October 23, 2026

Privacy Policy

This Privacy Policy describes how the Questika application collects, stores, and processes personal data of its users. Questika is a mobile application designed for families, enabling parents to manage their children's daily tasks in a gamified format. The privacy of our users — especially children — is our top priority.

1. Data Controller

The data controller is:

Rincon sp. z o.o.
ul. Spacerowa 9, 10-687 Klewki
NIP 7394035448 · KRS 0001242776 · REGON 544828315
Poland
Email:

For any questions regarding data protection, you can contact the data controller at the email address above.

2. What Data We Collect

Parent Data (main account)

  • Name — displayed within the app.
  • Email address — used for login and communication.
  • Password — stored in encrypted form by Supabase Auth (we never have access to your password in plain text).
  • Authentication method — Questika accounts use email and password sign-in.
  • Legal acceptance and child-representation evidence — acceptance timestamp, event type, IP address, user-agent, platform, app version, requested locale, legal document ids, versions, locales, URLs, titles and body hashes; and, for each represented child, parent id, child id, profile action, represented services, and evidence bundle hash, signature and timestamp fields.

Child Data (profile within the parent's account)

  • Name — displayed within the app.
  • Avatar photo (optional) — stored exclusively on the local device, never uploaded to the cloud, and not collected or processed by us.
  • Login code — a simple code that allows the child to access their profile (this is not a password).
  • Task and quest completion history — information about completed tasks, earned points, and progress.
  • Collection progress — data about collected rewards and animals.
  • Allowance data — if the parent uses the allowance management feature.

Subscription Data

  • Purchase state — whether the subscription is active.
  • Product ID — the type of plan purchased.
  • Expiry dates — when the subscription expires.

This data comes from the App Store (Apple) or Google Play (Google) and is used solely to verify access to premium features. We do not process credit card or banking information.

3. Purpose of Data Processing

We process personal data exclusively for the following purposes:

  • Service delivery — enabling the use of the app, synchronizing data across devices, and managing accounts.
  • Authentication — secure parent login and child profile identification.
  • Subscription verification — checking payment status to provide access to premium features.
  • Communication — responding to inquiries and support requests sent to our email address.
  • Legal acceptance and accountability — recording proof that the parent accepted the Terms of Service or acknowledged the Privacy Policy.

We do not use data for marketing, profiling, advertising, or analytics. Questika contains no tracking tools, advertising SDKs, or analytics systems of any kind.

4. Legal Basis for Processing

We process personal data on the following legal bases under the GDPR (Regulation 2016/679):

  • Article 6(1)(b) — Performance of a contract — processing is necessary to provide the Questika service, including account creation, data synchronization, and subscription management.
  • Article 6(1)(f) — Legitimate interest — maintaining proof of contract formation and legal-document acceptance, ensuring the security of the service, preventing abuse, and providing technical support.

A child's profile is created and managed by a parent or legal guardian acting as the child's legal representative. For child-profile administration, tasks, quests, rewards and allowance tracking, the represented child is party to the contract with Rincon and the processing necessary to perform those services relies on Article 6(1)(b). The adult contracts in their own name only for the parent account, premium subscription, billing and other parent-only functions. This processing is not based on the child's consent.

5. Data Storage

Questika uses a local-first architecture, meaning data is stored primarily on the user's device:

  • Locally — data is saved in an SQLite database on the mobile device. The app is fully functional offline.
  • In the cloud — data is synchronized with a PostgreSQL database managed by Supabase, enabling use across multiple devices.

Transmission Security

  • All communication with Supabase servers uses HTTPS with TLS encryption.
  • Authentication is based on JWT tokens (JSON Web Tokens), which are generated and verified by Supabase Auth.

Server Location

The Supabase servers that store data are located in the European Union. Data is not transferred to third countries outside the EEA, except as described in the section on external services.

Retention and Deletion

Questika uses a soft-delete approach: data marked for deletion is first flagged as inactive, retained for up to 30 days, and then permanently deleted by an automated daily cleanup. We keep personal data only as long as necessary:

  • Account, child-profile, and activity data — permanently deleted up to 30 days after you delete the data or your account.
  • Legal-acceptance evidence (including IP address and user-agent) — deleted immediately when you delete your account.
  • Subscription records — the active record is deleted on account deletion; a minimal transaction record is retained only for the period required by applicable tax and app-store rules.
  • Support correspondence — deleted once your request is resolved.

6. Photos and Avatars

Children's avatar photos are stored exclusively on the local device. They are not uploaded to Questika's servers, to the cloud, or to any third-party services. If the user uninstalls the app or clears the app's data, avatar photos will be permanently deleted.

7. Payments

Questika offers a premium subscription. All payments are handled entirely by the App Store (Apple) or Google Play (Google). Questika:

  • Does not process credit card data.
  • Does not have access to users' banking information.
  • Does not store any financial data.

We only receive information about the subscription status (active/inactive, expiry date, product ID) in order to provide the appropriate features within the app. Payment data processing is governed by Apple's or Google's respective privacy policies.

8. External Services

Questika uses a minimal number of external services:

Supabase

Supabase serves as the app's backend — it handles user authentication (Supabase Auth) and data storage and synchronization (PostgreSQL). Supabase processes data under a Data Processing Agreement (DPA). More information: supabase.com/privacy.

No Analytics, Ads, or Tracking

The Questika app does not use any analytics tools (e.g., Google Analytics, Firebase Analytics), advertising SDKs, user profiling systems, or any other tracking tools. We do not use tracking pixels and do not share data with advertising networks.

9. Children's Data

Questika is a family-oriented application and takes special measures to protect children's data:

  • A child's account is created exclusively by a parent or legal guardian. Children cannot create accounts on their own.
  • Data we process about children — name, an optional avatar photo, a login code, task and quest completion history, collection progress (rewards and animals), and, if the parent enables the feature, allowance configuration and reward receipts.
  • Children log in using a simple code, not a password or email address. The code is set by the parent.
  • We do not profile children, show them advertisements, or collect any data from them for marketing purposes.
  • Children's avatar photos never leave the device — they are not uploaded to the cloud or shared with third parties.
  • The parent has full control over the child's profile and can delete the child's data at any time.

10. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

  • Right of access (Article 15 GDPR) — you have the right to know what data we process and to receive a copy of it.
  • Right to rectification (Article 16 GDPR) — you can request correction of inaccurate or completion of incomplete data.
  • Right to erasure (Article 17 GDPR) — you have the right to request deletion of your personal data ("right to be forgotten").
  • Right to data portability (Article 20 GDPR) — you can request your data in a structured, machine-readable format.
  • Right to object (Article 21 GDPR) — you have the right to object to data processing based on legitimate interest.
  • Right to restriction of processing (Article 18 GDPR) — you can request restriction of data processing in certain situations.

To exercise any of these rights, please contact us at: .

You also have the right to lodge a complaint with a supervisory authority. In Poland, this is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.

11. Account Deletion

If you wish to delete your parent account and the data tied to it, open Questika and go to Settings → Delete account, then type DELETE to confirm. Shared child profiles may remain available to another active parent. If you cannot access the app, contact for support.

In accordance with our soft-delete approach, data is first flagged as inactive, retained for up to 30 days, and then permanently deleted by our automated daily cleanup.

12. Website statistics and cookies

The questika.eu website provides information for parents. Only with consent, it uses Google Analytics 4 to measure traffic sources, page views, scrolling and clicks to Google Play or the App Store. A store click does not confirm an installation. Analytics is not added to the Questika app and receives no family account data, task content, login codes or children’s in-app activity.

The controller is Rincon sp. z o.o. (contact details in section 14). Measurement data is received by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data includes a cookie-based browser identifier, browser and device information, language, page, campaign source and the events described above. Google also receives an IP address during the connection; the Google documentation linked below explains IP-address handling.

Consent is optional. Before consent and after rejection, we do not load Google Analytics or send measurements to Google. Use “Privacy settings” in each page’s footer to change your choice. Withdrawal blocks further measurement and deletes Analytics cookies in this browser; it does not affect the lawfulness of earlier processing.

Optional measurement and cookies rely on consent (GDPR Article 6(1)(a)). The _ga and _ga_* cookies last up to 180 days. Essential localStorage entry questika_website_analytics_consent_v1 remembers acceptance or rejection for 180 days solely to respect your choice. Event-level data is retained in Analytics for 2 months; aggregate reports may remain available longer. Advertising features and ad personalization are disabled.

Google may process data outside the EEA, including in the USA, using applicable transfer mechanisms described in Google’s frameworks. See Google’s privacy policy and Google Analytics 4 data protection.

How Google uses data from partner sites and apps.

13. Changes to This Privacy Policy

This Privacy Policy may be updated periodically. Any changes will be published on this page with an updated date. We encourage you to review this Privacy Policy regularly.

In the event of significant changes affecting how personal data is processed, we will make reasonable efforts to notify users in an appropriate manner.

14. Contact

If you have any questions about this Privacy Policy or the processing of personal data, please contact us:

Rincon sp. z o.o.
ul. Spacerowa 9, 10-687 Klewki
NIP 7394035448 · KRS 0001242776 · REGON 544828315
Email:
Poland

Last updated: October 23, 2026