Privacy policy

1. Controller

Dmitry Zaytsev, Quespy (sole proprietorship), Gestütring 16, 85435 Erding, Germany. Email: privacy@quespy.com. No data protection officer is required for a business of this size.

2. What we collect and why

• Website visit: IP address, browser, time and requested page. This data is kept in server logs for up to 7 days and serves the security of the site (Art. 6 (1) f GDPR). Hosting: Amazon Web Services, on servers in the European Union.
• Waitlist: your email address, to invite you to early access before launch and to notify you when Quespy launches (Art. 6 (1) a GDPR, consent). We send a confirmation email first (double opt-in) and store the time and IP address of your consent. You can unsubscribe at any time via the link in every email or by writing to us.
• Author early access: name, email address, city or region and your project idea, to get in touch about author access (Art. 6 (1) a GDPR). We store the time and IP address of your consent. We delete this data after 12 months if we have not been in contact.
• Bot protection: our forms use Cloudflare Turnstile, which processes technical browser data to tell humans from bots (Art. 6 (1) f GDPR). Cloudflare, Inc. is bound by EU standard contractual clauses. See Cloudflare's privacy policy.
• Email delivery: our emails are sent through Amazon Web Services under a data processing agreement. Bounces and complaints are recorded to keep our sending compliant.
• Statistics: anonymous page statistics through PostHog, hosted in the European Union, without cookies, to see which sections people read (Art. 6 (1) f GDPR). You can switch this off at any time under Cookie settings.
• Quespy app: account data (email address, display name), purchased tours and your progress. Only while a tour is running and with your permission, the app uses the location of your device to show your position on the map. The location is not stored on our servers.
• Purchases: Quespy will offer subscriptions for users and for authors, and paid self-guided tours that are bought separately, on this website and in the apps. Nothing is on sale yet. Payments on the website will be processed by Stripe; purchases in an app are processed by the Apple App Store or Google Play. We never see your full card details.
• Contacting us by email: when you write to us, we use your message and your address to answer you (Art. 6 (1) b or f GDPR).

3. Cookies

quespy.com sets only strictly necessary cookies and local storage (your choice on the cookie settings page, the Turnstile check). Page statistics are anonymous and use no cookies; you can switch them off at any time under Cookie settings. We set no advertising cookies.

4. Recipients and transfers

We share data only with the processors named above. Where a processor is located outside the EU, the transfer relies on EU standard contractual clauses or on an adequacy decision (EU-US Data Privacy Framework). We never sell personal data.

5. Retention

Waitlist: until you unsubscribe, at the latest 6 months after launch. An address that is not confirmed is deleted after 30 days. After you unsubscribe we keep the address, with the time and IP address of your consent, for another 3 years to be able to prove that consent (Art. 6 (1) f GDPR), and send it nothing more; then we delete it. Author requests: 12 months without contact. App account: until you ask us to delete it; we then erase it within 30 days. Legal retention duties (for example for invoices, 10 years) take precedence.

6. Your rights

You have the right to access, rectification, erasure, restriction of processing and data portability. You can object to processing that is based on a legitimate interest. You can withdraw consent at any time with effect for the future. Write to privacy@quespy.com. You may also complain to a supervisory authority; the one responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA) in Ansbach.

7. Children

Quespy is designed for explorers aged 12 and up. Anyone under 16 needs a parent's or guardian's consent to create an account (Art. 8 GDPR).