Privacy Policy
Last updated: 21/06/2026
Who we are
Questline ("we", "the app") is operated by Marc Andersson, based in Denmark. We are the data controller for your personal data. Contact: marclandersson@gmail.com.
What data we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Email address | Create and secure your account, sign you in, send confirmation emails | Contract — Art. 6(1)(b) |
| Password (stored hashed) | Authenticate you | Contract — Art. 6(1)(b) |
| Display name, optional avatar | Personalise the app | Contract — Art. 6(1)(b) |
| Habits, quests, schedules, progress, XP, streaks | This is the habit-tracking service | Contract — Art. 6(1)(b) |
| Sleep logs, weight (health-related) | Show sleep/wellness stats and estimate calories | Explicit consent — Art. 9(2)(a) |
| Google Calendar connection (event IDs, sync state) | Sync quests to your calendar if you connect it | Consent — Art. 6(1)(a) |
| IP address & device signals at login (Cloudflare Turnstile) | Block bots and abusive sign-ups | Legitimate interest — Art. 6(1)(f) |
We do not use advertising, analytics, or tracking cookies, and we do not sell your data.
Cookies
We set only strictly necessary authentication cookies (sb-*-auth-token) so you can stay signed in. These are exempt from consent under the ePrivacy rules. We use no analytics or marketing cookies, so there is no cookie banner.
Bot protection (Cloudflare Turnstile)
Our sign-in page uses Cloudflare Turnstile to tell humans from bots. Turnstile processes your IP address and browser/behavioural signalsfor this purpose, based on our legitimate interest in protecting the service. See Cloudflare's privacy documentation for details.
Automated processing
Questline automatically calculates your XP, levels, and streaks from your activity. This is part of the game mechanics and has no legal or otherwise significant effect on you. We do not carry out automated decision-making in the sense of Art. 22 GDPR.
Who we share data with (processors)
We use these service providers, who process data on our behalf under data-processing agreements:
- Supabase — database and authentication. Region: EU.
- Vercel — application hosting.
- Cloudflare — bot protection (Turnstile).
- Resend — sending account emails.
- Google — Google Calendar sync and Google sign-in (only if you use them).
Where any provider processes data outside the EU/EEA, transfers are protected by Standard Contractual Clauses and/or the EU–US Data Privacy Framework.
How long we keep your data
We keep your data while your account is active. If your account is inactive for 12 months, we email you a warning; if there is still no activity about 30 days later, we permanently delete your account and all associated data. When you delete your account yourself, all your data is erased immediately. Google refresh tokens are deleted when you disconnect Calendar or delete your account.
Your rights
- Access — use "Download my data" in Settings for a full JSON copy (Art. 15).
- Portability — that export is machine-readable (Art. 20).
- Rectification — edit your name, habits, quests, sleep entries, and settings in the app (Art. 16).
- Erasure — use "Delete account" in Settings to permanently delete everything (Art. 17).
- Withdraw consent — disconnect Calendar, or turn off health-data processing in Settings → Health, at any time, as easily as you gave it (Art. 7(3)).
- Restriction / objection — contact us by email (Art. 18, 21).
To exercise any right that isn't self-service, email marclandersson@gmail.com. We respond within one month.
Health data
Sleep and weight are treated as health-related (special-category) data. We only process them with your explicit consent, which you give in Settings before entering them and can withdraw at any time. If you withdraw consent, we stop processing this data and delete what we hold.
Age
Questline is intended for users aged 16 and over. We do not knowingly collect data from children under 16.
Complaints
You can lodge a complaint with the Danish Data Protection Agency, Datatilsynet, or your local supervisory authority.
Changes
We will update this notice as the app changes and post the new version here with a new date.