Privacy Policy

Last updated: 2 July 2025

1. Introduction

Tokyo QUEST (“we”, “our”, or “us”) operates the Tokyo QUEST mobile application and related services (collectively, the “Service”). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

By using our Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our Service.

2. Information We Collect

Data Type	Description	Legal Basis
Google Account Info	Email address, name, profile picture (via Google OAuth)	Art. 6 (1) (b) Contract performance
Quest Media	Photos and videos you upload when completing quests	Art. 6 (1) (b) Contract performance
Usage Data	Quest completions, app interactions, and performance metrics	Art. 6 (1) (f) Legitimate interest (analytics)
Cookies / Local Storage	Authentication tokens (NextAuth JWT), user preferences, and session state.	Art. 6 (1) (f) Legitimate interest (UX)

We do not knowingly collect data from children under 13. If you believe a child has provided us information, contact us to delete it.

3. How We Use Your Information

•Account management – authenticate you via Google and maintain your profile.
•Quest processing – store and display your uploaded media, mark quests as completed and generate your personalized travel video.
•Delivery of services – send you confirmations, support messages and download links.
•Analytics & improvements – monitor usage trends, diagnose errors and optimize performance.
•Security – detect, prevent and respond to fraud, abuse or technical issues.

4. Information Sharing & Disclosure

We do not sell, trade, or rent your personal information to third parties.

We may share your information in the following circumstances:

• Service providers – with trusted third-party services that help us operate our Service (e.g., cloud storage, analytics)
• Legal requirements – when required by law, court order, or government request
• Safety & security – to protect our rights, property, or safety, or that of our users
• Business transfers – in connection with a merger, acquisition, or sale of assets

5. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

Your data is stored on secure servers and protected by industry-standard encryption. We regularly review and update our security practices to maintain the highest level of protection in accordance with applicable law.

6. Data Retention

Data Type	Retention Period
Quest media (photos/videos)	Deleted 7 days after the final memory video is delivered to you (unless you request earlier deletion).
Account data	Retained until you delete your account or remain inactive for 24 months, after which it is erased or anonymized.
Usage & log data	Up to 12 months for security and analytics, then aggregated or deleted.

7. Your Rights

Depending on your jurisdiction, you may have rights to:

• Access – request a copy of your personal information
• Rectification – correct inaccurate or incomplete information
• Erasure – request deletion of your personal information
• Portability – receive your data in a structured, machine-readable format
• Objection – object to processing based on legitimate interests
• Restriction – limit how we process your information

To exercise these rights, contact us at [contact email]. We will respond within 30 days and may request additional information to verify your identity.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place for such transfers, including standard contractual clauses and adequacy decisions, to protect your data in accordance with this Privacy Policy and applicable law.

9. Third‑Party Links

The Service may contain links to external sites we do not operate. We are not responsible for the privacy practices of those sites. Please review their policies.

10. Changes to This Policy

We may update this Policy from time to time. Changes are effective when posted. Material changes will be announced via the Service or email.

Last updated: 2 July 2025