QUESTIFY PRIVACY POLICY Your quests are personal. We treat them that way. Effective August 4, 2026 This policy explains how Reilly Ventures Pty Ltd handles information when you use the Questify iPhone app and these support pages. INFORMATION WE COLLECT Account and profile We collect the email address used to create your account, a user identifier, display name, optional age if you choose to provide it, selected genre and character presentation, and preferences such as sound and reminder settings. Quests and game activity We store the quests, goals, and notes you choose to enter, including difficulty, completion status, and timestamps. We also store game progress such as XP, level, streaks, achievements, tutorial status, avatar progress, and share-card export counts so your experience can sync across sessions and we can understand whether the sharing feature works. Private Guilds If Guilds are available to your account and you choose to use them, we store your Guild username, Guild membership and role, invitation and join-request status, your Guild-visible hero (a link to your personalized hero game art when you have created one, otherwise a standard stage-hero identity), daily check-in participation and quest counts when you allow them, preset Bumps, Group Streak and weekly boss progress, privacy choices, and reliability receipts. Guilds do not receive quest names, notes, email addresses, exact completion timestamps, source selfies, or timezones. You can report a Guild member, join request, Guild Pass, or inappropriate Guild identity and can block another Guild user. Reports contain a preset reason and limited contextual evidence for moderation, abuse prevention, user safety, and enforcement. Blocks stop new Guild requests, passes, and Bumps between the two accounts. Voice input and planning If you use voice entry, Questify uses Apple's speech-recognition technology to turn microphone audio into text. Depending on your device and Apple settings, Apple may process that audio under Apple's terms. Questify uses the resulting transcript as Plan Your Day text and does not save the raw audio recording in Questify storage. Questify's Orb and Next Moves use OpenAI's gpt-4o-mini model through Questify's own server. AI planning is off unless you turn it on. We ask for your explicit consent first and explain what is sent; you can withdraw that consent at any time in Settings. If you have not turned it on, Questify does not send your task text, goals, or voice transcripts to any third-party text-generation provider, and you can continue using the manual task list. When AI planning is on, what is sent is the text you are planning with — your brain-dump or Main Quest, plus recent task titles for context — passed through Questify's own server to OpenAI. Your email address, account identifier, and payment information are never sent. OpenAI states that API inputs are not used to train its models by default, and may retain API abuse-monitoring data for up to 30 days. Questify does not keep a copy of the request beyond what is needed to return your tasks, and your prompts are never written to Questify's logs. Generated responses may be cached on your device for speed and are treated as expired after about one hour. Purchases If you buy a premium subscription, Apple processes the payment. Questify receives product, transaction, entitlement, and expiration information needed to unlock and restore the purchase. We do not receive your full payment-card number. Optional selfie and personalized avatar Personalized avatars are optional. Immediately before upload, Questify asks you to confirm that the photo is of you and to consent to it being sent to OpenAI solely to create your personalized hero. The selfie is uploaded to private Questify storage, safety-screened, and used to forge the first identity-bearing base character. Questify does not use it to identify you, advertise to you, track you across apps, or train models. After the base character is created—or if the generation attempt ends—Questify automatically attempts to delete the source selfie, clear its storage reference, and remove the temporary integrity fingerprint used to confirm the image did not change between screening and generation. Later stages and poses are built from the generated base character, not from the selfie. Generated character artwork and generation status remain with your account until you delete your account. OpenAI states that API inputs are not used to train its models by default. OpenAI may retain API abuse-monitoring data, which can include image inputs, for up to 30 days unless shorter approved retention controls apply, and may retain flagged content where required for safety review or law. Device and service information Our hosting and security providers may process basic network and request information, such as IP address, device or browser type, timestamps, and error logs, to operate, secure, and troubleshoot the service. Questify does not include an advertising SDK or collect a remote push-notification token. If you opt in to the daily reminder, it is scheduled locally on your device. HOW WE USE INFORMATION • Authenticate your account and provide, save, and sync Questify. • Calculate progress, streaks, rewards, and personalized game states. • Transcribe voice input and provide task suggestions or daily planning when you request them. • Generate an optional personalized avatar at your direction. • Verify, restore, and administer App Store subscription access. • Operate private Guild membership, cooperative progress, invitations, preset Bumps, safety reports, blocks, and moderation. • Prevent abuse, maintain security, diagnose failures, and answer support requests. • Meet legal obligations and enforce the Terms of Use. WHEN INFORMATION IS SHARED Inside a private Guild, members see your Guild username, your hero (your personalized hero game art if you have created one, otherwise a standard stage hero), membership role, and progress signals you choose to share. Guilds are invite-only rooms of up to six people, and your hero is always visible to them while you are a member. Small-group totals can sometimes imply participation even when an exact count is private. Quest text, notes, email, source selfies, exact times, and timezone are never shared with Guildmates; leaving a Guild removes your hero from it. A one-use Guild Pass shows limited invitation basics to the person holding it until it is used, revoked, or expires. We do not sell personal information, share it for cross-context behavioral advertising, or use it for third-party advertising. We disclose only what is needed to service providers acting for Questify: • Supabase provides authentication, database, file storage, and server functions. • Apple provides speech recognition, App Store payments, and purchase-validation information. • OpenAI processes the text you are planning with, but only if you turn on AI planning and give the separate consent described above. OpenAI separately processes a temporary selfie only when an eligible user requests personalized avatar generation and gives that feature's own consent. We may also disclose information when required by law, to protect users or the service, or as part of a business transfer subject to appropriate safeguards. RETENTION AND DELETION Account, quest, progress, generated-character, entitlement, and active Guild membership data is retained while your account is active or as needed to provide Questify. Expired Guild Passes, rate limits, and operational receipts use shorter cleanup windows. Safety reports, moderation actions, and limited pseudonymous Guild history may be retained longer where reasonably needed to investigate abuse, prevent repeat harm, preserve already-earned cooperative history, resolve disputes, or comply with law. Source selfies and their temporary integrity fingerprints follow the shorter deletion process described above. OpenAI's separate API safety-log retention may last up to 30 days. Questify does not store raw microphone recordings. Limited records may be retained where required for fraud prevention, transaction integrity, security, or law. You can permanently delete your Questify account from Settings → Account Actions → Delete Account. Account deletion does not cancel an Apple subscription; subscriptions must be managed separately in your Apple ID settings. Apple may retain its own transaction records under Apple's policies. YOUR CHOICES You can edit profile and app preferences in Settings, turn the local daily reminder off at any time, decline the personalized-avatar feature, choose Guild sharing preferences, report or block Guild users, restore an eligible purchase, leave a Guild, or delete your account in the app. You may also contact us to ask about access, correction, deletion, or another privacy right that applies where you live. CHILDREN Questify is for people age 13 and older and is not directed to children under 13. We do not knowingly collect personal information from a child under 13. SECURITY AND INTERNATIONAL PROCESSING We use access controls, private storage for selfies, authenticated requests, and other reasonable safeguards. No method of storage or transmission is completely secure. Service providers may process information in countries other than your own, subject to their contractual and legal safeguards. CHANGES AND CONTACT We may update this policy as Questify changes. We will update the effective date here and provide any additional notice required by law. Privacy questions: taylor@reillytalent.com Terms of Use: https://questify.supabase.co/functions/v1/questify-legal/terms Support: https://questify.supabase.co/functions/v1/questify-legal/support