Privacy Policy

1. Who is responsible

Operator / data controller: Kian Griffin
Country: Ireland
Postal address: Blackrock, Louth, A91 AK8W, Ireland

Contact: kiangriffin@gmail.com. Privacy enquiries: kiangriffin@gmail.com.

This notice covers QuestForge at questforge.ie.

2. What we use and why

• Account and sign-in details: Supabase stores your account ID, email, account timestamps and information supplied by your chosen sign-in provider, which can include a display name, avatar and provider identifier. Google, Discord and email magic links are enabled. Existing ChatGPT sign-in is also supported. QuestForge uses the verified account ID to find your saved training; we do not receive your Google, Discord or ChatGPT password.
• Your training: class and programme selections, workout volume, assigned sessions, exercise checkmarks, completed workouts and cycles, levels, graduation dates, optional Side Quests, and any resistance/load you log in kg or lb. Logged weight means weight lifted, not body weight. Progress displays are derived from these records.
• Account administration: account first-seen information, membership roles where assigned, and your age confirmation and version/date of Terms acknowledgement. There is no date-of-birth field.
• Feedback and requests: the message, selected category, class/level context and optional reply email you send through our form. These go through FormSubmit to the team’s inbox. Please do not include passwords, medical details or other people’s personal information.
• Optional contributions: if you choose to contribute, Stripe handles payment on its own hosted page. The operator can see the transaction and contact information Stripe makes available, such as payer name, email, amount, status and limited payment-method details, for receipts, support, refunds and financial records. QuestForge does not collect your full card number or security code, attach your training account to the payment, or use payment to decide access.
• Connection and security information: the hosting, authentication and form services receive information needed to handle a request, such as IP address, browser information and request/sign-in events. QuestForge has no separate IP/device tracking or security-log database in its application code.

We do not intentionally request diagnoses, treatment records, wearable health readings, body measurements, precise location, contacts or payment-card details. Training history may reveal information about fitness; avoid adding health details to feedback. We do not use it to diagnose conditions, make medical decisions, or build advertising profiles.

3. Our reasons and legal bases

We use the account and training data needed to provide the service you request under our agreement with you (contractual necessity). This includes signing you in, saving your programme and showing your history and levels. Account support can also be necessary to provide that service. If you choose to contribute, we use transaction information to fulfil that request and handle related support or refunds; accounting and other legally required records are processed to meet legal obligations.

We rely on legitimate interests for proportionate security, preventing abuse, maintaining the service and responding to general feedback. We balance those interests against your rights, and you can object. We may also process information when required by law. Agreeing to the Terms or acknowledging this notice is not consent to ordinary account processing.

Optional device preferences and external media use your specific choice, described below. You can withdraw that choice. If we introduce processing that needs additional consent or a special-category legal condition, we must establish it before that processing begins.

4. Browser storage and optional media

Necessary authentication storage keeps your Supabase session and the one-use sign-in verifier on your device so sign-in works and you stay signed in. A short-lived theme choice carries your selected class through sign-in. A pending age confirmation is kept for the sign-in journey and removed once saved to your account. Workout progress itself is stored on the server, not solely in your browser. Timers are held in memory and reset on reload.

We only remember that you have seen the opening introduction if you choose that option. You can change it using About Quest Forge or Account & privacy. Refusing does not affect workouts. We do not use advertising pixels, Google Analytics or behavioural analytics, and there is no “accept all cookies” banner.

Fonts and exercise illustrations are served with QuestForge. YouTube videos are optional: no player or thumbnail is requested before you choose to load a video. Loading it connects to YouTube/Google, which receives your connection information and may use storage under its own policy, even with the privacy-enhanced player. You can keep the illustrated/text guide instead and unload a video at any time. External guide links open only when you choose them. Sign-in and feedback providers may use their own necessary security cookies or spam checks on their pages.

5. Services that help run QuestForge

• Supabase: account authentication, identity verification and sign-in emails.
• Google and Discord: optional identity providers when you choose their sign-in buttons.
• OpenAI Sites and its Cloudflare infrastructure: hosting, HTTPS delivery and the D1 database that holds workout and account-administration records. OpenAI also handles the retained ChatGPT sign-in route.
• FormSubmit and the team’s email service: delivery and handling of feedback and rights requests.
• YouTube/Google: optional exercise videos that you choose to load.

These services may act as processors for us or as independent controllers for their own accounts, security and services. We do not sell personal information. Optional contributions use Stripe-hosted checkout. Stripe processes payment and security information under its Privacy Policy. No Stripe script, iframe or tracking request loads on QuestForge pages; you connect to Stripe only if you follow the contribution link.

Some providers may process data outside Ireland or the EEA. An Irish domain does not mean all information stays in Ireland. Before public beta, the operator must verify provider contracts, locations, retention and applicable transfer safeguards, such as adequacy decisions or standard contractual clauses, and complete this notice.

6. How long information stays

Active account and training records remain available until you delete the account or ask us to remove them. There is currently no automatic inactivity-deletion schedule. Feedback is retained while needed to handle the conversation and its outcome; the team must review messages and remove those no longer needed.

Account deletion removes the live application records and, for Supabase accounts, requests removal of the sign-in account. A minimal record of the opaque account identifier, deletion status and dates is retained to finish any interrupted deletion and stop old sessions restoring your records. It contains no workouts, email, name or authentication token. Deleting a QuestForge profile does not delete your Google, Discord or ChatGPT account. It also does not automatically erase contribution records held separately in Stripe. Contact us about those records; necessary accounting, dispute and payment-provider records may be retained to meet legal obligations.

Provider backups and security logs are not immediately erased by the button. Limited information may need to be retained to meet a legal duty or handle a dispute. Provider backup/log expiry and the operator’s final retention review schedule still need confirmation before public beta.

7. Your choices and rights

In Account & privacy, you can download your account/training data as JSON. You can request account deletion through Contact. Where automatic deletion is available for your account, the account page also offers it with a deliberate confirmation; otherwise it directs you to Contact. The export does not include provider logs, contribution records held in Stripe or messages held in the inbox; request those separately.

You may ask to access, correct or delete your personal data, restrict processing, object to processing based on legitimate interests, or receive portable data where applicable. You may withdraw any consent without affecting earlier lawful processing. These rights have legal conditions and exceptions. Contact us with your request; we may need proportionate identity verification. Requests are normally answered within one month, with notice if a permitted extension is needed.

You can complain to the Irish Data Protection Commission or your local EU supervisory authority.

8. Age, security and updates

The current beta is for people aged 16 and over. We ask for an age confirmation, not a full birth date. People under 18 still have additional privacy protections. If you believe someone under 16 has created an account, contact us so we can investigate and arrange removal.

We use HTTPS, verified sign-in and server-side account checks to restrict access to saved records. No system is risk-free. Keep your sign-in account secure and tell us about suspected unauthorised access. We will update this notice when the service or its data use changes and draw attention to material changes.