Privacy Policy

1. The short version

• No ads, no tracking for advertising, no selling data. Not to advertisers, not to anyone.
• Children don't give us personal details. A parent creates each explorer profile with a nickname, a birth year and a school grade.
• No chat, no public profiles. Children only ever see their own island and their own family.
• Parents are in control. You can see, change or delete your family's information at any time.

2. Who we are

QuestIsle is operated by Pixelafy Solutions (LA0090752-W) ("QuestIsle", "we", "us"). We are responsible for the personal information described in this policy, which covers the QuestIsle website, the QuestIsle apps for iOS and Android and the Parent Dashboard (the "Service"). Please read it alongside our Terms of Service.

3. Information about parents

When you create and use a family account, we collect:

• Account details: your name, email address and password (stored only as a secure hash).
• Sign-in details: if you use Sign in with Apple or Google, the account identifier and email address they share with us. If you choose Apple's "Hide My Email", we only receive the relay address.
• Parent PIN: stored only as a secure hash, and used to keep grown-up areas away from children.
• Preferences: your country, language, notification settings and whether you have opted in to product news.
• Purchase records: what you bought, when, the store transaction identifier and its status, as reported to us by Apple or Google. Payment card details are handled entirely by the store and never reach us.
• Messages: anything you send us when you contact support.

4. Information about children

For each explorer profile a parent adds, we store:

• Profile: a display name or nickname (it does not need to be a real name), a generated avatar, birth year, school grade and age band. We do not ask for a child's full name, birth date, photo, email address, phone number, location or school.
• Settings chosen by the parent: daily play-time cap, quest target and quiet hours.
• Learning and game progress: quests started and finished, answers and accuracy, hints used, time spent, streaks, stars, XP, achievements, unlocked islands and items, and the outfit chosen for their hero.

Children cannot enter free text that is shared with anyone else, and there is no way for them to send or receive messages.

5. Information collected automatically

• Device information: device type and name, operating system, app version, and when the device was last used, so we can keep your family signed in on the right devices and let you sign them out remotely.
• Push tokens: if you allow notifications on a parent device, a token from Apple or Firebase Cloud Messaging so we can send you progress updates.
• Service logs: IP address, request times and error information, kept for security, fraud prevention and fixing bugs. We keep an audit trail of important account changes for the same reasons.
• Cookies: our website uses only the cookies needed to keep you signed in and protect forms (session and security cookies). We do not use advertising or cross-site tracking cookies, and we do not use third-party analytics. The website loads its fonts from Google Fonts, which means your browser connects to Google's servers when the page loads.

6. How we use information

We never use children's information for advertising, and we do not build profiles of children for anything other than adapting their learning inside QuestIsle.

7. Children's privacy

We handle personal data in line with Malaysia's Personal Data Protection Act 2010. Because QuestIsle is made for children aged 5 to 12, we also follow children's privacy laws in the countries where families use it, such as the US Children's Online Privacy Protection Act (COPPA) and the child-specific rules of the GDPR and UK GDPR.

• Only a parent or legal guardian can create an account and add explorer profiles. Creating the account and adding a child is how a parent gives us consent to collect the child information described above.
• We collect only what a child needs to play and learn, and nothing a child types can be seen by other players.
• Parents can review their child's information in the Parent Dashboard, ask us for a copy, change it, refuse further collection, or delete the profile at any time, without losing access to the rest of the account.
• If we learn that we have collected personal information from a child without a parent's consent, we will delete it.

If you believe a child has given us information without a parent's permission, please email [email protected].

8. Who we share it with

We do not sell or rent personal information. We share it only with:

• Service providers who run parts of QuestIsle for us, such as cloud hosting and storage, email delivery and push notifications (Apple Push Notification service and Firebase Cloud Messaging). They may only use the information to provide their service to us and must keep it secure.
• Apple and Google, when you sign in with them or buy through their stores. Their own privacy policies apply to what they collect.
• Authorities or others when the law requires it, or when it is needed to protect the safety of a child or anyone else.
• A new owner if QuestIsle is ever sold or merged, in which case this policy, or one at least as protective, will continue to apply and we will tell you first.

9. How long we keep it

• Account, profile and progress information is kept while your family account is open.
• When you delete an explorer profile or your account, we delete or anonymise the related information within 30 days, apart from short-lived backups, which are overwritten within a further 90 days.
• Purchase records are kept as long as tax and accounting law requires.
• Service and security logs are kept for up to 12 months.
• If a family account is inactive for 24 months, we will email the parent and then delete the account if we don't hear back.

10. Your choices and rights

Depending on where you live, you have the right to:

• access the personal information we hold about you and your children, and get a copy of it;
• correct information that is wrong or incomplete;
• delete an explorer profile or your whole account;
• object to, or ask us to limit, some uses of your information;
• withdraw consent, for example to product news, at any time;
• complain to your local data protection authority.

You can change most information yourself in the Parent Dashboard and turn notifications off in your device settings. You can delete your whole family account at any time from the parent area in the app (behind the parent gate) by choosing Delete account. For anything else, or if you cannot get into the app, email [email protected]. We will confirm the request comes from the account holder and reply within 30 days.

11. Keeping it safe

We protect information with encryption in transit, hashed passwords and PINs, short-lived sign-in tokens and access limited to the staff who need it. Children's devices use their own restricted tokens that cannot reach parent settings. No system is perfectly secure, so if we ever discover a breach that affects your information, we will let you know as the law requires.

12. International transfers

Our service providers may store or process information in countries other than yours. When that happens, we use safeguards required by law, such as standard contractual clauses, so your information stays protected to the standard described here.

13. Changes to this policy

If we change this policy, we will update the date at the top. If a change affects how we use children's information or is otherwise significant, we will email parents before it takes effect and, where the law requires, ask for consent again.

14. Contact us

Questions or requests about privacy? Email [email protected]. QuestIsle is operated by Pixelafy Solutions (LA0090752-W).