Privacy

Effective 4 November 2026.

What Questy is

Questy is the fun way to manage chores. Your child ticks off their jobs, you say yes, and they earn stars to spend on rewards you choose. This page covers what we collect to run that, and nothing else. Questy carries no advertising and no analytics or tracking of any kind, on the web or in the iPhone app.

Who runs it

Questy is made and run by Dan Sutherland, an individual developer and the seller named on the App Store.

What we collect

One parent account per family, holding:

• An email address and a password, for signing in.
• The family’s name, and each grown-up’s own name.

A parent adds a profile for each child: a first name, a chosen picture and colour. A child profile is not an account. It has no email, no password and no way to sign in on its own. A parent switches into it with a tap, and a PIN, or Face ID on the phone, is what protects the way back.

A child’s own tablet is paired with a short code a parent reads out. The tablet then holds a key that opens that child’s screens and nothing else, and a parent can switch it off from Settings at any time.

Using the app writes the chores, challenges, rewards, badges and star totals a family creates for itself. That data belongs to the family and exists only to run the app in front of you.

What a child puts in

A child picks their own picture, colours and size of things, and ticks what they have done. On a challenge that counts something, they type the number they got to. In Jarry, a child can write a note on an ask in their own words, and names the goal they are saving for.

The child and the family’s grown-ups see these. Nobody else does.

What we don’t do

• No advertising, and nothing here is built to be sold.
• No analytics or tracking SDKs of any kind.
• We never sell, rent or share a family’s data with anyone for their own purposes.

Children’s privacy

A child never creates an account, gives an email address or signs in directly. A parent creates and controls every child profile from inside their own account, and can rename or remove it at any time. Removing a child erases them and everything about them within 7 days.

Who else sees it

These companies run parts of Questy for us. Each is under contract, and none may use a family’s data for anything but running the app on our behalf.

• Vercel hosts the apps and their server, so it receives every request, and its request logs hold IP addresses.
• Neon runs the database, which holds everything on this page.
• Stripe takes payment for Plus on the web. It receives the paying grown-up’s email address and our ids for them and their family. Card details go to Stripe and never reach us.
• RevenueCat keeps track of Plus bought in the iPhone app. It receives the family’s id and its App Store purchases, and no name or email.
• Forward Email sends the account emails. It receives the grown-up’s email address and the email itself: a welcome that confirms the address, a password reset link, or a note that the password changed.
• Apple delivers the iPhone app and takes payment for Plus bought in it, as it does for any App Store purchase.

How long we keep it

• A grown-up’s account, their name and the family’s name: while the account is open, and erased within 7 days of deleting it.
• A child’s profile and everything about them, their ticks, stars, badges, jars, asks and goals included: while they are in the family, and erased within 7 days of a grown-up removing them or deleting the account.
• The chores, challenges and rewards a family writes: while the account is open. A chore or challenge set for a removed child alone goes with them.
• A child’s tablet key: it stops working 14 days after its last use, and goes when a parent switches it off or removes the child. A grown-up’s sign in: until it runs out or they sign out. Deleting the account ends both at once.
• Sign-in attempt counts, kept as a scrambled copy of the email or IP address: erased the night after their window closes. A password reset link: erased the night after it runs out.
• A sign in that never joined a family: erased 30 days after its last request to join ran out.
• A record of each purchase event from the App Store or Stripe, with the family’s id and no name or email: kept after the account closes, so a refund or a dispute can still be answered.

How it’s protected

A password is never stored as typed. It is hashed with scrypt, a deliberately slow function built to resist guessing, before it ever reaches the database. Signing in issues a session key; on the web a cookie carries it, marked so a script on the page can never read it, and on the phone it sits in the device’s own keychain.

On your phone

Face ID and the passcode are the phone’s to check. The app asks iOS whether it is you, and iOS answers yes or no. No face, fingerprint or passcode ever reaches Questy.

A tick made without a connection waits on the device until one returns, then sends. Nothing else is kept on the phone beyond the session key above, and deleting the account clears both.

Deleting your family’s data

Delete an account any time from inside the app, from the Home screen on the web and the phone alike. Nothing to email, nobody to wait for. Every session ends the moment you confirm, and everything else is erased permanently within 7 days. To erase one child, remove them from Children in Settings.

Changes to this page

If what Questy collects changes, this page changes with it and the date at the top moves.

Contact

Questions about your family’s data, or a request about it: privacy@questy.family.