Privacy Policy

Last updated: 22 September 2026

This policy describes which data is processed when you visit rlquest.de and rlquest.app and when you use the RLQuest app. It is deliberately specific: RLQuest is an app that knows where people go, and that is exactly why what happens with that — and what does not — belongs here.

Controller

Nine to Zero UG (haftungsbeschränkt)
Malzer Chaussee 173, 16515 Oranienburg, Germany
Email: mail@ninetozero.de
Further details in the imprint.

This website

The site loads no external fonts, no analytics tools, no ad networks and no social embeds. No cookies are set.

On each request the web server writes a technical log entry: IP address, timestamp, requested address, amount of data transferred, browser identifier. This is necessary to operate the site and to defend against attacks (Art. 6(1)(f) GDPR, legitimate interest in a working and secure service). Entries are deleted after 14 days at the latest.

The app

Account

An account requires an email address and a password. The password is stored only as a hash and is not known to us. Confirmation and password emails are sent for us by the provider Resend (see the list of recipients below). The legal basis is performance of the contract (Art. 6(1)(b) GDPR).

Signing in with Apple or Google. Instead of a password you can sign in with your Apple or Google account. The sign-in itself happens at Apple or Google, and they learn that you are signing in to RLQuest. They send us a fixed identifier of your account with them and your email address — with Apple, if you choose, a relay address that keeps your real one hidden. Google also sends the name and the profile picture link of your Google account; both are stored with your account’s sign-in data but not used in the app. There is no password on this route. The legal basis is again performance of the contract (Art. 6(1)(b) GDPR).

Profile

Year of birth, time zone, language, chosen interests and the amount of time you set per day. Plus — if you set one — a freely chosen display name; it is shown to your friends and appears in the email about a friend request. The year of birth governs which quests may be assigned; an exact date of birth is not collected.

Progress and quests

Experience points, streak, number of completed quests, total distance covered, assigned and completed quests, achievements, weekly goals, finds.

So that you can see where you left off without a connection, the app keeps part of this — such as achievements, the place book and statistics — on your device, separately for each account. It is deleted when you sign out.

Quests you write yourself

If you write your own quests, we store their title, description, optional hint, category and status — text you wrote yourself. It stays with your account, is part of the data export and is deleted with the account.

Friends

The friends feature is optional and only available from the age of 16 (Art. 8 GDPR). If you use it, a friend code of eight characters is created on first use — a random identifier that only its owner can pass on. We also store who you are friends with, since when and who sent the request. Your friendships and pending requests are part of your data export — without any details about the other person.

What your friends see: your display name, your total experience points and the number of tiles you have uncovered on foot in the current week. Only the number — no tile identifiers, no places, no timestamps. They also see how many places you were the first to discover with a quest — just that one number, as of the start of the week: whatever you discover in the current week is only counted from the following Monday. They do not see which places those are, what kind they are or when you were there. While a request is pending, the two of you see nothing but each other’s display name — it comes with the request so it is clear who is asking. Numbers appear only once both sides have agreed.

If you send a request, the recipient gets an email with your display name and a link into the app — nothing more is in it. These notices can be switched off in the app. The legal basis is performance of the contract for a feature you switch on yourself (Art. 6(1)(b) GDPR).

Location — and what of it is stored

No location is stored. Not your current one, not your last one, neither as a coordinate nor as a route.

The app converts positions on the device into tiles of a global grid (H3 cells, resolution 9, roughly 350 metres across) and transmits only the identifier of those tiles. What is stored is therefore which tiles someone has uncovered and when for the first time — not where within a tile they were or are. From uncovered tiles the app also derives places you have reached — more on that below.

When location is read. By default only while the app is open and visible. There are two exceptions, and you switch on both yourself: a running distance quest, which records between start and finish, and the setting “Fill my map while I am out”. With that on, the app reads your location even with the screen locked — and stores the same thing as always: the tile, not the place. The switch lives in Settings and can be turned off at any time; on Android a persistent notification shows while it is running.

For a quest with distance measurement the recorded track is sent to the server for checking and is not stored there. What is stored is the result: measured distance, duration, number of track points.

Places for adventures. For an adventure with a radius, the app chooses the place on your device, and that choice is not transmitted. The app remembers which places it has already suggested to you for 60 days, only on your device, so that not every adventure leads to the same place. The list is deleted when you sign out.

Without a connection. If an uncovered tile can’t be sent right away, say in a dead zone, the app keeps its identifier on your device for up to 24 hours and sends it later — without any coordinate. If sending a distance quest fails, the track stays on your device until you send it again or the quest ends. Both are deleted when you sign out.

The legal basis is performance of the contract (Art. 6(1)(b) GDPR) — without this checking there is no service of the kind the app promises. The location permission is requested by the operating system and can be withdrawn at any time; quests that need it are then left out.

Places reached

RLQuest ships a fixed directory of named places — castles, lighthouses, viewpoints — from public OpenStreetMap data. If you uncover the tile such a place sits in, or complete a quest there, we store that you reached this place and when for the first time.

That is more specific than a tile alone: the entry names one particular place. It still does not say where exactly you were — reached means you were somewhere in the roughly 350-metre tile the place sits in — and it is not updated: only the first visit is recorded. Finds and the wanderer's maps also refer to such place identifiers. All of it is part of the data export and is deleted with the account.

First discoveries

If you are the first person in RLQuest to complete a quest at one of these places, it is recorded as a first discovery: which place, that it was you, and when. To do this, the app checks on your device whether you are within 300 metres of the place when you complete the quest — further for extended places such as beaches or large sites, never more than 2.2 kilometres — and sends only the result: not your location and not the distance.

Other users only learn whether someone has already completed a quest at a place — never who and never when. Your first discoveries are included in your data export. If you delete your account, the link to you is removed; the place stays marked as discovered, without any reference to a person.

A place's story (Wikipedia)

For many places RLQuest knows the matching Wikipedia article. If you tap “Read its story” on a quest's place card, the app fetches a short text excerpt directly from Wikipedia (Wikimedia Foundation Inc., San Francisco, USA). This happens only when you tap — merely opening a quest sends nothing to Wikipedia.

What is transmitted is your IP address, the title of the article and the technical identifier of the program making the request (the app's name and version). No location, no account, no name. The excerpt is held in memory only and is not stored. If you open the article or the licence, you leave the app; from there on Wikimedia's privacy policy applies. The legal basis is the legitimate interest in a feature you trigger yourself (Art. 6(1)(f) GDPR).

Steps

For a step quest the app sends the steps your device has counted since midnight (local time) to the server for checking. The step count itself is not stored — what is stored is the result of the check, as with every other quest. The count comes from the device's step counter: on iPhone from the system’s motion data (“Motion & Fitness”), on Android from Health Connect. From Health Connect the app reads steps only and writes nothing to it. The operating system asks for the permission, and it can be withdrawn at any time.

Photos

For a photo quest the picture you take is sent to our server and from there to OpenAI for checking. What comes back is an assessment of whether the subject is visible.

The picture is not stored. Once the check has been decided, it is discarded — at no point does it sit on our server for keeps. That is also why a data export contains no photos: there are none.

Location data in the image metadata (EXIF) is removed before upload.

What does remain is a checksum of the image — a short string from which the image cannot be reconstructed, but which lets us tell whether the same image is submitted twice. It serves that purpose alone and is deleted with the account.

Sounds

For a sound quest the app listens through the microphone for a few seconds to recognize a particular sound — a church bell, birdsong, a waterfall. Recognition happens on your device: on iPhone with Apple's built-in sound recognition, on Android with a model that ships inside the app.

Nothing is recorded, stored or uploaded. All that reaches our server is the result: the name of the sound the quest asked for, a score, and the number of time windows in which it was heard. The audio itself never leaves the phone — not even as a clip. That is also why nobody can listen in on what is being said nearby.

The microphone is only open while the listening screen is open, and it closes by itself after two minutes at most. You can withdraw the permission in your system settings at any time; sound quests will then no longer be assigned.

Weather

So that no snow quest is set in July, the server queries the weather from the Norwegian Meteorological Institute (api.met.no). A rounded position is transmitted, not an exact location.

Map

The map imagery comes from our own server (api.ninetozero.de). There is no external map service that learns which area someone is looking at.

Usage events

The app reports a short, fixed list of event names (such as “premium screen opened”) with no content, no free text and no third-party identifiers. They exist to show which features are plainly going unused. They are stored with the platform, the app version and — if you are signed in — your account identifier. The legal basis is the legitimate interest in a usable app (Art. 6(1)(f) GDPR).

Error reports

If something goes wrong in the app, it sends an error report: the error message, the technical trace, where in the app it happened, the platform, and the operating system and app versions. If you are signed in, the report is stored with your account identifier — an error that cannot be tied to an account can rarely be fixed. Before storing a report, the server cuts every decimal number in it down to one decimal place, so that even coordinates sent by mistake do not reveal a precise location. The legal basis is the legitimate interest in an app that works (Art. 6(1)(f) GDPR).

Quest reports

If you report a quest as broken, we store which quest it was, which of the given reasons you ticked and — if you wrote one — your free-text note. Please do not put anything in there that points to you or to anyone else; we do not need it and do not evaluate it that way. The report is tied to your account so that the free replacement is not granted more than once. The legal basis is the legitimate interest in quests that actually work (Art. 6(1)(f) GDPR).

Premium

Purchases run through the App Store or Google Play. Payment details never reach us. We use RevenueCat to manage entitlements; an account identifier is processed there together with the subscription status.

For every purchase, renewal and cancellation RevenueCat reports an event to our server. We store it so that we can tell why an account does or does not have Premium: your account identifier, product, timestamps, term, the transaction identifier at the App Store or Google Play, country, currency and price. No name, no email address and no payment details are among them. The legal basis is performance of the contract (Art. 6(1)(b) GDPR).

Processors and recipients

Where data is processed in countries outside the EU, this takes place on the basis of the European Commission's standard contractual clauses or an adequacy decision.

Retention

Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR).

Access and erasure work directly in the app, under Settings — without having to write to anyone. Access arrives as a file. Erasure removes your account with its profile, progress, quests, tiles, places, friendships and quest reports.

What deleting your account does not remove right away. Some entries remain, but no longer linked to your account: usage events and error reports until their 90-day period runs out, the cost statistics of photo checks, and first discoveries at places (see above). Purchase events from RevenueCat are kept as well; they still contain your former account identifier as text, together with the transaction identifier at the App Store or Google Play, country and price. On our side that identifier no longer belongs to any account after deletion.

You also have the right to lodge a complaint with a supervisory authority, for example the Data Protection Commissioner of the State of Brandenburg.

Children and young people

Quests carry an age limit; the year of birth in the profile decides which ones may be assigned. Quests with elevated risk additionally carry a safety note.

Changes

If the processing changes, this policy changes. The date above says when it was last touched.