PRIVACY POLICY

1. Introduction

sideQuest ("we", "us", or "our") operates the platform at playingsidequest.fun and the sideQuest mobile application. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

We comply with the Nigeria Data Protection Regulation (NDPR), the General Data Protection Regulation (GDPR), and other applicable data protection laws.

2.1 Information You Provide

• Account Information: Email address, display name, username, password (hashed)
• Profile Information: Bio, location, interests, avatar image
• Age Verification: Confirmation that you are 18 years or older
• Identity Verification: ZKP verification data (via Rarimo), KYC documents (via Smile ID) — if you choose to verify
• Quest Data: Quests you create, join, or complete; chat messages; proof submissions
• Financial Data: Wallet addresses, transaction history (for blockchain features)

2.2 Information Collected Automatically

• Location Data: GPS coordinates (when you enable location sharing for map features)
• Device Information: Device type, operating system, unique device identifiers
• Usage Data: Pages visited, features used, time spent on the platform
• Log Data: IP address, browser type, access times, referring URLs

2.3 Information from Third Parties

• OAuth Providers: Google, Apple — name, email, profile picture (when you sign in with these providers)
• Blockchain Data: On-chain transaction data from Base network

We use your information to:

• Provide, operate, and maintain the sideQuest platform
• Process quest creation, participation, and completion
• Enable real-time features (map, chat, notifications)
• Verify your identity and age (when you choose to verify)
• Process financial transactions (QuestCoin, USDC)
• Send notifications about quests, friends, and platform updates
• Personalize your experience and recommend quests
• Prevent fraud and ensure platform security
• Comply with legal obligations

Location sharing is opt-in. You can enable or disable location sharing at any time from the map page. When enabled:

• Your location is shared with friends you have added (based on friend tier settings)
• Location data is used for nearby quest discovery and venue recommendations
• Travel path data is recorded during quest readiness tracking (only for quests you join)
• You can enable "Ghost Mode" to hide your location from all users

Location data is stored securely and is never sold to third parties. You can delete your location history at any time.

5. Data Sharing & Disclosure

We may share your information with:

• Other Users: Your profile information (display name, username, avatar) is visible to other users. Your location is shared with friends when you enable location sharing.
• Service Providers: Supabase (database/auth), Mapbox (maps), Firebase (push notifications), Resend (email), Africa's Talking (SMS)
• Blockchain Networks: Transaction data on Base network is public by design
• Legal Requirements: When required by law, regulation, or legal process

We do not sell your personal data to third parties.

We implement industry-standard security measures including:

• Password hashing with bcrypt
• JWT-based authentication with token expiry
• Row Level Security (RLS) on all database tables
• HTTPS encryption for all data in transit
• Regular security audits and penetration testing

While we strive to protect your information, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

Under GDPR and NDPR, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your personal data ("right to be forgotten")
• Portability: Receive your data in a structured, machine-readable format
• Restriction: Request that we limit processing of your data
• Objection: Object to processing of your data for certain purposes
• Withdraw Consent: Withdraw consent at any time where processing is based on consent

To exercise these rights, contact us at playing.sidequest@gmail.com or use the GDPR export/deletion tools in your account settings.

8. Data Retention

We retain your personal data for as long as your account is active or as needed to provide services. When you delete your account, we will delete or anonymize your personal data within 30 days, except where retention is required by law.

9. Children's Privacy

sideQuest is not intended for users under the age of 18. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. You are advised to review this Privacy Policy periodically for any changes.

11. Contact Us

If you have any questions about this Privacy Policy, please contact us:

• Email: playing.sidequest@gmail.com
• Website: playingsidequest.fun