Privacy policy

The short version

• Queststone has no accounts, no ads, no analytics and no tracking. It uses no third-party code, and we never sell anything about you.
• Without iCloud, everything you make stays on your device.
• Tips in Settings are paid through Apple. We receive no payment details, and Queststone keeps no record of them.
• With iCloud turned on, it lives in iCloud: your own, or for a guild, the iCloud of the person who started it. We can't see either.
• To let your family find and invite you, iCloud publishes a small directory entry: your sigil, your hero's name, portrait and companion, and an ID for your iCloud account that only Queststone uses. Short alert messages, for your guild or for someone whose invitation you decline, can include names, quest titles and notes, and are kept in the same place for about a day. We can see these.
• If you send us feedback or report someone, it reaches us as an email.
• You can delete a hero, or everything, in the app: from your device and from your iCloud. Turning off iCloud in Queststone removes your directory entry and the alerts you've sent. For anything else, write to us.

Who we are

Queststone is made by an independent developer. In this policy, "we" and "us" mean the developer of Queststone. You can reach us at queststonesupport@gmail.com.

Apple and Google, described below, may store data in the United States or other countries. If the law where you live gives you more say over your data, as in the EU or the UK, write to us and we'll help.

What stays on your device

Your heroes, guilds, quests, notes, boons, journeys, gold, looks and settings are saved on your device. iCloud is off until you turn on "Keep my adventure in iCloud". While it's off, none of this leaves your device, except feedback you choose to send.

Reminders ("ravens") are scheduled on your device. Queststone asks only for permission to send notifications and, on a device with Face ID, to use Face ID. It doesn't use your location, camera, microphone, photos, contacts or health data, and it never asks anyone's age or birthday.

On a device where more than one hero plays, before switching to a guardian's hero, deleting a guardian's hero, a guild or everything, or unblocking somebody while a child's hero is playing, Queststone asks for your device's Face ID, Touch ID or passcode, if it has one, so only someone who can unlock the device can do it. iOS does the checking and tells Queststone only whether it passed. Queststone never sees Face ID or Touch ID data or your passcode, and keeps nothing from the check.

A word filter on your device keeps slurs, sexual words and strong profanity out of anything other people read, such as hero names, quests, notices and boons. It runs only on your device and sends nothing anywhere. The people you block and the things you report are remembered only on your device, for the Apple Account signed in when you did it: they are never synced or sent, and Delete everything clears them.

iCloud and guilds

When you turn on "Keep my adventure in iCloud", Queststone uses Apple's iCloud (CloudKit) to keep your heroes and guilds in step across your devices and your family's devices.

• Your own data is kept in your private iCloud storage. Apple stores it for you. We can't see it.
• A guild lives in the iCloud storage of the person who started it. It is shared through iCloud with the people who join it. Everyone in a guild can see:
  • the guild's quests and their notes;
  • its boons and journeys;
  • the guild notice and house rules;
  • each member's hero: their name, companion, level, badges, gold, what they've bought, their looks and their sigil.
  We can't see guilds.
• Invitations. Only a guild's Guildmaster can invite someone: the person who started it, on their iCloud account. They type the other person's sigil, and Queststone shows whose sigil it is before the invitation is sent. The invited person sees the guild's name and who asked them. With the current version of Queststone, they see the guild itself only if they tap Join. If they decline, their device leaves the Guildmaster a short guild alert saying so, such as "Robin declined your invitation to The Oakhollow Guild." Whether they decline, the Guildmaster cancels, or nobody answers within two days, Queststone takes the invitation back.
• Sigils. Each sigil belongs to one person. If yours turns out to be taken already, Queststone gives you a new one and tells you.

The sigil directory, invitations and guild alerts

A few small records go into Queststone's shared directory in iCloud (the "public database"). Anyone using Queststone can look up these records by sigil, and we can see them. To tell a guild's Guildmaster that their invitation was declined, Queststone also finds the Guildmaster's directory entries by the iCloud ID the invitation came from. They are used only to make the app work.

Sigils are short so they're easy to share, which also means one could be guessed. That's why a directory entry holds only a hero name, portrait and companion. Queststone asks for "your name", but any name or nickname works.

A child's hero name can appear in guild alerts sent to other members of their guild, or to a guild's Guildmaster when the child declines its invitation. It goes into the sigil directory only if it's the hero a device's iCloud account belongs to, with iCloud turned on in Queststone; for example, a child playing on their own phone or iPad. Heroes a guardian adds for someone who plays on the guardian's device never go into the directory.

Quest titles, notes and the guild notice can travel in guild alerts too, so keep private details about other people, like full names or addresses, out of them.

Notifications

Reminders are scheduled on your device. Guild alerts, invitations and sync updates reach your device through Apple's push notification service, via iCloud. Queststone never reads or stores your device's push token, and we don't run a server of our own.

Feedback and support

Sending feedback is always your choice. It opens an email in your Mail app (or another app you pick) addressed to queststonesupport@gmail.com, and you see everything before you send it. It contains:

• your message;
• your email address, as your mail app sends it;
• the app version, your device model and the iOS version;
• if you leave "Include sync details" on, the recent sync log. It holds technical details such as times, counts, error messages, gold balances and IDs, but not names or quest titles.

"Block and report", under an invitation, opens the same kind of email, prefilled with the inviting hero's name, the guild's name and the invitation's ID. You see it before you send it.

"Report", on the hero card of somebody in your guild, opens the same kind of email too, prefilled with what the report is about (their hero's name or portrait, or something they wrote), the words reported, their hero's name, the guild's name and the IDs of what was reported, and nothing else. You see it before you send it. What you report is hidden on your device straight away. We look at every report within 24 hours, as our community rules say. Everyone agrees to those rules when they turn on "Keep my adventure in iCloud" or join a guild.

We use feedback and reports only to answer you, to look into what was reported, and to fix problems in Queststone. The mailbox is hosted by Google. We delete feedback and report emails within a year of our last reply, or sooner if you ask.

Tips

Settings has a tip jar, "Support Queststone", where you can leave a tip to say thanks: a mug of cocoa, a campfire supper or a feast for the guild, at the price the App Store shows in your currency. A tip is a thank-you and unlocks nothing.

A tip is an ordinary App Store in-app purchase. Apple takes the payment, under Apple's own terms and privacy policy. We never see your payment details or learn who left a tip: Apple's reports to us show only totals, such as how many tips were left in each country. Queststone keeps no record of tips, on your device, in iCloud or anywhere of ours. Apple keeps its own record of the purchase, as it does for any App Store purchase.

If your family uses Ask to Buy, a parent is asked to approve a tip before it goes through.

Children and families

Queststone is made for families, and children can play as pathfinders with a guardian. We don't ask anyone's age, and we don't show ads to anyone or track anyone. Tips are optional, and with Ask to Buy a parent approves each one first. A child's information is handled in the ways described above.

A child's hero can be deleted in the app, as described under "Your choices, and deleting your data" below. A parent or guardian can also ask us what we hold about their child, and ask us to delete it: the sigil directory entry, invitations, guild alerts and feedback emails. To stop any more reaching us, turn off "Keep my adventure in iCloud" on your child's device. Write to queststonesupport@gmail.com and include the hero's sigil if you can.

Links out of the app

Settings has a link to the Queststone community on Reddit. It opens Reddit outside the app, where Reddit's own privacy policy applies. Queststone passes nothing to Reddit.

Who else handles your data

• Apple stores your iCloud data, the sigil directory and guild alerts, delivers notifications, and takes payment for tips, under Apple's privacy policy.
• Google hosts the mailbox that receives feedback emails, under Google's privacy policy.

Apple and Google handle this data only to store and deliver it for Queststone, and protect it at least as well as this policy says. Apple handles a tip's payment itself, as it does for any App Store purchase. We share your data with no one else. We don't sell it, and we don't use it for advertising.

Your choices, and deleting your data

• Stop syncing: on the Guild tab, turn off "Keep my adventure in iCloud". Queststone removes your sigil directory entry and the guild alerts you've sent, the next time it can reach iCloud. Your data stays on your device. What's already in your iCloud stays there, and any guild you started stays shared, so its members can keep playing.
• Leave a guild: on the Guild tab, tap Guilds, then Leave under the guild's name. Its Guildmaster, the person who started it, can't leave it while it syncs, because it lives in their iCloud, and only they can remove members. After you leave, what you did there, such as your hero and the quests you finished, stays in that person's iCloud.
• Delete a hero: on My hero, tap Delete my data under the sigil card. Its window shows what goes and what stays before anything does. Only the hero playing can be deleted, so switch to them first. A pathfinder holds the button for three seconds, as does anyone on a device only they play. Where more than one hero plays on the device, a guardian, or someone playing alone, confirms with the device's Face ID, Touch ID or passcode instead. That hero goes from your device and, if you use iCloud, from your iCloud: their level, XP and gold, their quests, looks, badges and satchel, their sigil and its directory entry, and invitations they sent that nobody has answered. Quests somebody gave them go back to whoever gave them, still to do; quests they gave and seals they granted stay with whoever has them. In a guild somebody else started, they only leave: what they did there stays in that person's iCloud, and only that person can delete it. If the same hero is also on another of your devices, delete them there too. Deleting the last hero on a device starts Queststone afresh.
• Delete everything: in Settings (the gear on My hero), tap Delete everything, the last row, and hold the button for three seconds; where more than one hero plays on the device, confirm with its Face ID, Touch ID or passcode too. Every hero on your device goes, with everything of theirs on it and what Queststone keeps of theirs in your iCloud: their quests, boons, journeys and history, their sigils and directory entries, invitations still waiting for an answer, and the guild alerts your device sent. Queststone then starts again as if newly installed, keeping only a note of which heroes were deleted, so a copy from elsewhere can't bring them back, and of anything still to delete from your iCloud. It is offered to a guardian who looks after everyone else on the device, or to someone playing alone, never to a pathfinder. A copy on another of your devices stays until it's deleted there too.
• Guilds you started: deleting a hero, or everything, keeps a guild other people play in, so they can carry on; it stays in your iCloud, or on your device, for them. Only its Guildmaster, the person who started it, can also delete it for everyone in it, with its own switch in the same window; that is always held for three seconds, and confirmed with the device's lock where more than one hero plays on it. A guild nobody else plays in goes with you.
• If iCloud can't be reached: when your device is offline, or not signed in to iCloud with the same Apple Account, Queststone deletes what's in your iCloud the next time it can reach it. The note after deleting says so while it's still to come: keep Queststone on your device until then.
• Outside the app: deleting the app removes what's on your device, but not what's in your iCloud or the sigil directory. To delete Queststone's iCloud data, in your device's Settings tap your name, then iCloud, then manage your storage; if Queststone is listed, you can delete its data there. That deletes every guild you started, for everyone in it.
• Anything else: write to queststonesupport@gmail.com. We'll answer within 30 days and help remove anything the app can't remove by itself.

Changes to this policy

If Queststone starts handling data differently, we'll update this page and the date at the top before the change reaches the app.