Privacy Policy

1. Introduction

Whispie Quest ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how Black Eagle Group LLC ("Whispie Quest," "we," "our," or "us") collects, uses, discloses, and safeguards your information when you use our mobile application (the "Service").

Whispie Quest is a children's activity app designed for parents and guardians of children ages 0-6. By using Whispie Quest, you consent to the data practices described in this policy.

2. Information We Collect

2.1 Account Information

Parent/Guardian Info: Name, email address, account credentials
Child Profile Info: Child's name (or nickname), date of birth/age, interests

2.2 Activity & Usage Data

Activity Data: Completed activities, activity ratings, feedback
Progress Data: XP points, levels, earned badges, streaks
Usage Data: App interactions, feature usage, session duration

2.3 Quest Proof Media (Optional)

Photos and Videos: If a parent chooses to capture a photo or short video at the end of an activity, it is stored privately in the family's Whispie Quest "Memories" archive. Parents control whether this is local-only or synced to our storage.

2.4 Technical Information

Device Information: Device type, operating system, app version, language and country settings
Push Notification Token: Firebase Cloud Messaging (FCM) registration token, used solely to deliver activity reminders and parent-verification alerts
Coarse Location: Approximate country/region derived from IP address; we do not collect precise GPS

2.5 Purchase Information

Subscription Status: Whether the account is on free or premium tier, the renewal date, and the transaction identifier returned by Apple's App Store or Google Play. We never receive your full payment card details.

3. How We Use Your Information

Purpose	Legal Basis	Data Categories
Provide age-appropriate activity suggestions	Contract Performance	Child Profile, Activity Data
Track progress and gamification	Contract Performance	Progress Data
Personalize user experience	Legitimate Interest	Usage, Technical
Improve our services	Legitimate Interest	Usage, Technical (Anonymized)

4. Data Sharing and Disclosure

4.1 Service Providers

Supabase Inc.: Database, authentication and file storage (EU/US regions)
Google Firebase (Analytics, Cloud Messaging): Anonymous usage analytics and push notification delivery
Apple App Store / Google Play Billing: Subscription processing — we receive only the transaction ID and product, never card details

We do not sell or rent personal information. We do not use any advertising SDKs and the app contains no advertising.

4.2 Legal Requirements

We may disclose information when required by law or to protect our rights.

4.3 Business Transfers

In connection with any merger or sale of company assets.

5. Children's Privacy

Whispie Quest is designed for use by parents and guardians. We take children's privacy very seriously.

We do not knowingly collect personal information directly from children
All child data is entered and managed by the parent/guardian
Child profile information is used solely to provide age-appropriate activities
Parents can view, modify, or delete their child's data at any time
We comply with COPPA (Children's Online Privacy Protection Act) and equivalent regulations

6. Regional Specific Provisions

6.1 European Union & United Kingdom (GDPR/UK-GDPR)

Legal Basis: We process your personal data on the basis of your consent (Art. 6(1)(a) GDPR), for contract performance (Art. 6(1)(b)), and for legitimate interests (Art. 6(1)(f)).

Your Rights: Access, rectification, erasure, restriction, data portability, objection.

6.2 United States - California (CCPA/CPRA)

California Privacy Rights: California residents have the right to know, delete, and correct personal information.

6.3 Turkey (KVKK)

Veri Sorumlusu: Black Eagle Group LLC

Haklarınız: KVKK Madde 11 uyarınca kişisel verileriniz için başvuru hakkınız bulunmaktadır.

7. Data Security

We implement appropriate technical and organizational measures including:

Encryption of data in transit and at rest
Regular security assessments
Access controls and authentication
Secure development practices

8. Data Retention

Account Data: Until account deletion + 6 years
Activity Data: Until account deletion
Payment Data: 10 years for tax purposes
Analytics Data: 2 years (anonymized)

9. Your Rights

Depending on your location, you may have the following rights:

Access to your personal information
Correction of inaccurate data
Deletion of your data
Restriction of processing
Data portability
Objection to processing
Withdraw consent

To exercise these rights, contact: [email protected]