Privacy Policy

Information We Collect

Anonymous use: you can use the entire site without an account. We do not require any registration to take quizzes, walk a learning path, or earn XP locally. No personal data is collected from anonymous users.

Optional account: if you sign up, we store the minimum needed to operate the account: your email address, a hashed password (we never see the plaintext), and an optional username. Sign-in via Google reveals your name and Google account email to us. Email confirmation is required.

Data Stored on Your Device

The following data is stored locally on your device using browser localStorage:

• Quiz progress and scores
• Daily streak and XP data
• App settings (sound, notifications)
• Hearts and gamification state
• Unlocked hats / cosmetics + Cert-Survivor laurels
• Path-progress map (which nodes you've completed per cert)

You can clear local data at any time from your browser/app storage settings, or via the "Reset local progress" button on your profile page.

Data Stored in the Cloud (Signed-In Users Only)

When you create an account, we mirror the same gameplay data above to our backend (Supabase, hosted in the EU). This is what makes your progress portable across devices.

Specifically, per signed-in user:

• Profile: username, account creation date
• Stats: XP, level, streak, session counts, per-pack accuracy
• Path progress: which nodes you've completed per certification
• Laurels: which final-boss exams you've cleared
• Cosmetics: hats unlocked + the one you're wearing
• Hearts: current count + last-lost timestamp (for regen)
• Daily quest: today's progress + claim state

All rows are protected by row-level security: only you can read or write your own data — neither other users nor we ourselves can browse it. Access is mediated by a session token issued to your browser after sign-in.

Your Rights — Account Data

You have full control over your account:

• Access: all your cloud-stored data is visible on your profile page.
• Rectification: change your username from the profile hero (✎ icon).
• Erasure (right to be forgotten): the "Delete account & all data" button on your profile page permanently removes your auth row and cascades through every backend table — no manual cleanup required, no data retained beyond standard log rotation.
• Sign out anywhere: sign-out invalidates the session on the device; cloud data is untouched and re-hydrates on the next sign-in.

If you need an export of your data in machine-readable form before deletion, contact us via the form and we'll send a JSON snapshot.

Contact Form

If you submit a message via our contact form, your message is processed by web3forms.com and forwarded to our email. We only use this information to respond to your inquiry. No data is stored beyond our email inbox.

Third-Party Services

The site uses the following third parties — each only sees the minimum data required for the function we use them for:

• Supabase (EU region) — auth + cloud storage for signed-in users. Sees: your email, hashed password, profile + gameplay rows. Does not see anonymous-user data.
• Brevo — transactional email (account confirmation, password reset). Sees: your email address and the message body of the confirmation / reset email.
• Google — only if you click "Continue with Google" to sign in. Google sees that you signed into CertQuests; we receive your Google account email and display name. Standard OAuth 2.0.
• Google Fonts — typography. Loaded from fonts.googleapis.com. Google sees that your browser fetched the font file.
• Web3Forms — contact-form submission relay (anonymous users too).

The site does not use analytics, advertising, or behavioural tracking services. We do not sell or share any data with advertising networks or data brokers.

Internet Access

Question data is loaded over the internet. No personal information is transmitted. The site can function offline for previously loaded content via the service worker cache.

Children's Privacy

CertQuests does not knowingly collect information from children under 13. The site is suitable for all ages as an educational tool.

Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be reflected by updating the "Last updated" date above.

Contact

Questions about this Privacy Policy? Use our contact form.