Legal

Privacy Policy

Last updated: 9 June 2026

Local Quest ("Local Quest", "we", "us") is a travel-list app that lets you save the sights, food and side quests you don't want to miss, and share those lists with friends. This policy explains what personal data we collect, why, who helps us process it, and the rights you have. We're based in the EU and follow the GDPR. Questions or requests: use our contact form.

What we collect

Account: your email address and the display name you choose when you sign up.
Your lists: the public quests you save, your completion ("done") status, and any custom items and notes you add.
Friends & sharing: friend invitations and trip-list shares — including any email address you enter to invite or share with someone.
Messages: anything you send us through the contact form (your name, email and message).
Technical: a secure session cookie to keep you signed in, plus standard server logs (e.g. IP address, browser type) kept briefly for security and reliability.

We use analytics to understand how the app is used (see "Analytics & cookies" below), and we never sell your data.

Browsing without an account

You can browse every destination and quest without signing in. We only create a profile once you choose to make an account to save lists or add friends.

The map

When you open the Map view, map tiles are loaded from OpenFreeMap, which means your IP address is shared with that provider to deliver the map. "Open in Google Maps" links take you to Google, whose own terms and privacy policy then apply.

Why we use your data (legal basis)

To provide the service (your account, saved lists, friends, sharing) — performance of our agreement with you.
To send the emails you ask for (friend invites, share notifications, account emails) — performance of our agreement / your request.
To keep the service secure and working (logs, abuse prevention) — our legitimate interest.
To reply to you when you contact us — your request / our legitimate interest.

Who processes your data

We use a small number of trusted providers, only to run the service:

Supabase — database & authentication (stores your account and lists).
Resend — sends our transactional emails (invites, account emails).
Hetzner — EU-based hosting for the app.
OpenFreeMap — map tiles for the Map view.
Google — Google Analytics, for usage statistics (only after you consent).

These providers act on our instructions. Where any provider processes data outside the EU, that transfer is covered by appropriate safeguards (such as the EU Standard Contractual Clauses).

Analytics & cookies

Essential cookie. We always use one essential cookie to keep you signed in (your Supabase session). It's required for the app to work and isn't used for tracking.

Analytics. With your consent, we use Google Analytics 4 to see how the app is used — which pages are visited, rough location (from your IP, which is anonymised), and device / browser type — so we can improve it. Google acts as our processor; data may be processed in the US under the EU Standard Contractual Clauses.

Your choice. On your first visit a banner lets you accept analytics cookies or keep just the essentials. Until you accept, analytics and advertising cookies stay switched off (we use Google Consent Mode). You can change your mind any time by clearing this site's cookies, which brings the banner back.

Advertising. We may show ads in the future. If we do, we'll update this policy and ask for your consent before any advertising cookies are used.

Inviting friends by email

If you invite someone or share a list by entering their email, you confirm you're allowed to give us that address. We use it only to send that one invitation and to connect your accounts if they join. They can ignore the invite, and we don't add them to any marketing.

How long we keep it

We keep your account and lists for as long as your account exists. If you ask us to delete your account, we remove your personal data (your lists, friends and shares are deleted with it), except anything we must keep briefly for legal or security reasons. Pending invitations expire automatically.

Your rights

Under the GDPR you can ask us to: access a copy of your data, correct it, delete it, restrict or object to processing, and receive it in a portable format. You can also withdraw consent at any time. Use our contact form and we'll handle it. You also have the right to complain to your data protection authority (in the Netherlands, the Autoriteit Persoonsgegevens).

Children

Local Quest isn't directed at children. The "With Kids" category is for adults planning family-friendly outings. Accounts are intended for users aged 16 and over.

Changes

We may update this policy as the app evolves. We'll change the "last updated" date above, and for significant changes we'll do our best to let you know.

Contact

For any privacy question or request, use our contact form and we'll get back to you.