Privacy Policy

Effective 20 October 2026

Questko helps families turn chores into quests: parents set up chores and rewards, children complete them and collect coins. This policy explains what personal data Questko processes, why, and what rights you have.

1. Who is responsible

The controller of your personal data is IM Brewing Limited, Pentadaktylou 27, 1016 Nicosia, Cyprus (“we”).

For anything about your data, write to [email protected].

2. What data we process

Parents

• your name and the email address or phone number you sign in with;
• one-time sign-in codes, valid for 15 minutes;
• your family’s name and time zone (taken from the phone that created the family), your role in it, and invitations you send to other parents, including the email address or phone number you invite.

Children

• first name (or what the family calls them), age and chosen avatar, as a parent enters them;
• a nickname, if the child picks one in the app. It is unique across Questko so that friends can later find each other by it. For now nobody outside the family sees it, and a parent can remove it;
• the chores, routines, rewards and savings goal set up for them, and their progress: coins, XP, levels, streaks, badges and redeemed rewards;
• photos taken as proof that a chore is done, only for chores where a parent asks for one;
• messages in the app, such as approved chores, cheers from parents and evening reminders of what’s left to do.

Technical data

• when the app talks to our server, the server logs the IP address, the time, the address requested, and the app version and platform (Android or iOS);
• the app keeps your sign-in and your appearance settings on your device;
• if you allow notifications, a push token for each phone, which lets Google’s Firebase Cloud Messaging and Apple Push Notification service deliver them. A notification carries its text, which can include a child’s first name and the name of a chore or reward. To deliver them, the Firebase software in the app also sends Google an identifier of the app installation, the device model, the phone’s language and time zone, the system and app versions, and data on how well Firebase itself performs. Firebase stays off on a phone until notifications are allowed there. Everyone chooses their notifications in the app (a parent can also turn a child’s off), and you can turn them all off in your phone’s settings;
• on Android, the QR code scanner that children sign in with is Google ML Kit. ML Kit sends Google diagnostic data: the device model, the Android and app versions, how well scanning performs, error codes and an identifier of the app installation. It doesn’t send the camera picture or the code it reads.

3. Why we process it

• To run Questko for you, meaning sign-in, the family account, chores, rewards, photos and notifications. This is necessary to perform our agreement with you (Article 6(1)(b) GDPR).
• To keep the service secure and prevent abuse, for example by limiting how many sign-in codes can be requested. This is our legitimate interest (Article 6(1)(f) GDPR).
• To keep the QR code scanner and notifications working: Google uses ML Kit’s diagnostic data (on Android) and Firebase’s data on how it performs to keep them reliable. This is our legitimate interest (Article 6(1)(f) GDPR).

Children’s data is entered and managed by their parent or guardian, who decides what goes into the app. The only thing a child enters on their own is a nickname, which a parent sees and can remove. A child can join their family only with a QR code that a parent creates. Children can’t create an account on their own.

4. Who processes data for us

We use these providers only as far as Questko needs them:

• Hetzner Online GmbH, Germany: the server that runs Questko and stores photos;
• Neon, Inc.: the database, hosted in Amazon Web Services’ data centre in Frankfurt, Germany;
• Cloudflare, Inc.: secures and delivers the connection to our server;
• Twilio Inc.: sends sign-in codes by SMS, so it receives your phone number;
• Google LLC: sends sign-in codes by email through Gmail, so it receives your email address. It delivers notifications through Firebase Cloud Messaging, so it receives the push token, the notification’s text and what Firebase sends about the phone, described in section 2. On Android, it also receives the QR code scanner’s diagnostic data from ML Kit, described in section 2;
• Apple Inc.: delivers notifications to iPhones through Apple Push Notification service, so it receives the push token and the notification’s text.

Neon, Cloudflare, Twilio, Google and Apple are based in the USA. Transfers outside the EU rely on the EU–US Data Privacy Framework or on standard contractual clauses approved by the European Commission. Apple and Google also process data under their own terms when you download the app from their stores.

5. How long we keep it

• Account and family data, including photos: until the account, the family or the child’s profile is deleted.
• Server logs: 14 days.
• Push tokens: until you sign out on that phone, the account or child’s profile is deleted, or the notification service tells us the token no longer works.
• Sign-in codes: they expire after 15 minutes. Twilio keeps records of the SMS it sends under its own rules.
• ML Kit’s diagnostic data and what Firebase sends about the phone: Google keeps them under its own rules.
• Deleted data can stay in database backups for up to 30 days before it is overwritten.

6. Deleting your account

In the app, open Family and tap Delete account at the bottom. Deletion is immediate and can’t be undone.

• If you are the only parent in the family, the whole family is deleted with your account: the children’s profiles, chores, routines, rewards, history and photos.
• If other parents are in the family, it stays with them and only your account is deleted. If you were the family’s admin, the parent who joined first becomes admin.

You can also ask us by email at [email protected]. Tell us the email address or phone number you sign in with. We’ll check that the request is really yours, then delete the account within one month.

Deleting a child’s profile

A parent with full access can delete a child’s profile in the app: open the child from Home and tap Delete profile at the bottom. The child’s progress, history and photos are deleted, along with the chores and routines that are only theirs.

7. Your rights

Under the GDPR you can ask us for access to your data, and to correct or delete it. You can also ask us to restrict how we use it, object to how we use it, or give you a copy in a portable format. Write to [email protected], and we’ll reply within one month. You can also complain to a data protection authority, especially the one in the EU country where you live or work. Our lead authority is the Commissioner for Personal Data Protection in Cyprus (dataprotection.gov.cy).

8. Changes

If we change this policy, we’ll update the date at the top. We’ll tell you about significant changes in advance.