Effective date: September 8, 2026

QuestGrow helps families turn everyday routines into quests, progress, and parent-approved rewards. This Privacy Policy explains how QuestGrow handles information through the QuestGrow iOS and iPadOS app, the questgrow.app website, and support communications.

In this Policy, a “parent” includes a parent or legal guardian. A “Guardian profile” is the parent-managed child profile represented by a QuestGrow character; it is not a separate child account.

1. Privacy at a glance

• Parents sign in with Apple. Children do not create accounts and do not provide an email address, password, real name, or date of birth.

• A child joins a parent-managed Guardian profile with a short pairing code and can only use features the parent has enabled.

• QuestGrow does not sell personal information, show advertising, use child information for targeted advertising, or create public child profiles.

• QuestGrow does not request access to the camera, microphone, photo library, contacts, or precise location. It does not accept task-photo uploads and does not use artificial intelligence to assess a child.

• Parents can review, correct, export, withdraw consent for, or delete their family’s information.

• QuestGrow is designed to comply with the U.S. Children’s Online Privacy Protection Act and Rule (“COPPA”) where they apply.

2. Information we collect and why

Parent account information

When a parent uses Sign in with Apple, we receive an Apple account identifier and authentication information. Depending on the parent’s Apple choices, we may also receive a name and an email address or Apple private relay address. We use this information to create and secure the parent account, restore access, communicate about the service, and respond to requests.

Guardian profiles, tasks, and progress

For each Guardian profile, we process an internal profile identifier, selected character and element, task titles and schedules created by the parent, completion and approval status, XP, streaks, evolution stage, rewards, and Screen Time Bank values. We use this information to provide the family’s task and reward experience and synchronize it across paired devices.

QuestGrow uses neutral labels such as Guardian 1, Guardian 2, and Guardian 3 and does not require a child’s real name.

A parent may write custom task text. Please do not include a child’s full name, school, health information, exact location, or other sensitive details in a task title or note.

Device, pairing, and notification information

We process pairing codes, device and session identifiers, app and operating-system information, time zone, language, notification preferences, and push-notification tokens. We use these details to connect the correct family devices, maintain sessions, deliver parent-approved notifications, prevent unauthorized access, diagnose errors, and keep the service reliable. On a paired child device, these technical identifiers and notification tokens may be associated with the relevant Guardian profile so QuestGrow can synchronize the correct tasks and progress, maintain the authorized session, and deliver enabled notifications. QuestGrow does not use them for behavioral advertising or to build profiles for unrelated purposes.

Subscription information

Apple processes payments. QuestGrow and RevenueCat receive subscription-related information such as the QuestGrow account identifier, product, transaction and status events, renewal or expiration status, and limited app or device information needed to provide and restore Premium access. QuestGrow does not receive or store a full payment-card number.

Parental confirmation records

Before a Guardian profile can be enabled for child use or paired with a child device, the signed-in parent must review a direct notice and actively confirm consent. QuestGrow uses a parent-directed process that combines a server-verified App Store subscription event, the signed-in parent account, direct notice, and an explicit confirmation action. This process is intended to obtain and document verifiable parental consent before enabling child use, including where COPPA applies. For an eligible introductory trial, the consent record is tied to the server-verified subscription event that authorizes the trial period; consent is not deferred until a later renewal or charge. We record the parent account, Guardian profile, notice version, server time, confirmation method and context, and the relevant server-verified subscription event, status, and product references. We use this record to apply the parent’s choice and document when consent was given or withdrawn.

Support and website information

If a parent contacts support, we process the email address, message, attachments, and information needed to answer the request. The public QuestGrow website is intended to provide product, support, and legal information. It does not provide child accounts or public child profiles. The website host may process an IP address and basic request information to deliver and protect the site. QuestGrow will update this Policy before adding forms, advertising, or analytics that materially change those practices.

3. Children and parental choices

The child experience is designed for children ages 6–12 under the supervision of a parent. Children do not sign in, purchase subscriptions, or create independent accounts.

COPPA and children’s privacy

QuestGrow is designed to comply with COPPA where it applies. Before QuestGrow collects personal information through a child’s restricted experience, the parent receives notice of QuestGrow’s practices and must complete the parental consent process. QuestGrow gives the parent controls to review the child-related information associated with a Guardian profile, delete that information, withdraw consent, and stop future collection for that Guardian.

QuestGrow limits child-related collection to information reasonably needed to provide the parent-managed task, progress, pairing, media, and notification features described in this Policy. QuestGrow does not use child information for advertising, targeted advertising, cross-app tracking, or public profiles. The operator and contact details for parental inquiries appear in Section 9.

Before QuestGrow enables child use, it first confirms eligible trial or paid subscription access from a server-verified subscription event. The signed-in parent then sees a clear notice describing the information used for the Guardian profile, how it supports tasks and progress, the service providers involved, and the parent’s controls. Child pairing remains unavailable unless the parent checks the confirmation box and selects Confirm.

A parent can review a Guardian profile, correct information, request a copy, disconnect devices, withdraw consent, or delete the profile from the parent area or by contacting support@questgrow.app. Withdrawing consent stops future child use and revokes the related pairing, device sessions, and notifications. The parent may also request deletion of information already collected.

QuestGrow collects only the information reasonably needed for the parent-managed task and progress features. It does not offer public child profiles, social networking, child-to-child chat, behavioral advertising, or third-party marketing to children.

If you believe a child is using QuestGrow without authorization from a parent, contact us so we can investigate and, where appropriate, disable access and delete the information.

4. How we disclose information

QuestGrow does not sell personal information and does not share it for cross-context behavioral advertising. We disclose information only as needed to operate the service, follow a parent’s instructions, protect users and the service, or comply with law.

Within the family

Information in a Guardian profile is available to the signed-in parent and the child device paired to that profile. It is not visible to the public or to other QuestGrow families.

Service providers

• Supabase provides authentication, database hosting, and synchronization for parent accounts, Guardian profiles, tasks, progress, pairing, and permission records.

• Apple provides Sign in with Apple, App Store subscriptions, and Apple Push Notification service. Apple handles information under its own terms and privacy policy.

• RevenueCat helps validate subscription status and process App Store transaction events. We do not intentionally send child task titles, XP, streaks, or reward details to RevenueCat.

• Bunny.net delivers QuestGrow’s app media. It may process connection information such as an IP address, requested file, and request time. QuestGrow does not allow child uploads to Bunny.net.

• Zoho Mail processes support emails and attachments sent to support@questgrow.app.

• The website hosting provider processes basic connection and request information needed to deliver and protect questgrow.app.

We select service providers under terms intended to limit their processing to the services they provide and to require appropriate privacy and security protections. Providers may use subprocessors for those same purposes. Apple may act independently for its account, payment, and platform services.

Legal, safety, and business changes

We may disclose information when reasonably necessary to comply with law, respond to valid legal process, protect a child or another person, investigate fraud or security incidents, or establish and defend legal claims. If QuestGrow is transferred as part of a business transaction, information may transfer with the service subject to this Policy and applicable law.

5. Data retention and deletion

QuestGrow keeps information only for the period described below or as otherwise necessary for the stated purpose:

• Active family data. Parent account data, Guardian tasks and schedules, task history, progress, rewards, pairing, device and session information, parental consent records, and subscription status are kept while the family actively uses QuestGrow and the information is reasonably needed to provide, synchronize, or secure the service.

• Inactive Guardian and child data. If neither the signed-in parent nor any paired child device uses QuestGrow for 24 months, QuestGrow permanently deletes every Guardian profile and all Guardian-scoped child data for that family. This includes tasks, progress, rewards, pairings, child-device access, notifications, reminders, and parental consent records. The parent account, family record, and Apple subscription record remain so the parent can sign in and start again.

• Delete one Guardian. A parent can open Children, select a Guardian, and choose Delete Guardian & Child Data. The confirmed action withdraws consent, revokes the child session, and permanently deletes that Guardian’s child-scoped data from active systems without deleting the parent account or other Guardians.

• Delete the family account. A parent can open Settings, choose Account, and select Delete QuestGrow Account. The confirmed action permanently deletes the parent account and the entire QuestGrow family from active systems, subject only to limited records that must be retained for law, security, fraud prevention, disputes, or provider backup cycles.

• Support messages. Routine support emails and attachments are deleted from the controlled mailbox, including sent and trash folders, within 30 days after the support matter is closed. Zoho may retain recoverable copies for up to an additional 30 days after trash deletion under its recovery process.

• Media-delivery logs. Bunny.net connection logs used for media delivery and security are retained for up to 3 days. QuestGrow does not enable permanent storage or forwarding of those logs.

• Backups. Deleted information may remain in encrypted, access-restricted service backups for up to 30 days before normal overwrite. It is not restored to active use except for disaster recovery or security purposes.

Apple and other providers may retain billing, transaction, fraud-prevention, or legal records under their own obligations. Deleting a QuestGrow account does not automatically cancel an App Store subscription; the parent must manage or cancel the subscription through Apple.

6. Security and international processing

QuestGrow uses measures appropriate to the information it handles, including encrypted network connections, Sign in with Apple, restricted administrative access, row-level database controls, server-side ownership checks, short-lived pairing codes, and device and session revocation. The app uses Apple platform protections for credentials and locally cached information.

QuestGrow is operated from Türkiye. Its service providers may process information in Türkiye, the United States, the European Union, and other countries where they or their subprocessors operate. Where required, international processing is governed by applicable provider terms and recognized contractual safeguards, including standard contractual clauses where incorporated. You may contact us for information about safeguards relevant to your data.

7. Your privacy rights

Subject to applicable law, a parent may ask QuestGrow to:

• confirm whether QuestGrow processes personal information and provide access or a copy;

• correct inaccurate information;

• delete a Guardian profile or the family account;

• withdraw parental consent or refuse further collection and use of a child’s information;

• restrict or object to certain processing; or

• provide information about relevant recipients or international-transfer safeguards.

Parents can use available controls in the parent area or email support@questgrow.app. We may take reasonable steps to verify the requester and protect the family account before completing a request. Withdrawing consent does not affect processing that occurred before withdrawal.

If Türkiye’s Law No. 6698 on the Protection of Personal Data applies, you may also exercise the rights available under Article 11. You may lodge a complaint with a competent privacy or data-protection authority where applicable.

8. Changes to this Policy

We may update this Policy as QuestGrow, its providers, or legal requirements change. We will post the updated Policy with a new effective date. If a change materially affects how we collect, use, or disclose a child’s personal information, we will provide direct notice to the parent and obtain any new consent required before applying the change to that information.

9. Contact

For privacy questions, parental requests, or complaints, contact: