Privacy Policy

Effective date: July 28, 2026 · Last updated: July 28, 2026 · Version 2.1

1. Who we are

QuestPal is operated by Jack Le (doing business as "QuestPal"), located at 740 Whidbey St, Melbourne, FL 32904, United States. We operate from the State of Florida, USA.

Privacy contact: questpalapp@gmail.com

2. Scope

This policy covers the QuestPal mobile application, this website, our beta testing program, and support communications with us (such as email and in-app feedback).

3. Children and parental consent

QuestPal accounts are created and managed by a parent or legal guardian. Children may provide homework questions, images, voice input, mood check-ins, and other learning content while using the Service under a parent's supervision. For children under 13, we require parental notice and verifiable parental consent before collecting personal information, except where an applicable legal exception permits otherwise.

How consent works. Before a child profile becomes active, the app shows the parent a direct notice describing the categories of child information collected — including disclosure of homework content to our AI provider — and requires an affirmative consent step (a checkbox plus a confirmation button) from the authenticated parent account. We keep a record of each consent: the parent account, date and time, the policy version accepted, the consent method, the categories of child information authorized, and whether disclosure to the AI provider was authorized.

Withdrawing consent. You may withdraw consent at any time by deleting the child's profile or your account in Settings → "Delete Account & All Data", or by emailing questpalapp@gmail.com from your registered parent email. Withdrawing consent ends further collection and we will delete the associated child data.

4. Information we collect

Provided by the parent:

• Your email address and sign-in credentials (or your Google account email if you sign in with Google)
• Your Parent PIN (stored in our database to sync across your devices)
• Child profile details you enter: first name, age, grade, and subject focus. We do not ask for a child's last name, photo, email, or address.
• Feedback and support messages you send us

Generated while your child uses the app:

• Homework questions typed by your child, and the AI tutor's responses (conversation history)
• Homework photos — processed transiently to read the problem; not stored (see Section 6)
• Voice input — transcribed to text on your device; raw audio never reaches our servers (see Section 6)
• Mood check-ins, daily quests, StarCoins, streaks, and badges

Collected automatically:

• IP addresses and sign-in events in authentication and security logs
• A push-notification registration token, if notifications are enabled
• Usage counters (daily and monthly message counts) used to enforce plan limits
• Server logs from our cloud functions, which may include account and profile identifiers

We do not collect advertising identifiers, and we do not use analytics for advertising or behavioral profiling.

5. How we use information

• To provide tutoring responses and run the app's features (progress dashboard, quests, moods, rewards)
• To enforce usage limits and prevent abuse
• To fix crashes and improve reliability
• To notify parents (for example, when a child's mood check-in suggests they need support)
• To respond to your support requests and feedback
• To comply with legal obligations

We do not sell personal information, and we do not use it for advertising.

6. Photos and voice — exactly what happens

Homework photos are sent securely to our cloud function, forwarded to our AI provider to read the problem and generate a tutoring response, and the extracted problem text is kept in the session so your child doesn't have to re-photograph it. The photo itself is not saved to our database or file storage and is not retained after the request completes.

Voice input is transcribed by your device's own speech-recognition service (for example, Google's speech service on Android), under that service's own policies and your device settings. QuestPal receives only the resulting text, and only if your child sends it. We never receive or store raw audio.

Optical character recognition (reading text in photos) is performed by our AI provider's model as part of generating the response — no separate OCR service receives your data.

7. Service providers (processors)

We share data with service providers only so they can process it on our behalf — this is "sharing" with processors, not selling:

• Google Firebase (Google LLC, USA): Authentication (parent sign-in), Cloud Firestore (our database: profiles, conversation history, moods, quests, subscriptions, usage counters, consent records, feedback), Cloud Functions (server code that calls the AI), and Cloud Messaging (notification tokens). We do not use Firebase Analytics, Firebase Crashlytics, or Firebase Storage.
• Anthropic (USA): powers the AI tutor. Each tutoring request sends the recent conversation, the homework text or photo, and your child's first name, age, grade, subject focus, and mood — used only to generate the response. Under Anthropic's commercial API terms, Anthropic does not use this data to train its models, and retains API inputs only for a limited period for trust-and-safety purposes under its policies. Your email address is never sent to the AI.
• Your device's speech service (for voice input), as described in Section 6.

8. How long we keep information (retention)

• Raw voice audio: never received or stored by us
• Homework photos: not stored; processed only for the duration of the request
• Conversation history and learning activity: retained until you delete the child profile or your account. Dormant accounts (no sign-in for 24 months) may be deleted after notice to your email.
• Authentication and server logs: typically retained for 30 days
• Usage and rate-limit counters: rolling daily/monthly records; removed on account deletion
• Consent records: retained as long as reasonably necessary to demonstrate compliance
• Backups: when you delete data, it is removed from our active database immediately; residual copies in our service providers' systems expire on their standard schedules, typically within 90 days

9. Administrator access

A small number of authorized administrators (currently the operator) can access stored data, including conversation history, for support, safety review, and abuse prevention. Administrator access is via authenticated provider consoles.

10. Security

We use reasonable safeguards: encrypted connections (HTTPS/TLS) for all data in transit, encryption at rest in Firebase, sign-in credentials stored on your device only in encrypted secure storage, our AI key held in a cloud secret manager (never in the app), and database access rules that restrict each parent to their own family's data. No method of transmission or storage is 100% secure, and we cannot promise absolute security.

11. Your rights as a parent

• Access and review your child's information (much of it is visible in the Parent Dashboard; you may also request a copy by email)
• Correct profile details in Settings
• Delete everything at any time — see our Delete Account page
• Withdraw consent to further collection (Section 3)
• Refuse to permit collection beyond what is reasonably necessary for your child to use the Service

Verified requests. Email questpalapp@gmail.com from the email address registered to your parent account. We may ask a follow-up question to confirm you are the account holder before acting. We respond within 30 days.

12. Where data is processed

QuestPal is operated from the United States, and information is processed and stored in the United States by the providers listed in Section 7. If you use QuestPal from outside the US, you understand your information is transferred to the US.

13. Data breach response

If a breach affects personal information, we will notify affected parents by email without undue delay and as required by applicable law, and will describe what happened and what we are doing about it.

14. Changes to this policy

If we make material changes, we will notify you in the app or by email before they take effect, and we will update the effective date and version above. If a change would materially expand the collection or use of children's personal information, we will request renewed parental consent — continued use alone will not be treated as consent to such a change.

15. A note on what to upload

Please teach your child to photograph or type only the homework problem. Do not include names, faces, classmates, school names, addresses, medical information, or other personal details that aren't part of the question. QuestPal's tutor is instructed not to ask for or repeat such details.

16. No AI training on your data

We do not use your or your child's data to train AI models, and under our AI provider's commercial terms, it does not use our API data to train its models either. Uploaded content is never used for advertising.

17. Contact us

Jack Le (QuestPal) · 740 Whidbey St, Melbourne, FL 32904, USA
Privacy email: questpalapp@gmail.com
Account deletion: see Delete Account