Privacy Policy

Last updated: May 2, 2026

Questr ("we," "us," or "our") operates the Questr mobile application (the "App"). This Privacy Policy explains how we collect, use, disclose, and protect your information when you use the App.

By creating an account or using the App, you agree to the practices described in this policy.

1. Information We Collect

1.1 Account and Profile Information

When you register, we collect:

• Display name and username
• Email address (for email/password sign-up)
• Apple or Google account identifiers (for social sign-in)
• Profile avatar image you choose to upload

1.2 User-Generated Video Content

The App's core function is recording and sharing short videos of challenge completions. When you record and submit a video, we collect:

• The video file and any associated audio
• Metadata such as timestamp and group association

Before recording, you are shown a safety reminder and confirm you have obtained consent from identifiable individuals who appear in your video.

Videos are processed and hosted by Bunny Stream (see Section 4). Videos are visible only to members of your private group unless you explicitly share them to the community feed.

1.3 In-App Activity

We collect data about how you interact with the App, including:

• Challenge completions and participation history
• Emoji reactions you submit on other members' videos
• Group membership and invitations you send or accept
• Weekly scoring and forfeit assignment records
• Push notification preference settings

1.4 Device and Technical Information

We automatically collect certain technical data when you use the App:

• Device type, operating system, and version
• Unique device identifiers
• App version and crash reports
• Network connectivity status

1.5 Analytics

We use PostHog to collect anonymized usage analytics, including feature usage patterns and session events. PostHog data is used solely to improve the App experience and is not sold or used for advertising.

2. How We Use Your Information

We use the information we collect to:

• Create and manage your account
• Enable video recording, compression, upload, and playback within your group
• Display challenge assignments, scoring, and weekly leaderboards
• Send push notifications about daily challenges, group activity, and weekly results
• Operate content moderation systems to enforce community guidelines
• Investigate reports of policy violations and take enforcement action
• Analyze aggregate usage patterns to improve the App (via PostHog)
• Respond to support inquiries
• Comply with legal obligations

We do not sell your personal information to third parties. We do not use your information to serve targeted advertising.

3. Lawful Basis for Processing

Under the UK General Data Protection Regulation (UK GDPR), we rely on the following lawful bases to process your personal data:

3.1 Contract Performance

We process your data as necessary to perform our contract with you (these Terms of Service), including:

• Creating and managing your account
• Hosting and delivering your video content via Bunny Stream
• Delivering daily challenge assignments to your group
• Managing group memberships, invitations, and weekly scoring

3.2 Legitimate Interests

We process certain data based on our legitimate interests, where those interests are not overridden by your rights and freedoms. This includes:

• Content moderation and enforcement of our Community Guidelines
• Abuse prevention, fraud detection, and app security
• Maintaining and improving the reliability of the App

3.3 Consent

We process certain data only with your consent, which you may withdraw at any time:

• Analytics: Collection of anonymised usage data via PostHog (you can opt out in App settings)
• Push notifications: Delivery of challenge reminders, group activity alerts, and weekly results (you can disable in your device settings or the App at any time)

Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

4. Video Data and Bunny Stream

Video content you record and upload is processed by BunnyWay d.o.o., registered at Dunajska cesta 165, 1000 Ljubljana, Slovenia, operating the Bunny Stream platform. Bunny Stream transcodes your video to MP4 and HLS formats, generates thumbnail images, and caches the encoded output on a global content-delivery network for playback. Bunny does not permanently retain the original file you upload; only the encoded renditions and thumbnails are stored for delivery.

Bunny acts as our data processor under UK GDPR Article 28. We do not grant Bunny the right to use your video content for any purpose other than hosting, transcoding, and delivery on our behalf. Bunny does not perform automated content scanning or moderation on our videos.

Video playback URLs are long, random identifiers scoped to our private Bunny Stream library. Access to videos within the App is additionally gated by our Row Level Security policies: a user can only retrieve playback identifiers for videos they are authorised to see under Section 1.2.

Bunny's privacy practices are described at https://bunny.net/privacy/.

5. Push Notifications

We use Expo's push notification service to deliver alerts about daily challenges, group member submissions, reactions, and weekly results. Push notifications are enabled by default and can be disabled at any time in your device settings or within the App's notification preferences.

Expo's privacy practices are described at https://expo.dev/privacy.

6. Analytics via PostHog

We use PostHog to collect anonymized event data. PostHog is configured to avoid collecting personally identifiable information in event payloads. Analytics data is used exclusively for product improvement and is retained for a maximum of 12 months.

PostHog's privacy practices are described at https://posthog.com/privacy.

7. Third-Party Services

The App integrates with the following third-party service providers, each of which processes data as described:

8. Content Moderation

User-submitted video content is reviewed primarily through a reactive, report-driven process. Users may report content that violates our guidelines using the in-app reporting feature. Reports are reviewed by our moderation team, who may remove content and suspend or terminate accounts that violate our policies (see Section 4 of our Terms of Service for prohibited categories).

We are working to add automated content scanning (including nudity, violence, and child-safety detection) provided by a specialist moderation vendor. We will update this Privacy Policy and notify existing users before that new processing begins.

Moderation actions may involve a human reviewer watching or reviewing your submitted video.

Where we identify content that constitutes child sexual abuse material (CSAM), we are required by law (18 U.S.C. § 2258A in the United States) to report that content to the National Center for Missing & Exploited Children (NCMEC) CyberTipline. Reports include the visual depiction itself, upload metadata, and identifying information about the uploader. We may also forward the same information to the Internet Watch Foundation (IWF) and to UK law enforcement where appropriate. Our full handling procedure is documented in docs/legal/csam-handling.md in our public legal repository.

8.1 Daily Quest Content

Daily quests are written by the Questr team and reviewed against an internal safety rubric before publication. They do not use any of your personal data as input, and no third-party AI provider generates or processes the quests we ship.

Our video processor (Bunny Stream) does not perform AI analysis of your videos. If we introduce any automated, AI-driven moderation in future, we will update this Privacy Policy and notify existing users before the change takes effect.

9. Data Retention and Deletion

Retention periods

• Account data: Retained while your account is active
• Videos: Retained while your account is active or until you delete the specific video
• Analytics data: Retained for a maximum of 12 months in PostHog
• Moderation logs: Retained for up to 24 months for safety and dispute purposes (e.g. records of reports you filed, decisions taken on reports about you, and Terms-of-Service violations)
• Anti-abuse audit data: A small fingerprint record (device hash, anonymised IP, account age signals — never your name, email, or content) is retained for up to 24 months after account deletion solely to detect and block ban-evasion via re-registration. This data is never used for advertising and is never shared with third parties.

Account deletion

You may request deletion of your account at any time through the App's settings screen or by contacting us at nick@questr.tv. Upon deletion:

• Your profile, username, and display name are removed immediately
• Your videos are deleted from Bunny Stream within 30 days, except where retention is required by law (for example, content preserved for a child-safety investigation — see the final bullet below)
• Your reactions and participation records are anonymised or deleted within 30 days
• Reports you filed are deleted; reports filed about your conduct are retained per the moderation-log policy above
• Anti-abuse fingerprint data is retained per the audit-data policy above
• Certain data may be retained longer if required by applicable law or needed to resolve ongoing disputes

10. Data Security

We implement reasonable technical and organizational security measures to protect your information. These include encrypted connections (TLS), Row Level Security policies on our database, and authenticated access to video assets.

No system is completely secure. In the event of a data breach that affects your personal information, we will notify you as required by applicable law.

11. Children's Privacy

The App is intended for users aged 16 and older. We do not knowingly collect personal information from anyone under 16. If you believe someone under 16 has created an account, please contact us at nick@questr.tv and we will delete the account and associated data promptly.

12. Your Rights

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, you have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your account and associated data (see Section 9)
• Portability: Request your data in a structured, commonly used, machine-readable format
• Objection: Object to processing based on legitimate interests
• Restriction: Request that we restrict the processing of your data in certain circumstances
• Withdraw consent: Where processing is based on consent (see Section 3.3), you may withdraw consent at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at nick@questr.tv. We will respond to your request within one month, as required by law.

Supervisory Authority

If you are not satisfied with our response or believe we are processing your data unlawfully, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: https://ico.org.uk
• Helpline: 0303 123 1113

13. International Data Transfers

Questr is operated from the United Kingdom. Your personal data is transferred to and processed in the following places:

• Bunny Stream (BunnyWay d.o.o.): video content is processed and stored in the European Union (Slovenia), and served from a global CDN that may cache encoded videos and thumbnails in edge regions closer to viewers (including outside the UK and EEA).
• PostHog EU: analytics events are processed in the European Union.
• Supabase: database, authentication, and realtime services are hosted in the United States.
• Expo Notifications, Apple, Google: may operate in the United States and other regions.

Where personal data is transferred outside the United Kingdom, we ensure appropriate safeguards are in place in accordance with UK GDPR, including the UK International Data Transfer Agreement (UK IDTA) or the UK Addendum to EU Standard Contractual Clauses (SCCs), as applicable. Transfers into the European Economic Area are covered by the EU Commission's adequacy decision for the United Kingdom and by standard contractual clauses where required.

You may request details of the transfer safeguards we have in place by contacting us at nick@questr.tv.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice in the App or by email before the change takes effect. Your continued use of the App after the effective date constitutes acceptance of the updated policy.

15. Contact Us

For privacy-related questions, requests, or concerns:

Questr Email: nick@questr.tv Website: https://questr.tv

16. DMCA & Copyright Designated Agent

Questr's parent company, ViralCow LTD, is registered as a service provider with the U.S. Copyright Office's DMCA Designated Agent Directory. This registration grants Questr safe-harbor protection under 17 U.S.C. § 512.

Designated agent for DMCA notices:

Nick Humphreys, Director, ViralCow LTD 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom Email: nick@questr.tv · Phone: +44 7761 856755

Public directory listing: https://dmca.copyright.gov/dmca/publish/history.html?search=ViralCow&id=a0b376584ce1309b743eb5fd8fffb7a8 (Registration No. DMCA-1072133, effective 30 April 2026).

Full DMCA takedown and counter-notice procedures are documented in our Terms of Service, Section 4.4.