XP Quests

🔒 Privacy Policy

Last updated: 28 September 2026 · Version privacy-2026-07

1. Who we are

The data controller is Tugay Serinken, a sole proprietor established in Estonia ("XP Quests", "we", "us"), operating the XP Quests learning app at xpquests.com. Postal address: [POSTAL ADDRESS]. For privacy questions, data requests, or to delete an account, contact contact@xpquests.com.

XP Quests is designed for children (around ages 8–14) and is used with a free family account created by a parent or guardian. We take children's privacy seriously and collect only what we need to run the service — described in full below.

2. What runs on your device

3. What we collect

3a. Your family account (required to use XP Quests)

A parent or guardian creates the account. When they do, we collect and store:

We do not collect a child's real name (unless a parent types one into the certificate or notebook), home address, phone number, child email, date of birth, or photos.

3b. Optional AI tutor (premium)

If a parent turns on the AI tutor, when the child asks a question we send that typed question and, optionally, a screenshot of the lesson page to an AI model (Google's open Gemma model) that runs on our hosting provider, Cloudflare Workers AI, to generate a hint. No other AI company receives it. This content is processed transiently and is not stored — neither on our servers nor used by Cloudflare to train models. We keep only how many questions were asked in each billing month (the Premium question allowance) and a record of any question packs bought.

3c. Optional premium voice

If a parent turns on premium narration, we send the lesson text (course content — not information about your child) to our voice provider (ElevenLabs) to generate audio.

3d. Optional email notifications & payments

If a parent enables email alerts, we send them to the parent's email via our email provider. If a parent buys a subscription, payment is handled entirely by Stripe — card details never touch our servers; we store only Stripe's customer/subscription IDs.

3e. Technical data

Like any website, our hosting provider (Cloudflare) processes IP addresses and basic request information to serve pages and protect against attacks. We run no analytics, no advertising trackers, and no third-party tracking cookies.

4. Cookies & local storage

XP Quests sets no advertising, analytics, or tracking cookies. We store data in your browser's localStorage only for things you asked for: your course progress, and (if you sign in) your login session. When you sign in we also set one strictly-necessary cookie, xpq_gate, which only lets our server check that you are signed in before showing course pages (it holds your account ID and an expiry date, is signed so it can't be forged, lasts up to 30 days and is deleted when you sign out). Our hosting provider may set strictly-necessary security cookies (e.g. bot protection). Because all of this is strictly necessary or explicitly requested, no cookie-consent banner is legally required — but we disclose it here for transparency.

5. Our sub-processors

We use a small number of trusted service providers. Each optional one only receives data when a parent turns on that specific feature.

We will keep this list current and note changes here. We do not use any advertising, analytics, or data-broker companies.

6. International data transfers

Some providers are located in the United States. Where we transfer data about EU/UK children, we rely on approved safeguards (EU-US Data Privacy Framework certification where available, otherwise Standard Contractual Clauses). Our account database (parent account, child profiles, progress, consent records) is stored in the EU: it runs on Cloudflare D1 with an EU data-location restriction. [Confirm the transfer mechanism for the remaining US providers before launch — see docs/legal/subprocessors.md.]

7. How long we keep data

We keep account data only as long as needed to provide the service. If you delete a child profile or your whole family account, the associated learning data is permanently erased. If an account is inactive for 24 months, we will notify the parent and then delete it. Deleted data can linger in our database provider's point-in-time backups for up to 30 days before it is gone for good. We keep a minimal, non-identifying record that a valid consent once existed (no child data) for as long as legally required to demonstrate compliance.

8. Parents' rights & choices

• Review — see all of your child's data in the parent dashboard.
• Delete — remove a child profile or the entire family account at any time; deletion cascades to all learning data.
• Export — download your data (via the account page / by contacting us).
• Refuse / withdraw — stop further collection by not creating an account, turning off premium features, or deleting the account. Withdrawing consent does not affect the lawfulness of processing before withdrawal.

To exercise any right, use the dashboard controls or email contact@xpquests.com. Depending on where you live, you may also have the right to complain to your data protection authority.

9. How we protect data

We maintain a written information-security program appropriate to the sensitivity of children's data: encryption in transit, a database that is never reachable from the browser (every request is checked on our server so each family can only access its own data), passwords stored only as salted hashes, secrets stored server-side only, signed data-processing agreements with our providers, and least-data-necessary design. No system is perfectly secure, but we work to protect your family's information.

10. Legal compliance

We design XP Quests to meet the U.S. Children's Online Privacy Protection Act (COPPA), the EU/UK General Data Protection Regulation including its child-specific rules, and the UK Age Appropriate Design Code ("Children's Code"). We seek verifiable parental consent before collecting personal information from a child through an account or a premium feature. Schools may consent on behalf of parents for authorized, non-commercial educational use under a separate agreement.

11. Changes to this policy

If we make material changes, we will update the version and date above and, where required, ask parents to agree again before continuing to use account features.

← Back to XP Quests