SideQuest is a small game for doing real things. It gives you one quest at a time, keeps your streak, and remembers what you have done so you can come back to it. This page explains, plainly, what that means for your data.
SideQuest is operated by Bureau St. James. We are the controller of the personal data described here. You can reach a human at hello@thesidequest.io.
When you sign in, you give us your email address. We use it to create and secure your account and to send you a sign-in link or a one-time code. There is no password to remember. We use your email to tell your quests apart from other people's, and to reach you about the service. Sign-in is handled by Supabase, our authentication provider.
You can choose a display name when you sign up. It is how you appear inside the app. You do not have to use your real name.
We store the quests you generate and complete, the dates you played, and the streak that follows from them. This is the substance of the product. We keep it so it is there when you come back.
When you ask SideQuest for a quest, the text you type is sent to our server and on to an AI provider (Anthropic's Claude API) to write the quest back to you. Please do not put anything sensitive into that box. The AI provider does not use your input to train its models.
If you choose to leave your email for news about SideQuest, we store that address for that purpose only, and you can ask us to remove it at any time.
On the iOS app, you can allow notifications so SideQuest can nudge you about a streak or a fresh quest. This is optional, it is off until you grant it, and you can turn it off at any time in your device settings.
Our server and hosting provider keep standard logs, and we may record an IP address against certain requests in order to prevent abuse and enforce rate limits. We do not build advertising or behavioural profiles from any of this.
We use a small number of service providers to run the product. They process data on our instructions and are not permitted to use it for their own purposes.
These providers are based in the United States, and your data is stored and processed there. If you are in the UK, EU, or EEA, that means your data is transferred outside your region. We rely on the European Commission's Standard Contractual Clauses, or an equivalent safeguard, for those transfers.
Backups persist for a short period after deletion and are overwritten on their normal cycle.
You can ask us to delete your account and everything in it at any time. Email hello@thesidequest.io from the address on your account with the subject Delete my account.
We will confirm receipt, and we will erase your account record, your quests, and your streaks within 30 days. Deletion is permanent and we cannot recover the data afterwards. We may retain a minimal record that a deletion request was made and honoured, which we are required to keep to demonstrate compliance.
Under the UK GDPR and EU GDPR you have the right to access a copy of your data, to correct it, to have it erased, to restrict or object to how we use it, and to receive it in a portable format. You also have the right to complain to your local data protection authority.
Our legal bases are: performing our contract with you, for running your account and storing your quests and streaks; your consent, for notifications, which you can withdraw at any time in your device settings; and our legitimate interests, for keeping the service secure and preventing abuse. To exercise any of these rights, email hello@thesidequest.io. We will respond within one month.
Under the CCPA and CPRA you have the right to know what personal information we collect and why, to request a copy of it, to ask us to delete it, to ask us to correct it, and not to be discriminated against for exercising any of those rights.
We do not sell personal information, and we do not share it for cross-context behavioural advertising. The categories we collect are identifiers (your email address and display name) and the quest activity you record. All of it is collected for the purposes described above. To make a request, email hello@thesidequest.io.
Data is encrypted in transit. Access to production systems is limited to people who need it to operate the service. No system is perfectly secure, and we do not claim otherwise. If you believe you have found a vulnerability, please write to hello@thesidequest.io and we will respond promptly.
SideQuest is intended for people aged 13 and over. We do not knowingly collect data from children under 13. If you believe a child has created an account, contact us and we will delete it.
If we change how we handle your data, we will update this page and change the date at the top. If a change is significant, a new category of data, or a new way of sharing it, we will tell account holders by email before it takes effect.
Bureau St. James
hello@thesidequest.io