“Your data is sacred, hero. Here you command
what is shared and what remains hidden.”
Sage Aurelia
Version 5.0
•
Effective: September 2, 2026
Table of Contents
1. Information We Collect
2. How We Use Information
3. Information Sharing
4. Data Security
5. Data Retention
6. Your Rights
7. Regional Privacy Rights
8. Data Use Restrictions
9. Children's Privacy
10. International Transfers
11. Policy Updates
12. Contact Us
1. Information We Collect
We collect only what the Service needs to run your hero’s journey. That falls into three groups.
•
Account information: the email address, display name, and hero profile you provide when you create an account, together with your realm and Sage selections.
•
Usage data: how you use Questria: quests created and completed, progress and streak statistics, XP and achievement records, skill-tree activity, and which features you interact with.
•
Sage conversations: the messages you exchange with a Sage, which we process to generate the response and to maintain continuity across your sessions.
•
Device information: device type, operating system, and app version, for compatibility and troubleshooting.
•
Transaction records: your subscription tier, billing status, and payment history. Full card numbers are handled by our payment processor and are never stored on Questria’s systems.
2. How We Use Information
We use the information described above to:
•
Provide, maintain, and improve the Questria service
•
Personalise your hero journey, quest recommendations, and Sage guidance
•
Process payments, subscriptions, and add-on purchases
•
Send service communications such as receipts, security notices, and account alerts
•
Analyse usage patterns in aggregate to improve features
•
Detect, investigate, and prevent fraud, abuse, and security incidents
•
Comply with legal obligations and enforce our Terms of Service
We do not use your Sage conversations to train publicly available AI models, and we do not sell your personal information.
3. Information Sharing
We do not sell your personal information, and we have not done so in the preceding twelve months. We share data only in the circumstances below.
•
Service providers: vendors who process data on our behalf and under contract, in these categories: cloud hosting and database infrastructure, authentication, payment processing, AI model providers who generate Sage responses, product analytics, crash and error reporting, and email delivery.
•
Other heroes: whatever your Profile Visibility and Activity Sharing settings permit. You control both, and both default to the private setting.
•
Legal requirements: when required by law, subpoena, or court order, or where disclosure is necessary to protect our rights, safety, or property.
•
Business transfers: in connection with a merger, acquisition, or sale of assets. We will give notice before your data becomes subject to a different privacy policy.
4. Data Security
We implement industry-standard security measures, including:
•
Encryption of data in transit (TLS) and at rest
•
Secure authentication with hashed credentials and optional two-factor authentication
•
Row-level access controls so heroes reach only their own records
•
Access controls limiting employee access to production data
•
Regular security review and monitoring
No system is perfectly secure. We cannot guarantee absolute security, and you are responsible for keeping your account credentials confidential.
5. Data Retention
We keep personal data only as long as it serves the purpose it was collected for, or as long as the law requires.
•
Active accounts: we retain your account information, quest history, progress, and Sage conversations for as long as your account remains open, because they are what the Service is.
•
Deleted accounts: deleting your account removes your data immediately and permanently. This action cannot be reversed and there is no recovery window. Please export anything you want to keep first.
•
Backups: residual copies may persist in encrypted backups for a short rolling period after deletion, after which they are overwritten in the ordinary course.
•
Analytics: usage analytics are retained in aggregated or de-identified form that is no longer linked to you, and may be kept indefinitely in that form.
•
Legal and financial records: transaction and tax records are retained for the period required by applicable law, typically seven years, even after account deletion.
6. Your Rights
Wherever you live, you may:
•
Access: request a copy of the personal data we hold about you.
•
Correction: update inaccurate or incomplete information, from your profile settings or by contacting us.
•
Deletion: delete your account and its associated data.
•
Portability: export your data in a structured, machine-readable format.
•
Opt out: control analytics and marketing communications from the data controls on this page.
You can exercise the first four directly from the app: Download My Data and Delete My Account are on this page for signed-in heroes. Otherwise write to privacy@questria.io and we will respond within the time the applicable law allows. We will not discriminate against you for exercising any of these rights.
7. Regional Privacy Rights
7.1 European Economic Area and United Kingdom (GDPR)
If you are in the EEA or the UK, Questria, Inc. is the controller of your personal data. In addition to the rights above, you may object to or request restriction of processing, and you may lodge a complaint with your local supervisory authority.
We rely on these legal bases:
•
Contract: to provide the Service you subscribed to, including your quests, progress, and Sage guidance.
•
Consent: for analytics, marketing communications, and activity sharing. You may withdraw consent at any time from the data controls on this page.
•
Legitimate interests: to secure the Service, prevent fraud, and improve features, weighed against your rights.
•
Legal obligation: to retain financial records and respond to lawful requests.
7.2 California (CCPA/CPRA)
California residents may request disclosure of the categories and specific pieces of personal information we have collected, the categories of sources, the purpose for collecting it, and the categories of third parties with whom we share it. You may also request deletion or correction, and you may limit the use of sensitive personal information.
Questria does not sell personal information and does not share it for cross-context behavioural advertising, so we do not offer a “Do Not Sell or Share My Personal Information” link. You may exercise your California rights through the controls on this page or at privacy@questria.io, and you may use an authorised agent to do so.
7.3 Other jurisdictions
If your local law grants you privacy rights not listed here, contact us and we will honour them to the extent it requires.
8. Data Use Restrictions
Important Restrictions
Your use of Questria is subject to our Terms of Service, which include strict restrictions:
•
Competitive use: you may not use Questria data or concepts to create competing products.
•
AI training: you may not use any Questria content as AI training data.
•
AI replication: you may not use AI tools to duplicate Questria’s business model.
•
Commercial data use: you may not sell, license, or monetise Questria data.
•
Data scraping: you may not extract data for unauthorised purposes.
Violations may result in immediate account termination and legal action. See Terms of Service Sections 5.2 and 6 for complete details.
9. Children's Privacy
Questria is not intended for children under 13, and we do not knowingly collect personal information from them. If you are under 13, you may not use Questria. If you are between 13 and 18, you must have parental or guardian consent.
If we learn that we have collected information from a child under 13, we will delete it promptly. A parent or guardian who believes their child has provided us information may write to privacy@questria.io.
10. International Transfers
Your data may be processed in the United States and in other countries where our service providers operate. These countries may not offer the same level of data protection as your own.
Where we transfer personal data out of the EEA or the UK, we rely on appropriate safeguards, including the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum.
11. Policy Updates
We may update this Privacy Policy from time to time. The version number and effective date at the top of this page always identify the current text. We will notify you of material changes through:
•
Email notification to the address on your account
•
In-app notification
•
Prominent notice on our website
Your continued use of Questria after an update takes effect constitutes acceptance of the revised policy.
12. Contact Us
For privacy questions, or to exercise any of the rights described in Sections 6 and 7:
Questria, Inc.
Email: privacy@questria.io
Legal enquiries: legal@questria.io
“In the realm of data, you are the sovereign.
Your secrets remain your own.”