Privacy Policy

Questory (website https://getquestory.com; "we") is operated by 源泉科技有限公司, a company registered in Taiwan (unified business number 50783302).

We play one of two roles, depending on the data:

• Organiser accounts, the website's "Book a demo" form and website security records: we are the collector and decide how the data is used.
• Data players create during an event (nickname, photos, answers, chat and so on): we process it on behalf of the company, school or group running the event (the "organiser"). The organiser chooses the event's settings, such as how many days photos are kept and whether the photo wall or location sharing is on. We use this data only to run that event and to keep the service secure.

If you are a player, you can also ask the organiser about the event itself; if you write to us, we will help or pass your request on.

This policy covers the getquestory.com website, the organiser console, the player web app and the Questory iOS app, the event big screen, shared results reports, and the redemption pages used by partner shops.

We collect only what the service needs. By who you are:

• Organisers (including staff accounts)

  Data

  Name, email, mobile number, job title (optional), organisation name and type, typical event size and how you heard of us (optional); the version and time of your acceptance of the terms, and whether you agreed to product news (optional); a hash of your password (never the password itself) and your encrypted two-step verification (TOTP) secret; identifiers and email of a linked Google or LINE account; sign-in sessions and failed sign-in counts; a log of console actions (audit log); push tokens of staff iPhones.

  Source

  You, when you sign up, complete your profile or use the console; Google or LINE when you sign in with them.

• Players

  Data

  Nickname and team; a device sign-in credential (stored only as a hash); photos, videos and answers submitted for tasks; for check-ins, your distance from the place and the location accuracy (coordinates are not stored); team chat, feed comments and likes; post-event survey rating, whether you would join again and an optional comment; consent records (event notice, photo wall, AI test, location sharing); if you choose to link one: your LINE user ID or Apple ID identifier; iPhone push token and language; reward redemption records.

  Source

  You, when you join a team and play; names in a registration list imported by the organiser.

• Live location (optional)

  Data

  When the organiser turns on the staff live map and you agree, the app or web page reports your current position and its accuracy. We keep only each player's latest position, never a trail.

  Source

  Your phone's location, only while the event runs and only with your consent.

• Website visitors

  Data

  "Book a demo" form: name, company or organisation, email, phone (optional), event type, headcount (optional), preferred date (optional), message (optional), form language, browser information (User-Agent), and a salted hash derived from your network address.

  Source

  You, when you submit the form.

• Partner shops

  Data

  Shop name (set by the organiser), a hash of the redemption PIN, redemption records and sign-in sessions.

  Source

  The organiser's settings and the shop's use of the redemption page.

Location in photos: phone photos often carry EXIF data such as where they were taken. When we receive a photo we re-encode a copy without any metadata (GPS included); review, the photo wall, reports, downloads and exports use only that copy. The original upload is scheduled for deletion as soon as processing finishes.

Hashes for security: to stop password guessing and form spam, we rate-limit by a salted hash of your network address (IPv6 counted by its /64 block). The address itself is not stored.

We collect, process and use personal data for these purposes (the codes are the specific-purpose codes published under the PDPA):

• Providing the service: organiser accounts, designing and running events, players joining teams, task review and scoring, leaderboards, the photo wall, highlight reels and results reports, reward redemption (069 contract or quasi-contract matters; 090 consumer and customer management and service).
• Running our systems: sign-in, push notifications, storage and backups, abuse prevention and security investigations (135 information and communication services; 136 information, communication and database management).
• Improving the service: statistics such as task completion and review times; testing AI-assisted judging when a whole team agrees (157 surveys, statistics and research analysis).
• Sales contact: replying to the "Book a demo" form, arranging demos and quotes (090 consumer and customer management and service).
• Marketing: Questory product news, only if you ticked the box; you can stop it at any time (040 marketing).

• The organiser and its staff see participants' nicknames, teams, photos and answers, and review them; they can download the event's photos (file names include the task and nickname); with the live map on, they see the positions of players who agreed to share.
• Data exports for HR or the organiser are team-level only: team names and sizes, tasks and scores per team, with no player nicknames, identifiers, locations, chat or review reasons.
• Your teammates see the team's photos, chat and feed.
• Other players in the same event and the big screen see team names, scores and ranks, and the nickname on your feed comments. Team photos appear on the big-screen photo wall and other teams' feeds only after every member of the team has agreed; anyone can withdraw at any time, and staff can take down any photo.
• Results report: the organiser can create a share link to a report that includes featured photos; the organiser can revoke it at any time, and it stops working once the data is deleted.
• Partner shops see only what they need to redeem a reward.
• AI-assisted judging test: see section 7.
• Legal requests: only when a court or authority requires it through due legal process.

We do not sell your personal data and do not use it for advertising.

These providers help us run the service and may process data only on our instructions:

• Amazon Web Services (AWS)

  Purpose

  Servers, database, photo and video storage, backups (Tokyo region ap-northeast-1), system email (Amazon SES)

  Location

  Japan

• Cloudflare

  Purpose

  Domain name service (DNS); website traffic does not pass through Cloudflare's proxy

  Location

  USA and global

• Apple

  Purpose

  iPhone push notifications (APNs), Sign in with Apple

  Location

  USA

• LINE (LY Corporation)

  Purpose

  LINE Login (organisers and players)

  Location

  Japan

• Google

  Purpose

  Google sign-in (organisers)

  Location

  USA

• Anthropic

  Purpose

  AI-assisted judging test (Claude API), only when a whole team agrees

  Location

  USA

• OpenStreetMap Foundation

  Purpose

  Map tiles: when you open a map, your browser downloads tiles directly from its servers, which see your network address

  Location

  UK and global

International transfers: these providers are outside Taiwan, so your data is transferred to Japan, the United States and other places. We choose providers with security and data-protection commitments and send only what each purpose needs. We will comply with any restriction the authorities impose on transfers to a particular country or region under Article 21 of the PDPA.

• When joining, a player may separately tick "use my photos after the event to test AI judging". It is unticked by default.
• A team's photos are used only when every member of that team agreed, only photos a human has already reviewed, and only the copy with location and other metadata removed.
• What is sent: the photo, plus the task title, task description and the organiser's review criteria. No nicknames, team names or contact details.
• Recipient: Anthropic PBC (USA), through the Claude API. Anthropic processes and retains API data according to its service terms.
• Purpose: comparing the AI's suggestion with the human decision, to improve the service. AI results never affect any score or review decision and are not used for live judging; if that changes, we will update this policy and ask for consent again first.
• AI results are deleted together with the event's data.

• Event photos, videos, answers and other player data

  For the number of days the organiser set after the event ends (30 by default, 1 to 180), then deleted automatically: photo and video files, answers, chat, comments and likes, survey comments, registration names, check-in distances, LINE / Apple links, push tokens and AI results. Nicknames are replaced with "已匿名" (anonymised) and share links stop working.

• What remains after deletion

  Team names, scores, survey ratings and task statistics: numbers that identify no one, kept as the event record and for reports.

• Deleted files

  Photo storage keeps deleted versions as a safeguard; they are permanently removed after at most 30 days.

• Live location

  Only the latest position; deleted at once when you withdraw, the organiser turns sharing off, or the event ends.

• Registration names in draft events that never ran

  Deleted after 90 days.

• Organiser account data

  While the account exists; when you ask us to delete your account we delete or de-identify it, except records the law requires us to keep.

• Unverified sign-up requests

  Currently kept; you can ask us to delete them.

• Audit log

  Kept for security and dispute handling; review reasons in it are removed when the event's data is deleted.

• "Book a demo" form

  Until our sales contact ends or you ask us to delete it.

• Network-address hashes for sign-in protection

  Rate-limit records are cleared within about a day; the hash on a form submission is kept with the form.

• Database backups

  Daily; the latest 7 are kept, and rotated-out backups are kept 30 more days as a safety net, then removed.

We use only cookies that are strictly necessary for signing in and security, plus browser storage that remembers display preferences. We use no advertising, tracking or third-party analytics tools.

• qs_admin

  Purpose

  Organiser console sign-in

  Lifetime

  12 hours

• qs_admin_locale

  Purpose

  Console language

  Lifetime

  1 year

• __Host-qs_oauth

  Purpose

  Security check during Google / LINE sign-in

  Lifetime

  10 minutes

• __Host-qs_admin_pending

  Purpose

  Holds a Google / LINE sign-in until sign-up or linking is finished

  Lifetime

  15 minutes

• __Host-qs_signup_bind

  Purpose

  Lets a sign-up link complete only in the browser that started it

  Lifetime

  24 hours

• __Host-qs_admin_enrol

  Purpose

  Two-step verification set-up

  Lifetime

  10 minutes

• qs_player

  Purpose

  A player's sign-in on this phone

  Lifetime

  2 days

• qs_line

  Purpose

  Holds a player's LINE sign-in while joining

  Lifetime

  15 minutes

• qs_merchant

  Purpose

  Partner shop redemption page sign-in

  Lifetime

  12 hours

• questory-theme, q-contrast (local storage)

  Purpose

  Light / dark theme and outdoor high-contrast mode

  Lifetime

  Until you clear it

• questory-last-player, questory:install-dismissed, questory:map-locate (local / session storage)

  Purpose

  Clearing offline pages when someone else signs in, hiding the install prompt, map locate state

  Lifetime

  Until you clear it or close the tab

On the live site, cookies starting with __Host- are only ever sent over HTTPS. When you sign in with LINE, the page loads LINE's sign-in script.

• All traffic is encrypted with HTTPS (TLS); storage refuses unencrypted connections.
• Photos, videos and database backups are encrypted at rest with keys managed in AWS KMS.
• The database isolates each organiser with row-level security (RLS): one organiser cannot read another's data.
• Passwords are stored only as hashes; organiser accounts that sign in with a password must use two-step verification (TOTP); sign-in links, device credentials and share links are stored only as hashes.
• Sign-in, sign-up and forms are rate-limited, and repeated failures lock the account for a while.
• Important console actions are recorded in an audit log.

No system is perfectly secure. If personal data is breached, we will investigate and notify affected people in an appropriate way as the law requires.

• Events run by schools or youth groups may include minors. The organiser is responsible for informing their parents or guardians and obtaining consent beforehand.
• Once the organiser marks an event as including minors: live location sharing is unavailable (stored positions are deleted at once), and the photo wall stays off until the organiser confirms guardian consent was obtained.
• Organiser accounts are for adults signing up on behalf of an organisation.
• If you are a parent or guardian and want to see or delete your child's data, write to us or contact the organiser.

Under Article 3 of the PDPA you may, for your personal data:

• ask to see or review it
• ask for a copy
• ask us to complete or correct it
• ask us to stop collecting, processing or using it
• ask us to delete it

Write to support@getquestory.com with who you are (organiser, player or form sender), the event or account concerned, and the right you want to use. To protect you, we verify your identity first. We answer requests to see, review or copy data within 15 days, and handle requests to correct, complete, stop using or delete data within 30 days; if we need longer, we may extend each once and tell you why. For copies, the law allows us to charge the necessary cost.

Players can withdraw photo-wall and location-sharing consent at any time on the Team tab of the app or web page. To withdraw AI-test consent, write to us and we will stop using your team's photos. For event data we process on an organiser's behalf, we may need to confirm with the organiser before acting.

To stop product news, just write to us; it does not affect your account.

• Organisers: without a name, email, organisation name and mobile number we cannot create or finish setting up your account. Job title, event size and how you heard of us are optional.
• Players: a nickname and agreement to the event notice are needed to join a team. LINE / Apple linking, the photo wall, the AI test and location sharing are optional; saying no only means going without that feature (for example, asking staff for a recovery code when you switch phones).
• Website form: without the required fields we cannot contact you.

When we update this policy we change the version date at the top of this page. For material changes (for example a new purpose or a new kind of service provider) we notify organisers by email or in the console before they take effect, and ask for consent again where it is needed.

Operator

源泉科技有限公司

Unified business number

50783302

Brand

Questory

Website

getquestory.com

Email

support@getquestory.com