Privacy Notice

1. Who we are

Grappler Quest is operated by Anton Malek, who is the data controller responsible for personal data processed through the Service and decides how and why it is processed.

2. Data we collect and why

• Account data (email address, login credentials managed by our authentication provider, display name) — to create and secure your account. Legal basis: performance of a contract.
• Profile and gameplay data (character choices, level, XP, gold, belts, cosmetics, quest and badge progress, guild membership) — to provide the Service and its progression features. Legal basis: performance of a contract.
• Coaching prompts and messages you send to the AI coach — to generate responses. Legal basis: performance of a contract.
• Usage and technical data (device and browser information, IP address, log and error data) — for security, fraud prevention, debugging and improving the product. Legal basis: legitimate interests.
• Support messages you send us — to answer your enquiry. Legal basis: legitimate interests.
• Subscription status received from our payment provider — to unlock paid features. Legal basis: performance of a contract and legal obligation.

We do not collect or store your card details. Payment data is collected and processed by Paddle as Merchant of Record.

3. Who we share data with

• Service providers / subprocessors: hosting, database and authentication infrastructure, and the AI model provider that powers the coach.
• Paddle.com, our Merchant of Record, for sale of the product, subscription management, payments, tax compliance and invoicing.
• Professional advisers (legal, accounting) where necessary.
• Authorities where required by law.

We do not sell your personal data.

4. Public information

Your display name, belt rank, level and earned badges are visible to other users on guild pages and leaderboards. Your email address is never shown publicly.

5. Retention

We keep account and gameplay data for as long as your account is active. If you delete your account, we delete or anonymise your personal data within 90 days, except where we must retain records (for example transaction and tax records) to meet legal obligations.

6. International transfers

Our providers may process data outside your country, including in the United States and the European Union. Where data leaves the UK/EEA we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses.

7. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing of your personal data, to data portability, and to withdraw consent at any time. Users in the UK/EEA may also lodge a complaint with their supervisory authority. We respond to requests within one month.

8. Security

We use appropriate technical and organisational measures, including encryption in transit, row-level database access controls and server-side authorisation checks, to protect your data. No system is perfectly secure, so we cannot guarantee absolute security.

9. Cookies and local storage

We use strictly necessary cookies and browser local storage to keep you signed in and remember preferences such as audio mute state. Our payment provider may set cookies needed to complete checkout. We do not use advertising cookies. You can clear or block cookies in your browser settings, though sign-in will not work without the essential ones.

10. Children

The Service is not intended for children under 13, and we do not knowingly collect their data.

11. Contact

To exercise your rights or ask a privacy question, contact Anton Malek through the Support button in the app, or use the email address on your Paddle receipt.