Privacy policy · VoidQuest

1. Controller

The controller responsible for data processing under the GDPR is:

Christian Romeni Holzwasen 11 73087 Bad Boll Germany Email: datenschutz@voidquest.app

We are not legally required to appoint a data protection officer. The address above handles every privacy matter.

2. Overview and scope

VoidQuest is a family app in which parents shape their children's day as quests, give coins and manage rewards. This policy covers:

the app VoidQuest (iOS and Android, Android package com.voidmind.voidquest) with its views for parents, kids and fans,
the app VoidQuest Kids (iOS and Android, Android package com.voidmind.voidquest.kids),
the web admin in the browser at voidquest.app, the public pages there and the related interface (API).

VoidQuest Kids is a separate, slim app for a kid's device. It contains only the kid sign-in and the kid's view. A kid signs in there with a QR code or a PIN that a parent creates in VoidQuest, for a kid profile the parents created beforehand. VoidQuest Kids creates no account of its own and collects no data that the kid's view in VoidQuest does not also process. Everything this policy says about the kid's view and the kid profile applies to VoidQuest Kids in the same way.

Our principle: we process as little data as possible. Neither app contains advertising or any advertising, analytics or tracking SDK, and neither uses an advertising ID; we run no analysis of usage of our own. On Android devices, Google's component in the QR scanner sends its own diagnostic and usage data to Google (section 3.12). The family's data is stored in our database on European servers (Cloudflare, region weur, Western Europe); short lived technical copies of some details sit for seconds up to a few days in Cloudflare's globally distributed cache (section 3.4). Services from Expo, Google and Apple take part in notifications, the QR scanner and purchases in the parent app; sections 3.5, 3.10, 3.12 and 5 say which data they receive. Kids have no email address of their own in VoidQuest and sign in with a QR code or a PIN from a parent's device.

3. What data we process

3.1 Parent account

email address, for signing in with a sign-in link
display name (freely chosen, for example "Mum")
the family's name, time zone and first day of the week
notification settings per channel and the app language
the family's settings for albums, stickers and gifts, and the sticker packs the parents have unlocked
for a purchase of VoidQuest Plus, the purchase details, see 3.10

3.2 Fans

Grandparents or other people the parents invite can follow a kid's progress as a fan (of the kind "family" or "companion"). For this we process:

email address (for the invitation by sign-in link) and display name
which kids a fan may see (the parents can withdraw this at any time)
reactions the fan sends: a predefined emoji and an optional short message of congratulations (at most 200 characters) on something the kid did

3.3 Kid profile

Only a parent creates a kid profile, in VoidQuest or in the web admin. Further data arises when the kid uses the app. We process:

display name (for example the first name or a nickname, set by the parents)
avatar: an emoji or the character the kid puts together from parts in the avatar workshop (we store the choice of character and parts, never a photo)
date of birth (optional, added by the parents; kept internally for later age adjustments and never public)
No email address. Kids have no account of their own; signing in on the kid's device, in VoidQuest as in VoidQuest Kids, works only with a QR code or a six digit PIN that the parents create on their device. The QR code and the PIN are valid for 10 minutes: for that long the six digit PIN, together with the reference to the kid profile, sits in Cloudflare's cache (section 3.4), and it is deleted when it is used or when it expires.
The kid's activity and behaviour history. This is the most sensitive data set and concerns the kid's daily life. In detail:
- the quests created for the kid (title, icon, time window, coins)
- every check-in ("I did it") with time stamp, punctuality and whether it fell inside the time window
- short notes the kid writes with a late claim ("I was on time") or when skipping a quest
- the complete, continuously kept coin history (spendable coins and all-time coins) as an unchangeable ledger
- streaks (days in a row), streak shields, and weekly and monthly goals
- achievements reached
- requested and fulfilled rewards with status and cost
- exceptions and pauses the parents enter for the kid, with an optional note
- stickers and albums: which stickers the kid got with coins and stuck in, and which avatar workshop parts it put on
- gifts: stickers the parents give a kid or that siblings give each other (when the parents allow it), each with a sender
- reactions received from fans (emoji and optional short message)
push token of the kid's device (if notifications are on), see 3.5

Data that stays within the family: quests, check-ins, notes, coins, rewards, the avatar workshop character, stickers, albums, gifts and reactions are visible only to members of the same family, and only as far as the parents decide: a fan sees only the kids the parents have shared with that fan. There are no public profiles, no search for other families and no exchange with people outside the family.

3.4 Authentication and security data

Server side session tokens (refresh tokens), stored as a SHA-256 hash, never in plain text. For each session we record the IP address and the browser or app identifier (user agent) to detect stolen sessions.
The short lived access token (valid for one hour) and the refresh token (90 days) are kept on the device only in the encrypted system storage.
Personal access tokens: parents can optionally create long lived tokens that let their own scripts or AI tools use the interface. We store only a hash, an eight character prefix, a name, the permissions, and the creation and last use time. Tokens can be revoked in the settings at any time.
Security log (audit log): sign-ins, sign-outs, token renewals, failed sign-ins, connecting kid devices and important changes to the account and the family, each with time stamp, IP address and user agent, and for sign-in attempts partly with the email address entered. The entries contain technical identifiers, such as those of the member and the family. It serves only to prevent abuse and fraud.
Cache (Cloudflare KV): for sign-in and operation, some details sit briefly in Cloudflare's key value store, which is distributed worldwide. These are the family's name and time zone (60 seconds), the email address for a sign-in link (15 minutes), the PIN and the identifiers of the kid and the family when connecting a kid's device (10 minutes), and for an invitation the email address, the display name and the identifiers of the family, the inviting parent and, for a fan, the kids shared with them (7 days). In addition: when a new family is created, the email address for the setup (60 minutes); when an email address belongs to several households, the email address for choosing the household (5 minutes); per family, a list of open invitations with email address, display name and role (7 days); counters per IP address that limit the number of requests, when a sign-in link is requested or redeemed, when a session is renewed or ended, when a kid's device is connected, for an invitation, when a family is created, when a household is chosen or switched, and for error reports from the app (one minute each). The entries then expire automatically; links, codes and invitations that have been used are deleted at once.
App lock: if parents turn on the app lock, the PIN (as a salted hash) and the setting for fingerprint or face recognition stay on the device only. The operating system performs the biometric check; we receive no biometric data.

3.5 Notifications (push)

If you allow notifications, the app gets a push token for the device from Expo's push service. On Android devices, Firebase Cloud Messaging (Google) issues a device token for this and uses the Firebase installation ID, a random identifier of the app installation; on iOS devices, Apple (Apple Push Notification service) issues the device token. For each device we store the push token, the platform (iOS or Android) and an optional device name.

For a notification, our server sends the push token, a title and a short text to Expo, Expo passes them on to Google or Apple, and they deliver them to the device. The text can contain names and content from the family: a kid's name, the title of a quest or reward, a fan's name and the text of their reaction, the sender of a gift or the name of an achievement. Quest reminders are also scheduled by the app directly on the device; these never leave the device.

3.6 Enquiries through the form on voidquest.app

The public pages (voidquest.app) offer a form for signing up to the closed test or for getting in touch as an illustrator. We collect only what you enter yourself:

name
email address (so that we can answer; for a test sign-up also to add you to the test)
your message (optional)
the topic of the enquiry (test or illustration)
for a test sign-up, the platform of your phone (Android or iOS)

Purpose and legal basis: we process these details to answer your enquiry. For a sign-up to the closed test we also use your email address to add you to the test: for Android we enter it in the Google Play Console as a tester so that you can install the app from the Play Store; for iOS we invite you to TestFlight through App Store Connect, and Apple sends you the invitation at this address. We do not use the details for any other purpose. The legal basis is your consent, which you give with the checkbox in the form (Art. 6(1)(a) GDPR). You can withdraw it at any time at datenschutz@voidquest.app; processing up to the withdrawal remains lawful.

Path of the data: the details are not stored in our database. They are put together directly into an email to hallo@voidquest.app and delivered by our email provider Resend (region eu-west-1, Ireland, see section 5). Your email address is set as the reply address in the message so that an answer reaches you directly.

Retention: the enquiry is kept as an email in our mailbox and is deleted once it has been dealt with and no legal retention duty applies, at the latest after twelve months. You can ask for deletion at any time at datenschutz@voidquest.app.

Protecting the form: to prevent abuse, we limit the number of enquiries and attempts per IP address. Counters for the IP address are kept in a cache (Cloudflare KV) for one hour and then expire automatically. Before sending, Cloudflare Turnstile checks that a human fills in the form (section 3.8). The purpose of these measures is to block automated enquiries and injected code; the legal basis is our legitimate interest in doing so (Art. 6(1)(f) GDPR). The consent you give in the form covers only handling your enquiry, not these protective measures.

Log of rejected enquiries: if we reject an enquiry because it does not come from our page, failed the security check, has a field filled in that humans cannot see, contains characters that are not allowed or exceeds the limit, we write a line about it into our server's log (section 3.7). It records the reason for the rejection, your IP address, your browser's identifier (user agent), the topic and language of the enquiry and, for characters that are not allowed, the names of the affected fields. Your message and your email address never go into the log. Purpose and legal basis are the same as for protecting the form (Art. 6(1)(f) GDPR). Like the whole log, the line is kept for at most seven days and then deleted automatically (section 3.7).

3.7 Server and connection data

Cloudflare, our hosting provider, automatically processes IP addresses and request metadata when the app and the interface are used, for delivery and security (edge logs). Cloudflare deletes this data after a short period, and we do not analyse it. Details: Cloudflare privacy policy.

Our server's log: our server writes technical error and security messages into a log at Cloudflare (Workers Logs), for example when sending an email fails or an enquiry from the form is rejected (section 3.6). We keep no log of every single request with address and origin. Depending on the occasion, a message contains the IP address, the browser's identifier (user agent) or an internal identifier of the affected account, but no content such as messages, email addresses or coin balances. The purpose is safe and error free operation and preventing abuse; the legal basis is our legitimate interest in this (Art. 6(1)(f) GDPR). Cloudflare keeps the log for at most seven days (three days on the free plan) and then deletes it automatically.

3.8 Security check with Cloudflare Turnstile

We use Cloudflare Turnstile when you sign in to the web admin and in the form on voidquest.app. Turnstile checks that a human and not an automated program is using the page. For this your browser loads a script from challenges.cloudflare.com, and Cloudflare evaluates technical features of the connection and the browser, including the IP address, the browser's identifier (user agent), features of the encrypted connection and signals from the check in the browser. Most of the time the check runs without you doing anything; only when in doubt does Turnstile ask you to tick a box. The result is a short lived proof that our server has Cloudflare confirm, together with your IP address. Turnstile sets only cookies needed to detect bots, no advertising cookies, and builds no advertising profiles.

Cloudflare's two roles: to protect our sign-in and our form, Cloudflare processes this data on our behalf (data processing, section 5). In addition, Cloudflare uses the signals from the check as a controller in its own right to improve Turnstile and bot detection in general. Cloudflare itself is responsible for that use; details are in the Cloudflare Turnstile privacy notice.

Legal basis for our use of Turnstile: our legitimate interest in protecting the sign-in and the form from automated abuse (Art. 6(1)(f) GDPR).

3.9 Feedback form

At voidquest.app/feedback there is a feedback form for the participants of the closed test. Purpose: we learn how VoidQuest works in family life and improve the app with it. We collect only what you enter yourself:

three ratings from 1 to 5 (daily life with VoidQuest, how much the kid likes using the app, how easy it is to find your way as a parent)
ticked answers: what helped, what got in the way, how the kid uses VoidQuest
the age of the kids in age groups (optional)
a message (optional)
an email address for follow-up questions (optional)
the language of the form (German or English)

Voluntary and anonymous: filling in the form is voluntary and has no effect on taking part in the test. We store the answers without a name, without an IP address, without a browser identifier and without a link to an account or a family. Only the message and the email address can be personal, and both are optional. Without an email address the form reaches us anonymously.

Legal basis: for evaluating the answers, our legitimate interest in improving the app (Art. 6(1)(f) GDPR). For the email address, your consent, which you give by entering it (Art. 6(1)(a) GDPR); we use it only for follow-up questions about your feedback. You can withdraw consent at any time at datenschutz@voidquest.app; processing up to the withdrawal remains lawful.

Storage and path of the data: the answers are stored in our database at Cloudflare (D1, region weur, Western Europe, see section 5). In addition, our server puts them together into an email to hallo@voidquest.app, delivered by our email provider Resend (region eu-west-1, Ireland); an email address you entered is set as the reply address.

Retention: we delete the message and the email address from the database automatically twelve months after sending. The ratings and ticked answers remain without any personal reference and are used only in summarised evaluations. The email to hallo@voidquest.app contains all answers of the form, including the message and email address. We delete these emails from the mailbox by hand, at the latest twelve months after they arrive. You can ask for earlier deletion at any time at datenschutz@voidquest.app.

Protecting the form: as with the form in section 3.6, we limit the number of forms and attempts per IP address (counters kept for one hour in the Cloudflare KV cache), check with Cloudflare Turnstile that a human fills in the form (section 3.8), and on a rejection write a line into our server's log (section 3.7) with the reason, the IP address, the browser's identifier and the language, without the message and without the email address. The legal basis is our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR).

3.10 Purchases of VoidQuest Plus

In the VoidQuest app, parents can buy VoidQuest Plus for the family, as a subscription or as a one time licence. The purchase runs through Google Play or Apple's App Store and can be reached only in the parents' view after they sign in. The kids' view, the fans' view and VoidQuest Kids contain no purchases.

Payment data stays with Google and Apple. We do not receive the payment method, name or billing address of your store account. After a purchase, the app hands the purchase receipt to our server; the server has it verified by Google (Google Play Developer API) or Apple (App Store Server API) and acknowledges it with Google. For this we store:

the purchase identifiers: the store's order or transaction number and the Google Play purchase token or Apple's original transaction number
the platform, the product bought and the plan
the status: time of purchase, expiry date, whether a subscription renews, a refund, and the state of the acknowledgement with Google
the family the purchase is credited to

The purchase identifiers stay on our server; the family's devices receive the state of Plus (plan and term) without these identifiers. You manage and cancel a subscription in your Google Play or Apple account. Purpose and legal basis: performing the purchase contract (Art. 6(1)(b) GDPR), and for keeping the receipts also the obligations of commercial and tax law (Art. 6(1)(c) GDPR). Google and Apple are controllers in their own right for the payment itself; their privacy policies apply.

3.11 Error reports from the app

If a screen of the app crashes or a task in the background fails, such as renewing the sign-in, the app sends an error report to our own server. No outside crash reporting service is involved. A report contains the app version, the platform (iOS or Android), the operating system version, the screen where the error happened, and the error's name, message and stack trace. If the device is signed in, we add the family's identifier and the role (parent, kid or fan), never the identifier of an individual member. Before sign-in, the report has no link to any family. Purpose and legal basis: finding and fixing errors, our legitimate interest in an app that works (Art. 6(1)(f) GDPR). Retention: 90 days, after which our server deletes the reports automatically.

3.12 Camera and QR scanner

Both apps use the camera only to read the QR code for connecting a kid's device, and only with your permission. The camera image is analysed on the device; images are neither stored nor sent to us. On Android devices, Google's ML Kit library recognises the QR code. ML Kit works on the device but sends diagnostic and usage data to Google, such as details about the device and the app, performance metrics and error codes, together with an identifier of the installation. Google uses this data to run and improve ML Kit; details are in Google's ML Kit data disclosure. On iOS devices, the operating system recognises the code.

4. Purposes and legal bases

Providing the service (managing accounts, quests, check-ins, coins, streaks, rewards, sync): Art. 6(1)(b) GDPR (performance of the user contract) with the parents.
Processing the kid's data (profile, date of birth, activity and behaviour history): Art. 6(1)(a) in conjunction with Art. 8 GDPR, consent of the holder of parental responsibility. For how this works, see section 8.
Authentication and security (sign-in link, PIN and QR code, session and audit data, rate limits, the Cloudflare Turnstile check, the server log with the rejected form enquiries): Art. 6(1)(f) GDPR (legitimate interest in securing the family accounts and preventing abuse).
Notifications (quest reminders, confirmations and reactions): Art. 6(1)(a) GDPR (consent, which you can withdraw at any time in the device settings).
Sending system emails (sign-in link, invitations): Art. 6(1)(b) GDPR, or point (a) for invitation emails to third parties.
Enquiries through the form on voidquest.app (name, email address, platform, message): Art. 6(1)(a) GDPR (consent through the checkbox in the form). Protecting the form from abuse falls under authentication and security. For details see section 3.6.
Feedback form (ratings, ticked answers, optionally a message and an email address): Art. 6(1)(f) GDPR (legitimate interest in improving the app), for the email address Art. 6(1)(a) GDPR (consent by entering it). For details see section 3.9.
Purchases of VoidQuest Plus (verifying and crediting the purchase, purchase receipts): Art. 6(1)(b) GDPR, for keeping the receipts Art. 6(1)(c) GDPR. See section 3.10.
Error reports from the app: Art. 6(1)(f) GDPR (legitimate interest in an app that works). See section 3.11.
QR scanner (connecting a kid's device): Art. 6(1)(b) GDPR; the ML Kit diagnostic data sent to Google: Art. 6(1)(f) GDPR (legitimate interest in reliable recognition of the code). See section 3.12.

5. Processors and third countries

We use the following service providers, which process personal data on our behalf and under our instructions (data processing under Art. 28 GDPR):

Cloudflare, Inc., hosting of the database (D1), the key value store (KV) and the Worker interface, the server log (Workers Logs, section 3.7) and the Turnstile security check for sign-in and the form (section 3.8). Cloudflare also uses the signals from the Turnstile check as a controller in its own right to improve Turnstile (section 3.8). Location of the database: region weur (Western Europe); the KV cache is distributed worldwide and holds entries only briefly (section 3.4). Standard contractual clauses (SCC) of the EU Commission are in place; Cloudflare is also certified under the EU-US Data Privacy Framework.
Resend, Inc., sending the system and sign-in link emails as well as the enquiries from the form and the answers from the feedback form on voidquest.app (sections 3.6 and 3.9). Region: eu-west-1 (Ireland). Processes only the recipient's email address and the email content (sign-in or invitation link, or the details from the form).
Fastmail, mailboxes for hallo@voidquest.app, datenschutz@voidquest.app and security@voidquest.app: stores the emails sent to us, including the enquiries from the form and the answers from the feedback form. Location: European Union.
Expo (650 Industries, Inc., USA), push service at exp.host: issues the push token and passes notifications on to Google and Apple. It receives the push token and the title and text of the notification, which can contain names and content from the family (section 3.5).
Google (Google Ireland Limited, Google LLC), Firebase Cloud Messaging for delivering notifications on Android devices, with the device token and the Firebase installation ID (section 3.5).
Apple (Apple Distribution International Ltd., Apple Inc.), Apple Push Notification service for delivering notifications on iOS devices (section 3.5).

Independent controllers: Google and Apple are themselves responsible for the following; their privacy policies apply:

Google ML Kit in the QR scanner on Android devices, with diagnostic and usage data and an installation identifier (section 3.12).
Google Play and Apple's App Store for installing the apps and for purchases of VoidQuest Plus in the parent app, including the payment (section 3.10).

Data is transferred to a third country (USA) for delivering notifications through Expo, Google and Apple, for the ML Kit diagnostic data, for verifying purchases with Google and Apple, and for the Turnstile security check, which runs in Cloudflare's worldwide network. The basis is the EU Commission's standard contractual clauses and, where the provider is certified under it, the EU-US Data Privacy Framework. What leaves the EU: the push token with the title and text of the notification, the ML Kit diagnostic data, the purchase receipts for verification and the features of the Turnstile check. The coin history, the check-ins and the rest of the family's data are stored in our database in the EU; section 3.4 describes the short lived entries in Cloudflare's globally distributed cache.

6. What we expressly do NOT do

No tracking, no profiling, no advertising IDs, no advertising cookies
No analysis of usage of our own and no analytics or statistics services (no Google Analytics, no Mixpanel, no Firebase Analytics). On Android devices, Google's ML Kit component in the QR scanner sends its own diagnostic and usage data to Google (section 3.12)
No external crash or error reporting: error reports go only to our own server (section 3.11)
No advertising, analytics or tracking SDKs in the apps. The built in components from Google (Firebase Cloud Messaging, ML Kit) deliver notifications and run the QR scanner (sections 3.5 and 3.12)
No advertising. Purchases exist only in the parents' view in VoidQuest (VoidQuest Plus, section 3.10), not in the kids' view and not in VoidQuest Kids
No selling of data and no sharing of data with third parties for advertising
No links to social networks
No chat, photo, location or friendship features: kids cannot exchange content with strangers. The camera serves only the QR code for connecting a kid's device

7. Retention

The family's data (parents, fans and kids) and the activity and coin history: as long as the family exists. The coin history is kept as an unchangeable, tamper proof ledger of the reward system (corrections are made with offsetting entries, never by deleting). When the parents delete the family, the family's data is removed from our database immediately and irreversibly. The security log, the purchase receipts and the error reports are kept (see below). Pending invitations, sign-in links and codes for connecting a kid's device in the cache expire on their own after their period (section 3.4), after 7 days at most.
Database restore points: Cloudflare keeps earlier states of the database for up to 30 days, so that it can be reset to an earlier point in time after a fault. Deleted data is still contained in them for up to 30 days and no longer after that.
When the parents remove a member (a kid, a second parent or a fan), that member's access ends at once and all of their sessions are ended. Their earlier data stays in the family, so that the coin history and the history stay complete, until the family is deleted. On request to datenschutz@voidquest.app we delete the data of an individual person; we do this by hand, within one month of receiving the request.
Security log (audit log): we keep it for security and to prevent abuse, also after the family is deleted. There is currently no fixed deletion period for it. When the family is deleted, we remove the reference to the member from each entry. What remains is the time, IP address, user agent and the details of the event with technical identifiers, such as the family's identifier, and, where entered, the email address. You can ask for entries to be deleted at datenschutz@voidquest.app.
Sessions (refresh tokens with IP address and user agent): a refresh token is valid for 90 days or until sign-out or revocation. The session record then stays stored until the family is deleted.
VoidQuest Plus purchase receipts (section 3.10): they stay stored even after the family is deleted, because they show which family a payment was credited to and because commercial and tax law require them to be kept. The Plus entitlement itself is deleted with the family.
Error reports from the app (section 3.11): 90 days, then deleted automatically, even if the family was deleted earlier.
Feedback form: message and email address twelve months in the database, then deleted automatically; the ratings and ticked answers remain without any personal reference. We delete the email with all answers in the hallo@voidquest.app mailbox by hand at the latest twelve months after it arrives (section 3.9).
Server log (error and security messages, rejected form enquiries with IP address and browser identifier): at most seven days, three days on Cloudflare's free plan, then deleted automatically by Cloudflare.
Sign-in link: 15 minutes. Connecting a kid's device (QR code or PIN): 10 minutes. Invitation of a second parent or a fan: 7 days. A family's list of open invitations: 7 days. Setup of a new family: 60 minutes. Choosing the household: 5 minutes. The family's name and time zone in the cache: 60 seconds. Counters per IP address: one minute, for the forms one hour. Each then expires automatically (section 3.4).
Access token: valid for one hour. Refresh token: valid for 90 days (or until sign-out or revocation).
Personal access tokens: until the parent revokes them (no automatic expiry).

8. Special protection for children (Art. 8 GDPR)

VoidQuest is meant for families with children aged about 5 to 13. We treat children's data with particular care and keep it to a minimum:

All of a kid's data is entered by the parents or arises when the kid uses the app the parents set up for them.
Kids have no account of their own, no email address and no server access without a parent being involved. VoidQuest Kids is only the sign-in for a kid profile the parents created.
No profiling, no advertising, no advertising ID, no advertising, analytics or tracking SDKs (for Google's component in the QR scanner, see section 3.12). We share children's data with nobody except the service providers named in section 5, and only for the purposes named there.
No sign-in through OAuth or a social network (no Google or Apple Sign-In) for kids: a deliberate design decision to keep data away from platforms.
No chat, photo, location or friendship features.
No purchases in the kids' view and in VoidQuest Kids. A kid gets stickers and avatar workshop parts with coins earned for quests, never with money.
Reactions come only from family members invited by the parents and consist of predefined emojis plus an optional short message, so there is no free input from strangers.
Encrypted transfer (TLS) on every connection.
QR codes and PINs for connecting a kid's device expire after 10 minutes; only a signed in parent device can create new ones.

Consent (Art. 8 GDPR): processing children's data is based on the consent of the holder of parental responsibility. This consent is collected explicitly and as a requirement when a kid profile is created: the signed in parent must actively confirm on their own authenticated device that they hold parental responsibility and consent to the processing of the child's data. Without this confirmation no kid profile can be created. For kid profiles created before this question was introduced, the app and the web admin show parents a notice through which they give the consent afterwards.

Record of consent: we record this consent as proof. We store the time it was given, the identifier of the consenting parent, the IP address, the browser or app identifier (user agent) and the version of this privacy policy that was agreed to. These details serve only as proof of validly given consent under Art. 8 GDPR.

Consent can be withdrawn at any time with effect for the future. When the parents remove the kid from the family, the kid's access ends at once, in VoidQuest Kids too, and no new data arises; the earlier data stays stored until the family is deleted, or we delete it by hand on request to datenschutz@voidquest.app, within one month. Deleting the family removes the kid's data and the record of consent from our database; section 7 says what remains after that.

9. Your rights (Art. 15 ff. GDPR)

You have the right at any time to:

Access (Art. 15 GDPR): which data we hold about you and your family
Rectification (Art. 16 GDPR): correction of inaccurate data
Erasure (Art. 17 GDPR): removal of the data ("right to be forgotten")
Restriction of processing (Art. 18 GDPR)
Data portability (Art. 20 GDPR): export of the family's data in a machine readable format through the backup in the web admin (see section 11)
Objection (Art. 21 GDPR) to processing based on legitimate interests
Withdrawal of consent (Art. 7(3) GDPR): at any time with effect for the future, in particular for processing children's data and for notifications
Complaint to a supervisory authority (Art. 77 GDPR), for example to the data protection authority where you live. The authority responsible for the controller is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.

To exercise your rights, please email datenschutz@voidquest.app. We answer within the legal deadline (usually within one month).

Parents can delete the whole family with all of the kids' data themselves and irreversibly, in the app under Manage, Edit family, Danger zone, Delete family. How it works, what is deleted and how to request deletion without the app is described on the page Delete your account and data.

10. Notifications

Notifications are sent only if you have allowed them in the device settings. You can withdraw this permission at any time (system settings, then notifications, then VoidQuest) without affecting the rest of the app. In the app you can also choose per channel which kinds of notifications you receive. The text of a notification is short and can contain names and content from the family, for example a kid's name and the title of a quest or reward; it appears on the lock screen if the device is set up that way. Section 3.5 explains how notifications are delivered; for the transfer to third countries see section 5.

11. Local storage and encrypted backup

VoidQuest and VoidQuest Kids store data locally on the device so that they keep working without an internet connection:

an SQLite database with the family data the device may see, such as quests and the check-in history (synced with the server)
authentication tokens in the encrypted system keychain (iOS Keychain or Android Keystore), not in unencrypted app storage
local schedules for reminders
device settings such as language, sounds and, if turned on, the app lock

When you sign out, the app deletes the sign-in tokens and the cache of its screens. The app empties the local database when the family is deleted on this device. When the family is deleted on another device or a member is removed from the family, the devices concerned learn of it the next time they reach the server: an adult's device then empties its local database. A child's device keeps it until the app is uninstalled, its data is cleared or the device is connected to another account; until then the app there shows only a farewell with the child's coins, record and number of stickers. A device whose app no longer reaches the server, and a device with an app version older than this rule, which only signs the person out, keep their local database until the app is uninstalled. All local data is removed completely when you uninstall the app or clear the app's data in the device settings.

Data export and backup: in the web admin (Settings), parents can download a backup of their family's data as a .vqb file, encrypted with a passphrase they choose. It contains the family and its members, quests, the coin history, rewards, reactions, stickers, the kids' achievements and their settings, and consents. It does not contain sessions, push tokens, the security log, personal access tokens or purchase receipts. The file is encrypted with AES-256-GCM; the key is derived from the passphrase with PBKDF2-SHA256 (200,000 iterations). The file can only be read with this passphrase, so keep it safe. This backup also serves data portability under Art. 20 GDPR.

12. Changes to this privacy policy

We may adapt this privacy policy when the app, the law or our service providers change. The current version is always available at voidquest.app/en/privacy. We announce significant changes by email or with a notice in the app.

13. Contact

Please send questions and requests for access or deletion to datenschutz@voidquest.app. For the postal address see section 1.