Privacy Policy

Welcome to SkillQuest. We are committed to protecting your personal data and respecting your privacy. This privacy policy explains how we collect, use, and protect data when you visit our website skill-quest.app or use our SkillQuest mobile app.

This policy complies with the General Data Protection Regulation (GDPR) and Dutch and European data protection legislation.

SkillQuest is the data controller for your personal information.

### 3.1 Website Analytics

We use Vercel Analytics to collect anonymous usage data, including:

• Page views and navigation patterns
• Browser type and version
• Device information (desktop/mobile/tablet)
• Geographical location (country/region level only)
• Referral sources

Vercel Analytics operates without cookies and does not track individual users.

### 3.2 Android Alpha Updates

If you sign up for SkillQuest updates or Android alpha information, we collect:

• Email address (required)
• Name (optional)
• Platform preference (Android)

This data is securely stored in Supabase (EU servers) and used to keep you informed about SkillQuest updates.

### 3.3 Contact Forms

If you contact us via a contact form, we collect:

• Your name
• Email address
• Subject and message content

This information is sent via Resend to hello@skill-quest.app for customer support.

### 3.4 SkillQuest Mobile App

When you use the SkillQuest app, we collect app data such as:

• Account Data: Username, email, profile picture (optional)
• Skill Tracking Data: Skills, timer logs, XP, levels, streaks
• Family Mode Data: Parent-child account relationships, consent settings
• Device Data: Device ID for push notifications, app version
• Analytics: In-app usage patterns (anonymously aggregated)

All app data is stored locally on your device and optionally synchronized to our secure servers for backup and cross-device sync.

We use your data for:

• Improving User Experience: Analytics help us understand how visitors use our website
• Product Updates: Email notifications about Android testing and product updates
• Customer Support: Responding to inquiries and support requests
• App Functionality: Skill tracking, progress synchronization, family mode features
• Legal Compliance: Fulfilling legal obligations

We never sell or rent your personal data to third parties. We do not display advertisements and do not use tracking pixels.

Under the GDPR, we process your data based on:

• Consent (Art. 6(1)(a)): Waitlist registrations, contact forms, app account creation
• Legitimate Interest (Art. 6(1)(f)): Website analytics, security monitoring, service improvement
• Contractual Necessity (Art. 6(1)(b)): Providing app services you request

You can withdraw your consent at any time by contacting us.

We take the following security measures:

• HTTPS Encryption: All data transfer is encrypted
• Secure Database Access: Strict access controls and authentication
• Regular Security Updates: Systems are kept up-to-date
• Limited Access: Only authorized personnel have access to your data
• Data Minimization: We only collect what is strictly necessary

While we implement strong security measures, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

We use the following GDPR-compliant services:

| Service | Purpose | Location | GDPR Status |

|--------|------|---------|-------------|

| Vercel | Website hosting and analytics | EU/US | Standard Contractual Clauses (SCC) |

| Supabase | Database for waitlist and app data | EU servers | GDPR-compliant |

| Resend | Email delivery for contact forms | US | GDPR-compliant, SCC |

| Google Play Services | Android closed testing and app distribution | US | GDPR-compliant |

All these services have appropriate safeguards for data transfer to countries outside the EU.

### Minimal Cookie Usage

• Vercel Analytics: No cookies, completely anonymous analytics
• Strictly Necessary Cookies: Only for essential website functionality (session management)

### What We DO NOT Use

• ❌ Advertising cookies
• ❌ Third-party tracking pixels
• ❌ Social media trackers
• ❌ Cross-site tracking

You can manage cookies through your browser settings.

As an EU/EEA resident, you have the following rights:

• Right to Access (Art. 15): Request a copy of your personal data
• Right to Rectification (Art. 16): Correct inaccurate or incomplete data
• Right to Erasure (Art. 17): "Right to be forgotten" - request deletion of your data
• Right to Data Portability (Art. 20): Receive your data in a machine-readable format
• Right to Object (Art. 21): Object to processing based on legitimate interest
• Right to Restriction of Processing (Art. 18): Restrict the processing of your data
• Right to Withdraw Consent: Withdraw previously given consent

• Email us at hello@skill-quest.app with your request
• We will respond within 30 days as required by the GDPR
• Identity verification may be required for security purposes

You have the right to file a complaint with the Autoriteit Persoonsgegevens (AP) in the Netherlands if you are dissatisfied with how we process your data.

We retain your data only as long as necessary:

• Website Analytics: Indefinite (anonymized, no personal identification)
• Update Emails: Until you unsubscribe
• Contact Form Data: Maximum 2 years for customer support purposes
• App Account Data: Until you delete your account

You can request deletion of your data at any time.

### Age Requirements

• Family Mode: SkillQuest is specifically designed for families with children aged 6 years and older
• Parental Supervision: Parents/guardians must create and manage accounts for children under 16
• GDPR Compliance: We comply with GDPR requirements for processing data of minors

### Parental Controls

• Parents have full control over child accounts via Family Mode
• Parents can view, modify, and delete their children's data
• Child accounts have limited features and privacy protection by design

If we discover that we have unintentionally collected data from a child under 16 without parental consent, we will immediately delete that data. Please contact us at hello@skill-quest.app if you have concerns about this.

Some of our third-party services (e.g., Vercel, Resend) may store data on servers in the United States. We ensure that:

• All transfers are protected by Standard Contractual Clauses (SCC) approved by the European Commission
• Services comply with GDPR requirements
• Appropriate technical and organizational measures are implemented

Your primary app data is stored on EU servers (Supabase EU region).

We may update this privacy policy from time to time. When we do:

• We will post the updated date at the top of this document
• For material changes, we will send additional notification via:
• Email (for email subscribers and app users)
• Prominent banner on our website
• In-app notification (for app users)

We encourage you to review this policy periodically to stay informed.

If you have any questions, concerns, or requests regarding this privacy policy or your personal data:

We strive to respond to general inquiries within 5 business days and to formal GDPR requests within 30 days.

---