Privacy Policy — QuestPilot

QuestPilot (the "Platform") is run by the QuestPilot team ("we," "us," or "our"). Student organizations and similar groups ("Organizations") use the Platform to run their own points-based competitions, each on its own site (for example, aiche.questpilot.net). This Privacy Policy explains how we collect and use your information when you use the Platform. The Platform is not an official service of The University of Texas at Austin or of any school.

1. Eligibility (18+)

The Platform is intended only for individuals who are 18 years of age or older. By creating an account or using the Platform, you represent that you are at least 18. We do not knowingly collect information from anyone under 18. If we learn that we have collected information from someone under 18, we will delete it.

2. Organizations and Your Account

You have one QuestPilot account (your email and password), and it can belong to more than one Organization. You join an Organization when its organizers invite you, or by signing in on its site if it is open to everyone.
Each Organization's competition is kept separate. Your crews, submissions, points, evidence files, and roles in one Organization are not shown to another Organization.
Your name and email address are part of your account, so the administrators and coordinators of each Organization you belong to can see them. They can also see that your account belongs to another Organization, but not which one or anything you do there.
An Organization's coordinators and administrators can see your submissions, review decisions, and evidence files in that Organization (coordinators only for the seasons they help run), including on a page for each member that brings them together.
The QuestPilot team can access every Organization's data to run, support, and secure the Platform.
Each Organization chooses how its site works, for example what it calls its crews and quests, and whether its scoreboard is public.

3. Information We Collect

Account information. Your name and email address. If you sign in with Google, we receive your name and email from your Google account. If you are invited by an organizer, we store the name and email they provide.
Competition data. For each Organization you join: your roles, crew membership, the quests you submit, any notes or evidence links you include, points awarded, and review decisions.
Evidence files. Photos, videos, and documents you upload as evidence for a submission, with their file names and sizes. Uploaded files are private: only you, the coordinators of your season in that Organization, that Organization's administrators, and the QuestPilot team can see them, and they are never shown on the scoreboard. Please do not upload files showing other people without their permission.
Feedback you submit. Any testing feedback or messages you send through the Platform.
Technical data. Standard log information such as your IP address and timestamps, including the IP address recorded when you accept these policies. This is processed by our infrastructure providers (below).
Activity logs. We keep a record of actions taken on the Platform — such as signing in, submitting quests, reviewing submissions, and administrative changes — along with who performed them, when, and in which Organization. These logs are visible only to the QuestPilot team and are used to operate and secure the Platform and its competitions.

4. How We Use Your Information

To run each Organization's competition, including scoring, crew assignment, and submission review.
To authenticate you and keep your account secure.
To display scoreboards and standings (see Section 5).
To respond to your requests and feedback.
To maintain an activity log of actions on the Platform for security, moderation, and competition-integrity purposes.

5. Scoreboards and Standings

An Organization's site may include a publicly accessible scoreboard that anyone on the internet can view without signing in (an Organization can instead limit it to its members). Your name and your associated points and crew in that Organization may be displayed there. Signed-in members of an Organization may also see a standings page that lists its members with their crews and points (an Organization can turn this off). Please do not join an Organization if you do not want your name shown in these ways. Evidence files and submission notes are never shown on a scoreboard or on the standings page.

6. Service Providers

We rely on third-party providers to run the Platform, and your information is stored and processed on their systems:

Supabase — authentication and database hosting.
Vercel — application hosting and request logging.
Cloudflare — storage of evidence files you upload (Cloudflare R2), and the domain name system and email forwarding for questpilot.net.
Google — if you choose Google sign-in, your authentication is handled by Google.

These providers process data on our behalf under their own terms and privacy policies. We do not sell your personal information.

7. Cookies

We use only the cookies needed to run the Platform. We do not use advertising, analytics, or tracking cookies, and we do not load third-party trackers.

Sign-in cookie. Keeps you signed in on an Organization's site. Each site has its own, so you sign in separately on each Organization's site. It is removed when you sign out or your session expires.
Google sign-in cookie. If you sign in with Google, a short-lived cookie is used while you are redirected to Google and back.
Temporary-password cookie. Set only in an organizer's browser, for about one minute after they reset someone's password, so the new temporary password can be shown to them once.

You can block cookies in your browser settings, but you will not be able to sign in without the sign-in cookie.

8. Data Retention

We retain your account and competition data for up to one year after the end of the season in which you participated, after which it may be deleted. We will delete your data sooner if you ask us to (see Section 9), unless we are required to keep it. Evidence files are deleted together with the submission, season, or account they belong to, and organizers may delete them sooner. Files you upload but never submit are removed automatically over time, and always when their season is deleted.

9. Your Choices and Requests

You may request access to, correction of, or deletion of your personal information by emailing us at privacy@questpilot.net.
Deleting your account removes your submissions and data in every Organization you belong to, and may affect scores.
An Organization's organizers can remove you from their Organization. Your past submissions there stay part of that Organization's competition records until its season's data is deleted. Ask us if you want them deleted sooner.

10. Security

We take reasonable measures to protect your information and to keep each Organization's data separate, but no online service can be guaranteed to be completely secure. You are responsible for keeping your password confidential.

11. Changes to This Policy

We may update this Policy from time to time. When we make material changes, we will update the version and ask you to review and accept the updated policies the next time you sign in.

12. Contact Us

The QuestPilot team is led by Saathvik Dabbara. Questions about this Policy can be sent to saathvik@questpilot.net. For requests about your data, write to privacy@questpilot.net (see Section 9).