Privacy Policy
The short version: a parent creates the only account (email + PIN). Kids never get an email, a password, or an account of their own — they're set up by the parent with just a first name and a chosen character, and join a device with a short pairing code. We don't show ads, we don't use third-party analytics or ad trackers, and we don't sell data. Apple only ever sees what it needs to bill the subscription.
Who we are
MyQuests is an app made by Winn.solutions ("we", "us"). This policy explains what information MyQuests collects, why, and the choices and rights you have — especially around your children's information, since MyQuests is a family app.
What we collect
About the parent (the account holder)
- Email address — used to sign you back in and to identify your family's account.
- PIN — stored only as a salted cryptographic hash (PBKDF2-SHA256). We never store your PIN in plain text and cannot recover it if you forget it.
About children
For each child profile, we collect only:
- a first name or nickname the parent enters, and
- a chosen in-game character/avatar.
That's the entire child data model. We do not collect a child's email address, we do not create a login, password, or account for a child, and we do not collect photos, precise location, or any other personal information from or about a child.
Game and account activity
To run the app we store quest completions, parent approvals, and a gold ledger tied to your family's account, plus your subscription/trial status. This activity is associated with your family account and a child's first name — not with any additional identifying information, because we don't collect any.
What we do not collect
We do not collect payment card details (Apple handles all billing — see "How we share information" below), precise location, contacts, photos/camera access, or advertising identifiers.
Why we collect it
- To create and secure your parent account and let you sign back in.
- To run the core app: quests, approvals, the gold economy, and rewards.
- To run your free trial and, if you subscribe, to know which plan is active.
Children's privacy (COPPA)
MyQuests is designed around the Children's Online Privacy Protection Act (COPPA, 16 CFR Part 312) from the ground up, not bolted on after the fact:
- Only a parent can create an account. A child never fills out a sign-up form, enters an email address, or sets a password.
- Pairing, not credentials. To use a device, a child enters a short one-time pairing code the parent generates in the app — the code is not personal information and expires quickly.
- Parental consent. When a parent creates an account, they must affirmatively check a consent box agreeing to this notice and to their child's first name and chosen character being used in the app. We record that consent (timestamp + the notice version shown above).
- No ads. MyQuests does not show advertising to children or adults.
- No third-party analytics or trackers. We do not embed third-party advertising SDKs, analytics trackers, or social widgets that would collect data about your family across other apps or sites.
- We never sell personal information — about a child or a parent — to anyone, for any reason.
This is a data-minimization posture: because we only ever collect a first name and a character choice for a child, we've scoped this policy — and our systems — to match, rather than collecting more and asking for broader verified parental consent under 16 CFR §312.5.
How we share information
We share the minimum necessary with one processor:
- Apple — your subscription (Single or Family plan) is billed entirely through Apple's In-App Purchase system. We never see or store your card details; Apple handles payment and shares back only the subscription status needed to keep your account active.
We do not share, rent, or sell family or child data to advertisers, data brokers, or any other third party. If we ever turn on optional account-verification email (a capability that exists in our systems but is currently disabled), it would be sent through a transactional email provider solely to deliver a one-time verification code to the parent's email address — never for marketing, and never involving a child's information.
Data retention
We keep your family's data for as long as your account exists. Canceling a subscription stops billing but does not delete your data automatically — your account and history stay intact in case you come back. If you want your data removed, use Delete account (below), which is immediate and permanent.
Your rights and choices
As the parent account holder, you can at any time, from inside the app:
- Export your data. Settings → Privacy → Export data gives you a complete copy of your family's account, configuration, quest/approval history, and gold ledger.
- Delete your account. Settings → Privacy → Delete account permanently and immediately removes your family's account and everything tied to it — sessions, paired devices, quest and approval history, the gold ledger, subscription/entitlement record, and consent record. This cannot be undone.
Because children never have their own account or email, these rights are exercised entirely by the parent on behalf of the whole family — there's no separate child login to manage.
Security
PINs are never stored in plain text (salted PBKDF2-SHA256 hashing). Sessions and device-pairing tokens are randomly generated, short-lived, and scoped to your family's account only — no request can read or change another family's data.
Changes to this policy
If we materially change what we collect or how we use it, we'll update this page and the notice version number above, and — for changes affecting children's data — ask parents to re-consent in the app.
Contact us
We're finalizing a dedicated support/privacy contact address. In the meantime, please reach us through the Support page.