PointQuest Privacy Policy

Last updated: October 26, 2026

PointQuest is made by Colin Robey (CR Studios), a sole developer in Burlington, Ontario, Canada. "I" and "me" in this policy means me.

1. What PointQuest Does

PointQuest is a family activity challenge app. Families create point-based fitness and activity challenges, log activities, and track progress together. The app is designed for families to use privately.

2. Information I Collect

To make the app work:

To understand how the app is used and to fix problems:

I do not collect precise location, contacts, photos, or browsing history. PointQuest does not connect to Apple Health or Google Health Connect, and does not use advertising identifiers.

3. Children's Privacy (COPPA Compliance)

PointQuest is meant to be set up and run by parents. Children under 13 should not create their own email accounts. Only a parent or legal guardian may create managed profiles for children. These profiles:

Kid mode. A child can open PointQuest on their own device by tapping "I'm a Kid" and entering their family's invite code, then choosing their profile. This creates an anonymous session with no email, password or name of its own. In kid mode a child can see their family's progress and, if a parent allows it, log activities and ask for rewards. A parent approves each log and reward request before it counts.

Starting with version 1.2.1, kid mode sends no usage analytics. Earlier versions sent usage events from kid mode tied to a random session ID, with no name or email. Crash reports are still sent from kid mode so I can fix problems, tied to the same random session ID (see Section 2 for what a crash report contains). None of this is used for advertising.

Parents must provide consent before adding any child profile, and a consent record is created each time a child is added. Parents can review and delete their child's profile and all associated activity data at any time from the app.

4. How I Use Your Data

I do not sell your data, show you ads, track you across other apps or websites, or share your information with third parties for marketing purposes.

5. Data Storage and Security

Your app data is stored in Google Firebase (Cloud Firestore), hosted in the United States. Firebase provides encryption at rest and in transit.

Access to your data is restricted by Firestore security rules:

6. Third-Party Services

7. Account Deletion

You can delete your account at any time from the More tab in the app. Account deletion permanently removes:

Usage and crash data already sent to PostHog and Sentry is tied to a random ID, not your email, and is kept under those services' standard retention periods. To have it deleted as well, email me (Section 15).

8. Data Retention

I keep your app data for as long as your account is active. When you delete your account, your app data is removed immediately as described above.

9. Your Rights

You have the right to:

10. Canadian Privacy Law (PIPEDA)

If you are located in Canada, your personal information is protected under the Personal Information Protection and Electronic Documents Act (PIPEDA). You have the right to access, correct, and request deletion of your personal information. I collect and use your personal information only with your knowledge and consent, and only for the purposes described in this policy.

11. International Data Transfers

Your data is stored and processed in the United States by Google Firebase, RevenueCat, PostHog and Sentry. By using the app, you consent to the transfer and processing of your data in the United States. These providers use EU Standard Contractual Clauses (SCCs) for transfers of personal data from the European Economic Area and United Kingdom to the United States.

12. European Union and United Kingdom Users (GDPR)

If you are located in the European Union or United Kingdom, the General Data Protection Regulation (GDPR) or UK GDPR applies to your personal data. This section supplements the rest of this Privacy Policy.

Lawful basis for processing: I process your personal data on the following legal bases:

Your rights under GDPR: In addition to the rights described in Section 9, you have the right to:

To exercise any of these rights, contact me at crstudiosdev@gmail.com. I will respond within 30 days. You also have the right to lodge a complaint with your local data protection supervisory authority.

Data transfers: See Section 11.

Retention: I keep your personal data for as long as your account is active. Deleting your account removes it, including COPPA consent records, as described in Section 7.

13. Law Enforcement and Legal Requests

I may disclose your personal data if required to do so by law, court order, subpoena, or other legal process, or if I reasonably believe that disclosure is necessary to:

Where permitted by law, I will attempt to notify affected users before disclosing their data in response to a legal request.

14. Changes to This Policy

If I make changes, I'll update the date at the top. For significant changes, I'll notify you in the app.

15. Contact

Questions about this policy? Email crstudiosdev@gmail.com.