Section 5.
•
Legal obligation: to retain financial records and respond to lawful requests.
On the web we ask before we store anything for analytics. Until you accept, no analytics identifier is written to your browser and no usage is collected. If you decline, or if you later switch Analytics & Improvement off above, collection stops and the identifier is deleted from your browser. Crash reporting is separate and runs without consent because it keeps the Service working: on the web it stores nothing on your device, carries no analytics identifier, and does not track you between visits.
8.2 California (CCPA/CPRA)
California residents may request disclosure of the categories and specific pieces of personal information we have collected, the categories of sources, the purpose for collecting it, and the categories of third parties with whom we share it. You may also request deletion or correction, and you may limit the use of sensitive personal information.
Questria does not sell personal information and does not share it for cross-context behavioural advertising, so we do not offer a “Do Not Sell or Share My Personal Information” link. You may exercise your California rights through the controls on this page or at privacy@questria.io, and you may use an authorised agent to do so.
8.3 Other jurisdictions
If your local law grants you privacy rights not listed here, contact us and we will honour them to the extent it requires.
9. Consumer Health Data
Some of what Questria can record is health data under Washington’s My Health My Data Act, Nevada Senate Bill 370, and the sensitive personal information rules in several other states: body measurements, sleep, diet, injuries, and anything a Sage infers about your health from them. That category has its own full policy, at its own address, because those laws ask for a separate document rather than a section inside this one.
The short version. Every health field is optional and Questria works without any of them. Nothing is collected until you give consent specifically for health data, separately from accepting the Terms. Withdrawing that consent deletes the values rather than hiding them. A document you upload is read once and discarded, and only figures you confirm on screen are ever stored. Progress photographs, the ones you take to track your own body, stay on your device, are never uploaded and are never sent to a model. A photograph you attach to a quest or a post is a different thing: it is uploaded, looked at by a person, and shown to other heroes, and Section 2 and the Terms describe it. We do not sell health data, we do not use it for advertising, and it reaches no other hero.
10. Data Use Restrictions
Important Restrictions
Your use of Questria is subject to our Terms of Service, which include strict restrictions:
•
Competitive use: you may not use Questria data or concepts to create competing products.
•
AI training: you may not use any Questria content as AI training data.
•
AI replication: you may not use AI tools to duplicate Questria’s business model.
•
Commercial data use: you may not sell, license, or monetise Questria data.
•
Data scraping: you may not extract data for unauthorised purposes.
Violations may result in immediate account termination and legal action. See Terms of Service Sections 5.2 and 6 for complete details.
11. Children's Privacy
Questria is not intended for children under 13, and we do not knowingly collect personal information from them. If you are under 13, you may not use Questria. If you are between 13 and 18, you must have parental or guardian consent. In the European Economic Area and the United Kingdom, where the age of consent for data processing is set locally between 13 and 16, the higher local age applies to you instead.
We do not collect health measurements from anyone under 18. Body weight, body fat, waist measurement, dietary pattern, food lists and injury records are refused for heroes aged 13 to 17, and the refusal is enforced in our database rather than by a check inside the app, so it holds however the request arrives. A hero under 18 keeps everything else: their realm, their Sage, their whole month of quests, their skill tree and their progress. Only the body composition fields are closed to them. The reason is plain, and Section 9 states it: adolescents are the group most at risk of harm from a product that invites them to record a weight and watch a line move.
If we learn that we have collected information from a child under 13, or health data from anyone under 18, we will delete it promptly. A parent or guardian who believes their child has provided us information may write to privacy@questria.io.
12. International Transfers
Your data may be processed in the United States and in other countries where our service providers operate. These countries may not offer the same level of data protection as your own.
Where we transfer personal data out of the EEA or the UK, we rely on appropriate safeguards, including the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum.
13. Policy Updates
We may update this Privacy Policy from time to time. The version number and effective date at the top of this page always identify the current text. We will notify you of material changes through:
•
Email notification to the address on your account
•
In-app notification
•
Prominent notice on our website
Your continued use of Questria after an update takes effect constitutes acceptance of the revised policy.
14. Contact Us
For privacy questions, or to exercise any of the rights described in Sections 7 and 8:
Questria, Inc.
Email: privacy@questria.io
Legal enquiries: legal@questria.io
“In the realm of data, you are the sovereign. Your secrets remain your own.”