< BACK

SIDEQUEST

PRIVACY

Last updated: 10 November 2026

Sidequest is a small game for Junction 2026 in Helsinki. We collect as little as we can: no email address, no real name, no location, no tracking cookies. This page explains what we do store, why, and what you can do about it.

WHO IS RESPONSIBLE

Sidequest is a private, non-commercial project by Moritz Kraus. It is not run by the Junction organizers.

Moritz Kraus
Scharnweberstraße 118
13405 Berlin, Germany
Email: hello@playsidequest.quest

Email or write to us for anything privacy-related.

WHAT WE STORE

When you claim your handle

  • Your handle and your avatar (a preset, or a selfie you take).
  • An anonymous account ID. We never ask for your email or name.
  • Your spare key. We only keep a hash of it, so we can't read it or send it to you again.

When you play

  • Quest photos you upload, and when you uploaded them. Photos are re-encoded in your browser before upload, which removes metadata such as GPS location.
  • Realmoji selfies, RESPECT reactions, comments and reports you make.
  • Which quests you've completed, and the XP and level that follow from them.

If you turn on notifications

  • A push subscription for your device (an address and keys issued by your browser's push service). Turning notifications off deletes it.
  • When someone comments on or sends a Realmoji to one of your photos: a short note (who, which photo, when) so we can notify you. It's deleted a day after the notification went out.

Technical data

  • Your IP address, browser type and request times, processed by our hosting providers to deliver the app and keep it secure (server logs).
  • Cloudflare Turnstile checks whether a sign-in comes from a human or a bot. It processes technical signals from your browser for that check only.
  • Anonymous usage statistics with Umami: which pages are opened, when, the referring site, and your browser, device type and country. We also count a few in-app actions (for example "quest completed", "RESPECT given", "upload failed"), with only the quest name or similar labels attached, never your handle, photos or comments. Umami sets no cookies and stores nothing on your device. Your IP address is only used to derive the country and an anonymous visitor count (hashed with a value that changes daily) and is not stored. This data is never linked to your handle or account. If your browser sends "Do Not Track", nothing is recorded.

WHO CAN SEE WHAT

  • All signed-in players see your handle, avatar, level, XP and rank, your quest photos, Realmojis and comments.
  • The public landing page shows the number of players and some preset avatars, never handles or photos.
  • Organizers (admins) can also see hidden content and reports, and can hide photos, selfies and comments.

Please keep in mind that other players can see, and could screenshot, anything you post.

PHOTOS OF OTHER PEOPLE

Some quests ask for a photo together with someone. Only post a photo of another person if they agree to it. If you're in a photo you don't want online, report it in the app (⋯ → Report) or contact us, and we'll take it down.

WHY WE PROCESS YOUR DATA

  • To run the game you signed up for (Art. 6(1)(b) GDPR): your account, handle, avatar, photos, reactions, comments, XP and leaderboard. Without these, the game doesn't work.
  • To keep the game safe (Art. 6(1)(f) GDPR, our legitimate interest in preventing abuse): bot protection, rate limits, server logs, reports and moderation.
  • To improve the game (Art. 6(1)(f) GDPR, our legitimate interest in knowing which parts of the app are used): anonymous usage statistics without cookies.
  • Notifications only if you turn them on (Art. 6(1)(a) GDPR, consent). You can turn them off at any time on the Quests tab or in your device settings.

There is no automated decision-making or profiling, no ads, and no analytics that identify you.

COOKIES

We only use cookies that are strictly necessary: one to keep you signed in (Supabase session) and those Cloudflare Turnstile needs for bot protection. No tracking or advertising cookies; our usage statistics work without cookies.

SERVICE PROVIDERS

We use these providers to run Sidequest. They process data only on our behalf and under data processing agreements:

  • Supabase Inc.

    Database, accounts, photo storage

    Data stored in Stockholm, Sweden (EU)

  • Vercel Inc.

    Hosting the app

    Servers in Stockholm, Sweden (EU)

  • Cloudflare Inc.

    Bot protection (Turnstile)

    Global network

  • Umami Software, Inc.

    Anonymous usage statistics (Umami Cloud)

    EU data region

  • Apple, Google, Mozilla, Microsoft

    Delivering push notifications (depends on your browser)

    Global

Our data is stored in the EU. Some of these companies are based in the US, so data may be accessed from there (for example for support or security). These transfers are covered by the EU–US Data Privacy Framework and/or the EU Standard Contractual Clauses.

HOW LONG WE KEEP IT

Everything you created in Sidequest is deleted on 30 November 2026:

  • Photos, selfies, comments, reactions and reports. Save the photos you want to keep before then (on your profile page via SAVE / SAVE ALL).
  • Accounts, handles, spare keys and game stats.
  • Push subscriptions, unless you turned notifications off earlier (then they're deleted right away).

Anonymous usage statistics don't identify anyone and are deleted when we close the Umami account after the event, at the latest with the rest of the game data.

Server logs are kept according to our hosting providers' log retention, typically a few days to a few weeks.

YOUR RIGHTS

Under the GDPR you have the right to:

  • access the data we hold about you, and get a copy of it;
  • have incorrect data corrected;
  • have your data deleted, e.g. a single photo or your whole account;
  • restrict or object to processing;
  • data portability (get your data in a common format);
  • withdraw consent at any time (notifications), without affecting earlier processing.

Contact us at the address above and tell us your handle. Because there's no email or name on your account, we may ask you to prove it's yours, e.g. by showing your spare key in person at the venue.

You also have the right to lodge a complaint with a data protection supervisory authority, for example in the EU country where you live.

CHANGES

If we change this page, we'll update the date at the top. If a change matters, we'll tell you in the app.