Skip to content
QuestMaxx

Privacy

Last updated 7 October 2026

QuestMaxx is made in the UK. This page covers this website and the QuestMaxx iPhone app. If something here isn't clear, email support@questmaxx.co.uk. QuestMaxx is run by Billy Knowles, a sole trader in the United Kingdom, who is the data controller.

Who it's for

QuestMaxx is for people aged 16 and over. The app asks your date of birth when you start and won't go further if you're under 16. If you're 16 or 17, some quests are hidden from you, for example anything involving strangers, being out at night, travelling alone, or places that serve alcohol. Under-18s also get extra protections, described below: no notifications between 9pm and 8am, only non-personalised ads, usage data off by default, and no photo of theirs ever shown to an adult.

This website

The waitlist

If you join the list we store your email address, the page you signed up from, and, if you arrived from a link that carried them, the link's source tags and the site you came from. We use it to send you one email when the app is out. We don't sell it or pass it on. Email us to be removed at any time.

What the site stores on your device

No cookies. The waitlist form keeps one small item in your browser's session storage: the source tags and referring site from your first page view, so they're still there if you read this page and come back. It's used only to attach to your signup if you join, and your browser deletes it when you close the tab.

Stopping abuse

To stop the signup form being flooded we keep a scrambled version of your connection's IP address for up to two days. It can't be turned back into the address.

Website analytics

When it's switched on, we use PostHog to count visits and see which parts of the page people use. It runs in a mode that sets no cookies and stores nothing on your device for analytics, which is why there's no cookie banner. PostHog processes your IP address to do this; we've set it up in the EU. We don't record sessions or build a profile of you. Invite links (/add and /join) run no analytics at all.

The app: what we collect

  • Your date of birth, to check you're 16 or over and to decide which quests you can see.
  • A name for Maxx to call you (your display name). Anything you like, except web links.
  • What you do in the app: quests offered, accepted, finished, skipped and shared, your XP, badges and streak, and your timezone so days roll over at the right time.
  • Proof photos you take when you finish a quest (see Photos).
  • Your Apple ID details, if you save your progress with Sign in with Apple. We get a token and your email (or Apple's private relay address). We never see your Apple password.
  • Friends, Groups and reports, if you use them (see below).
  • A notification token, if you allow notifications.
  • Subscription and ad records, if you subscribe or watch a rewarded ad.
  • Usage data, unless you turn it off (see Usage data).

Guest accounts

When you first open the app you get a guest account so you can play straight away. If you don't save it with Apple and don't open the app for 120 days, the guest account and everything in it is deleted automatically.

Share cards

Share cards are made on your phone. They carry no name or location, and include a photo only when an adult chooses to add one. We don't receive the card unless you send it somewhere yourself.

Photos

  • When you finish a quest the app makes a fresh JPEG of your photo and removes any location data before upload.
  • You can only upload a photo for a quest you're currently doing.
  • Photos are stored privately. They aren't publicly reachable, and are shown only through short-lived links to people allowed to see them.
  • Proof photos are deleted 90 days after you upload them, unless you keep one in your Scrapbook. A kept photo stays until you remove it or delete your account. Uploads that never get attached to a finished quest are deleted after 7 days.
  • Your friends and group-mates see your quest photos from the last 7 days, and only when your "Show my quest photos" switch is on (Profile, then Privacy). It's on by default for adults and off by default for under-18s. A photo from an under-18 is never shown to an adult.

Friends and Groups

Friends and Groups need a saved account. Friends see your display name, XP, badges and finished quests. In a Group, the other members see each member's display name, level, whether they're an adult or under 18, and the Group quests they finish (with any vouches) for 7 days. The Group's name and member list are visible to members, and group names can't contain web links. The Group's owner also sees the name, level and adult or under-18 status of anyone who asks to join. Adults can't send friend requests to under-18s, and people on different sides of the age line can only share a Group if they're friends; otherwise one of them is removed from the Group.

Reports and bans

You can block anyone, and reporting someone blocks them too. You can report a person, a quest or a Group. A report can include the reported photo and a short note from you. We keep reports so we can review them, even if the reported person later deletes their account. If you delete your account, reports you made are kept too, without the link to you. Your feedback reports about quests are deleted with your account. A report keeps a copy of their display name at the time and a one-way scrambled (SHA-256) form of their Apple sign-in identifier. If someone is banned they lose social features, and the scrambled identifier of their Apple ID is kept so a new account can't be made with it. It can't be turned back into the Apple ID.

Notifications

If you allow them, we send a daily nudge and a streak reminder from Maxx (scheduled on your phone; change them in the notification settings in Profile) and, from our servers, notifications for friend requests, accepted requests, challenges, and Group invites, join requests, quests and results. The nudge and streak reminder are on by default for adults and off by default for under-18s, who can turn them on. Under-18s get no notifications between 9pm and 8am their time. Your notification token is deleted when you delete your account or when it stops working. You can turn notifications off in iOS Settings.

QuestMaxx+ subscriptions

QuestMaxx+ costs £2.99 a month or £19.99 a year (or the local price shown in the App Store), auto-renews, and has no free trial. Apple takes the payment and RevenueCat manages the subscription status; we receive your subscription status and purchase records, never your card details. You cancel in iOS Settings, under your name, then Subscriptions. Deleting your QuestMaxx account does not cancel an Apple subscription.

Usage data (analytics)

We use PostHog, set up in the EU, to see which quests and screens work. It uses a random id, with no names, photos or friends. It is on by default for adults and off by default for under-18s, who can turn it on. The switch, "Share usage data", is in Profile, then Privacy. Until an under-18 turns it on, usage data queued on the phone is deleted, not sent. Your usage records are deleted when you delete your account.

Ads

QuestMaxx only shows rewarded ads, and only when you choose to watch one. Ads may not be switched on in every version of the app, and they aren't switched on yet. When they are, they'll be served by an ad network (such as Google AdMob or AppLovin MAX) that we'll name on this page before ads go live.

  • Adults will be asked to choose "Picked for me" or "General ads", and Apple's own tracking prompt may also appear. You can change the choice later in Profile, then Privacy.
  • Under-18s aren't asked: they only ever get general, non-personalised ads.
  • If you're in the US, choosing "General ads" means we tell the ad network not to sell or share your data. We don't sell personal data.
  • We keep a record of each ad reward, so we can give you the reward, for up to 90 days.

Why we're allowed to use your data

Under UK and EU GDPR we need a lawful reason for each use of your data. In plain terms:

  • Running your account, quests, friends and Groups, and subscriptions: to provide the app you asked for (contract).
  • Safety, moderation, keeping reports and banned-ID hashes, and preventing abuse and cheating: our legitimate interest in keeping the community safe, especially for under-18s.
  • Usage data (analytics): for adults, our legitimate interest in improving the app, with an off switch. For under-18s, only with their choice to turn it on (consent).
  • Personalised ads: your consent.
  • Legal obligations, where they apply.

Who processes your data

These companies handle data on our behalf:

  • Supabase: our database, sign-in and photo storage. The database and photo storage are in the EU (Ireland).
  • Cloudflare: hosts this website, and processes visitors' IP addresses to serve it.
  • PostHog: usage data and website analytics, hosted in the EU.
  • RevenueCat: subscription status and purchase records.
  • Apple: Sign in with Apple, payments and notification delivery.
  • Expo: delivers push notifications to your phone.
  • An ad network, when ads are on (such as Google AdMob or AppLovin MAX; we'll name it here first).

Some of these companies are based in, or can access data from, countries outside the UK and EU, including the US. Where that happens we rely on standard contractual clauses (the UK and EU versions) or an equivalent safeguard. We don't sell your data.

How long we keep things

  • Proof photos: 90 days, unless kept in your Scrapbook. Abandoned uploads: 7 days.
  • Unsaved guest accounts: removed after 120 days without opening the app.
  • Account data (progress, friends, Groups, tokens): until you delete your account.
  • Ad reward records: up to 90 days.
  • Reports, and the scrambled Apple identifier of banned accounts: kept for as long as needed to keep people safe.
  • Waitlist emails: until we send the launch email or you ask to be removed.

Deleting your account

In the app: Profile, then Delete account (under Settings). It removes your account, history, XP, photos, friends, Group memberships, any Groups you own (and their boards), notification token and usage data, and your RevenueCat customer record. If you used Sign in with Apple, it also revokes QuestMaxx's access to your Apple ID; you'll be asked to sign in with Apple once to confirm. It can't be undone. Reports made about you are kept, as described above. Deleting doesn't cancel an Apple subscription, so cancel that in iOS Settings. Or email us and we'll do it.

Your rights

Wherever you live, email support@questmaxx.co.uk and we'll help.

  • UK GDPR and EU GDPR: you can ask for a copy of your data, ask us to correct or delete it, object to how we use it, and ask for it in a portable form. You can complain to the Information Commissioner's Office at ico.org.uk, or to your local data protection authority.
  • United States: under California's CCPA/CPRA and similar state laws you can ask to know what we hold, delete it, correct it, and opt out of sale or sharing. QuestMaxx doesn't sell personal data.
  • Canada: under PIPEDA you can ask to see and correct your personal information, and complain to the Office of the Privacy Commissioner of Canada.
  • Australia: under the Privacy Act 1988 and the Australian Privacy Principles you can ask for access and correction, and complain to the OAIC.
  • New Zealand: under the Privacy Act 2020 you can ask for access and correction, and complain to the Privacy Commissioner.

Changes

If this page changes in a way that matters, we'll say so in the app. The date at the top is when it last changed.