Privacy Policy

Quest ("we", "us", or "our") is committed to protecting the privacy of every student, parent, and teacher who uses our platform. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and the rights you have under Malaysian law, including the Personal Data Protection Act 2010 (PDPA).

By using Quest, you agree to the practices described in this policy. If you are under 18, please review this policy with a parent or guardian.

1. Information we collect

We collect only what we need to run Quest and help you study:

• Account data: your name, email address, and password (stored as a secure, salted hash — we never store your password in plain text).
• Learning data: quiz attempts, scores, XP, coins, streaks, levels, completed topics, and leaderboard rankings.
• Preferences: subjects you choose, theme, and sound settings.
• Referral data: your referral code and any friends you refer.
• Technical data: device type, browser, and approximate location (country/region) used to improve performance and security.

2. How we use your information

• Provide and personalise quizzes, progress tracking, and leaderboards.
• Surface the topics you struggle with most so your study time is effective.
• Send account, streak, and (optionally) product emails you can turn off at any time.
• Process payments and manage Premium subscriptions via our payment provider (Billplz).
• Maintain security, prevent fraud, and analyse aggregate usage to improve Quest.

3. Cookies & local storage

We use essential cookies and browser local storage to keep you logged in, remember your settings, and keep the app secure. We do not use third-party advertising or tracking cookies. You can disable cookies in your browser, but some features may not work.

4. Who we share data with

We do not sell your personal data. We only share it with:

• Payment processors (e.g. Billplz) to handle subscriptions — they receive only the data needed to process your payment.
• Hosting & infrastructure providers who store data on our behalf under confidentiality obligations.
• Authorities where required by Malaysian law.

5. Data retention

We keep your account and learning data for as long as your account is active. If you delete your account (or request deletion), we remove your personal data within 30 days, except where we must retain limited records for legal, tax, or security reasons.

6. Children's privacy

Quest is designed for secondary-school students, some of whom are under 18. We collect only the minimum data needed for learning, we never show behavioural advertising, and we encourage parents to review their child's account. Parents may request access to or deletion of a minor's account by contacting us below.

7. How we protect your data

We use encryption in transit (HTTPS), hashed passwords, access controls, and regular security reviews. No online service is 100% secure, but we work continuously to protect your account.

8. Your rights (PDPA)

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Withdraw consent or request deletion of your data.
• Opt out of non-essential communications at any time.

To exercise any of these rights, email privacy@quest.my. We respond within 21 days as required by the PDPA.

9. Changes to this policy

We may update this policy as Quest evolves. Material changes will be announced in-app or by email. The "last updated" date above reflects the latest version.

10. Contact us

Questions about privacy? Email privacy@quest.my or write to Quest, Attn: Data Protection, Kuala Lumpur, Malaysia.