This Privacy Policy explains what personal information EcoQuest collects, how we use it, and the choices you have. EcoQuest is operated by Rachamim Labs Pty Ltd ("the Company", "we", "us", "our"), a company registered in New South Wales, Australia (ACN 700 315 868). We handle personal information in line with the Australian Privacy Principles under the Privacy Act 1988 (Cth).
EcoQuest is a game. We aim to collect only what we need to run it, save progress, and keep accounts secure.
1. What we collect
You can play EcoQuest's free zones as a guest, without an account. As a guest you don't give us an email, and we don't create an account for you. Guest progress bests stay on your device until you sign up. When you finish a geography find or a zone quiz as a guest, we may also store a first-party play attempt under an anonymous device id on your device and link those attempts to your account if you later sign up. We may also record thin first-party product-use events (for example signup or store steps) the same way — still without your email in those records. We may still receive the basic technical information described below (as with most websites). The rest of this section also applies once you create an account.
Information you give us
•
Account details — the email address and password you sign up with. Your password is handled by our authentication provider (Supabase) and stored only in encrypted (hashed) form — we never see it. At sign-up we also ask your age range to confirm you're old enough for an account (13+); we record only a yes/no result and do not store your age or date of birth.
•
Explorer name (optional) — a short pseudonymous display name (letters and numbers only) you may choose to show next to scores. We never ask for your real name.
•
Messages — anything you send us at support@ecoquest.app.
•
Feedback — anything you send through the in-app feedback form. Feedback is anonymous: it isn't linked to your account or email, and we ask you not to include personal details. We use software tools to help us analyse and summarise feedback so we can improve the game.
Information created as you play
•
Gameplay and progress data — your progress, guesses, scores, streaks, species cards and reports collected, Explorer's Log ranks and badges, mastery results where applicable, and which zone packs you've unlocked.
•
Play attempts and product-use events — when you finish a geography find or a zone quiz, we store a first-party record of that attempt (zone, scores, and whether you improved on your previous best). We also record thin first-party product-use events (for example opening signup, confirming email, viewing the store, or starting checkout). If you play as a guest, we store those under an anonymous device id on your device and link them to your account if you later sign up. We use this to understand how the game is played and to improve the product. We do not put your email in these records.
•
Map play is not GPS tracking — when you place a pin on the world map, that is a gameplay guess about a place in the game. We do not collect your device's precise GPS or physical location to play EcoQuest.
What other players can see
•
Leaderboards — if you set an explorer name, that name and the related score may be visible to other players on EcoQuest leaderboards. Email addresses are never shown.
•
Party matches — if you join a friends-only party match, other players in that match can see the shared scoreboard for that session (including display names used in the match). Party matches are not open to strangers.
Payment information — handled by Paddle, not us
•
When you buy a pack, payment is processed by Paddle, our merchant of record. You enter your card or payment details directly with Paddle. We never see or store your full card number. We receive from Paddle only what we need to grant your purchase and keep records — such as a transaction ID, which packs you bought, the amount, and the status (completed or refunded).
Technical information
•
Basic technical data that any website receives — such as your IP address, browser type, general device information, and an approximate region derived from your IP — used to keep the Service secure and working. This is not precise GPS location.
•
Anonymous site analytics — we use Vercel Web Analytics, a privacy-friendly analytics service, to count page views and broad sharing actions in aggregate. A sharing event records only the EcoQuest surface, destination category, and result (for example, whether Copy succeeded). It never includes your name, score, party code, species, email, account ID, or shared text. Vercel Web Analytics sets no cookies and collects no personal identifiers.
Features we may add later
If we introduce optional community emails, we will update this policy (and the effective date) before or when that feature launches. Until then, community email is not active. Our internal inventory tracks what is live versus only authorised for a later build.
2. How we use your information
We use your information to:
•
run your account and save your progress;
•
unlock and deliver the packs you buy, and keep accurate purchase records;
•
send account-service emails (such as signup confirmation, password reset, inactivity warnings, and deletion confirmations);
•
provide support and answer your messages;
•
keep EcoQuest secure, prevent fraud and abuse, and fix problems;
•
understand, in aggregate, how the game is used so we can improve it;
•
look up an individual account's progress when needed for support or operations; and
•
meet our legal, tax, and accounting obligations.
We do not sell your personal information, and we do not use it for third-party advertising.
3. Who we share it with
We share personal information only with service providers who help us run EcoQuest, and only as needed:
•
Paddle — payment processing as merchant of record. Paddle handles your payment details under its own privacy policy.
•
Supabase — our database and authentication provider, which stores your account and gameplay data on our behalf.
•
Vercel — hosting and delivery of the EcoQuest website.
•
Vercel Web Analytics — cookieless, privacy-friendly site analytics. It receives anonymous page-view counts and the limited sharing-event categories described in section 1 — never your email, account details, shared content, or any identifier.
•
Resend — our email delivery provider, which sends account-service emails on our behalf (such as signup confirmation, password reset, inactivity warning, and deletion confirmation) and receives your email address for that purpose.
Studio operators at Rachamim Labs may access account and gameplay records on a need-to-know basis for support and operations. Aggregate metrics may be reviewed in our internal studio tools. Other players only see what section 1 describes (leaderboards and party scoreboards) — not your email, and not a searchable directory of accounts.
If Rachamim Labs is involved in a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction under continuing confidentiality and privacy obligations.
We may also disclose information if required by law, or to protect the rights, safety, and security of our players, the public, or EcoQuest.
4. Children's privacy
EcoQuest accounts are for people aged 13 and over. We ask your age range at sign-up, do not allow account creation below 13, and store only a passed/not-passed result — never an age or date of birth. Guest play does not require an email or account. Guest progress bests stay on the device; guest play attempts and thin product-use events may be stored under an anonymous device id as described in section 1 — we do not ask children for an email. Like most websites, we may receive basic technical information (section 1) from any visitor. We do not knowingly create accounts for children under 13. If you believe a child under 13 has created an account, email support@ecoquest.app and we will delete the account and its data. Parents and guardians of teens can contact the same address to review, correct, or delete their teen's information.
5. Cookies and similar technologies
EcoQuest uses only the cookies and local storage needed to keep you signed in, remember your session, store guest progress on your device, remember optional preferences, and process payments securely through Paddle. We don't use advertising or cross-site tracking cookies. Vercel Web Analytics is cookieless — it sets no cookies and stores nothing on your device.
6. Where your information is stored
EcoQuest uses service providers (Supabase, Vercel, Paddle, and Resend) that may store and process data on servers outside Australia, including in other countries. Where information is transferred overseas, we take reasonable steps to ensure it is handled consistently with this policy and applicable privacy law.
7. How long we keep it
We keep your account and gameplay data while your account is active, and we don't keep personal information indefinitely:
•
Inactive accounts are deleted automatically. If you don't sign in for 18 months, we delete your account and its personal data. We email a warning to your address at 17 months so you have the chance to keep the account by signing in.
•
Deletion requests are confirmed by email. When you request deletion in the app, we send a single-use confirmation link that expires after 24 hours. Opening the link does not delete anything; you must confirm on the secure page. We keep only a hashed token for retry safety after deletion and remove the email from that record.
•
Purchase records are kept, but anonymised. We keep purchase and transaction records for as long as tax, accounting, and legal obligations require. When your account is deleted (by you or by the inactivity process), those records are anonymised — the link between them and you is removed.
•
When we no longer need information, we delete or de-identify it.
8. Security
We take reasonable steps to protect your information — including access controls and storing data with reputable providers — and we intentionally minimise what we hold. No online service can promise perfect security. If a data breach is likely to cause serious harm, we will take steps required by Australian law (including notifying the Office of the Australian Information Commissioner and affected individuals where required) and work to contain and remediate the issue promptly.
9. Your rights and choices
You can:
•
access the personal information we hold about you (including asking for a copy);
•
correct it if it's wrong;
•
delete your account and associated data — yourself, at any time, using "Delete my account" on the account screen and confirming the emailed link, or by emailing us; and
•
ask questions or raise a privacy complaint with us.
To do any of these, email support@ecoquest.app. We aim to respond within 30 days. Note that we may need to keep certain purchase records to meet legal obligations even after you delete your account. Depending on where you live, you may have additional rights under your local privacy laws (for example access, correction, deletion, and portability under the GDPR in Europe); we honour those rights where they apply to the services we provide.
If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (oaic.gov.au) — our primary privacy regulator in Australia.
10. Changes to this policy
We may update this policy from time to time. We'll change the effective date at the top and, for significant changes, give reasonable notice. New collection (such as optional community email or richer play analytics) will not go live under an outdated notice.
11. Contact us
Questions or requests about your privacy? Email
support@ecoquest.app — it reaches Rachamim Labs Pty Ltd directly. See also the
contact page.