1. Controller
The data controller for personal data under this policy is legal.bodies.privacy.placeholder (legal entity and address on Imprint). Contact: privacy@questelix.com (placeholder).
2. What we collect
- Account data (email, display name) when you sign up via Supabase Auth.
- Gameplay and progress (quiz runs, mastery, streaks) stored in our database.
- Technical data (IP, device/browser, logs) for security and operation.
- Cookies and similar technologies — see Cookie Policy.
3. Purposes & legal bases (GDPR / UK GDPR)
- Provide the service (contract): account, quiz play, sync across devices.
- Payments (contract / legal obligation): subscriptions via Stripe when offered.
- Security & fraud (legitimate interests): protect users and infrastructure.
- Compliance (legal obligation): respond to lawful requests.
4. Processors & transfers
We use Supabase (EU-hosted where configured) for database and auth, Stripe for payments, and first-party product analytics (aggregated funnel events in our database when you consent). Transfers outside the UK/EEA use appropriate safeguards (e.g. SCCs) as required.
5. Your rights
You may have rights of access, rectification, erasure, restriction, portability, and objection, plus the right to lodge a complaint with a supervisory authority (EU/EEA) or the ICO (UK). Contact privacy@questelix.com.
6. AI-generated visuals
Realm cover art is disclosed as synthetic content. Machine-readable provenance is in the Digital transparency register (EU AI Act Art. 50 orientation).