Privacy Policy
Effective 2026-08-12. This policy describes the shipped architecture. It is undergoing formal legal review; if the reviewed version changes anything material, the change lands here first.
What we store
- Account data. A stable account identifier and, if you provide it, your email address. Authentication is handled by our own identity service (id.getquest.gg); if you sign in with Google, Google confirms your identity to us and learns that you signed in — nothing more is exchanged.
- Your workspace. Boards, goals, canvas cards and the links between them, stored in our sync database and access-controlled to your identity at the row level. Life check-ins and diary text are always end-to-end encrypted; board, goal and canvas text is end-to-end encrypted once you set up encryption keys. The security page states exactly what is and isn’t covered.
- Your files. Envelope-encrypted at rest, in a storage namespace that belongs to you alone. Deleted files are purged from the index after 30 days in trash.
- Operational events. Per-account event streams (for sync) scoped to your identity.
- Billing data. Payments are processed by Stripe (our payment processor). We store a customer reference and your subscription state; card numbers never touch our servers.
- Backups. Encrypted backups of the service are taken nightly and restore-tested; they exist so your data survives us making a mistake, and are subject to the same access controls as the live service.
What we never do
- No third-party trackers, analytics scripts, or ad pixels — on this site or in the app. This website makes no external requests and runs no third-party code; its only JavaScript is a few inline snippets (theme, scroll animation) readable in the page source.
- No external font or CDN requests; assets are self-hosted.
- No selling or sharing of your data. There are no advertising partners.
- No reading your workspace to build profiles, train models, or “improve the service.”
The AI companion
The companion only reads your workspace when you ask it something. The relevant slices are sent through our server to an AI model to produce the answer, and every reply shows a manifest of exactly what left the device and a provenance line naming the model that wrote it. Nothing is sent without your action.
Which model depends on the job and on the brain tier you choose in Account → Companion. Our AI subprocessors are: Anthropic (planning, safeguards, card minting, and reading documents with page citations — direct); and, through OpenRouter (our model router), Meta (Muse Spark — reading and tutoring), Together AI / Fireworks AI (US hosts running the open-weight GLM models — chat on the Open tier, titles, memory distillation), and Cerebras (running the open-weight gpt-oss model — formatting, search rewrites, and judging which of the vault passages a search returned actually answer your question, on the Open and Frontier tiers), and Google (Gemini Flash — plain chat on the Open tier, through Google’s paid API, which does not train on requests). Every routed request carries the router’s no-training and no-retention flags and is pinned to the named host; none of these providers trains on your requests. Free-tier and consumer subscriptions are never used.
If you bring your own API key (Anthropic or OpenRouter), your requests go from your device to that provider under your own agreement with them and never through our server; the same provenance line tells you which model answered.
Sessions
Access tokens are held in memory only — never in localStorage. A signed, HttpOnly, same-site refresh cookie lets your session resume after a reload; signing out revokes it everywhere, immediately.
Your rights, as endpoints
Export and deletion are implemented in the product, not just promised here: you can export your vault in full, and you can delete your data outright. Deletion of your storage namespace is immediate; trashed files age out after 30 days.
Changes
If this policy changes, the change lands here with a new “last updated” date before it takes effect.
Contact
Questions about this policy: hello@getquest.gg.