Privacy Policy

1. Data We Collect

• Guest profile. On your first visit, a profile is created with a random ID, auto-generated nickname, and emoji avatar. The access key is stored in your browser.
• Nickname. If you enter a nickname (guest login or settings), we save it.
• Telegram data. When logging in via the bot, Mini App, or the Telegram button, we receive your Telegram ID, username, name and surname from your Telegram profile, and interface language. We do not receive or request your phone number.
• Game data: rooms you played in, in-game actions and answers, room chat messages, points, game history, certificates, and event participation.
• Visit statistics: anonymous browser ID, opened page, language, referrer source, and timestamp. Search engine bots are excluded.
• Instagram step: a record that you opened our page and clicked “Continue.” We do not check or view your subscription status.
• Profile photo, if you upload one. The server resizes it to a 256×256 square and removes file metadata (e.g., location data).

2. Browser Storage and Cookies

We do not use advertising or tracking cookies. Browser storage (localStorage and sessionStorage) contains: the profile access key, anonymous ID for statistics, visit start flag, Telegram launch flag, and viewed splash screen flags. Clearing site data in your browser logs you out of the guest profile; a Telegram-linked profile is restored by logging in via Telegram. Site statistics use the PostHog service: it keeps an anonymous visit identifier in the browser (cookie and localStorage) and counts page views and clicks. Yandex Metrica is also used for statistics: it keeps its own cookies in the browser, counts visits and shows a recording of how the page was scrolled and clicked (Webvisor); it does not record what you type into fields.

3. Why We Need This Data

• To run games: rooms, roles, team progress, and chat.
• To save progress, points, and issue certificates.
• To allow logging into the same profile on the website and in Telegram.
• To display player rankings and event results.
• To calculate site statistics: visit counts, traffic sources, and started/completed games.
• To send Telegram notifications to users who logged in via Telegram and have not blocked the bot.
• To secure the service: limits on guessing room codes, chat spam, and access brute-force.

4. What Is Visible to Others

• Your nickname and avatar are visible to players in your room, event participants, and all visitors of the ranking.
• Chat messages and photos are visible to room participants. The team may view games for moderation and when players report something.
• A certificate is opened via link or QR code: it shows the nickname, rank, points, number, and date. It does not show the Telegram ID or other personal data.
• Other players cannot see your Telegram ID, first name, or last name.
• Your profile photo is visible to players in rooms, in the ranking, and to your friends.
• Friends can see if you are online and what game you are playing. Others cannot see this.

5. Who We Share Data With

• Railway — hosting for the website and database. Servers are located in the USA. The hosting provider may keep technical request logs (including IP addresses) for operation and security.
• Telegram — when logging in via Telegram, running the bot, or the Mini App, data is processed subject to Telegram’s rules.
• Instagram — only if you voluntarily open our page; this occurs on Instagram’s site.
• Payment services — tezcheck.uz (Uzbek cards) and Telegram Stars. When you buy, they receive the amount and the order number; your card details are entered on their page, we neither see nor store them.
• PostHog — website analytics (servers in the USA). It receives page views, clicks and game and purchase steps together with the internal profile number. Nicknames, names, Telegram IDs and card details are not sent to it.
• Yandex Metrica (Yandex LLC) — visit statistics and Webvisor. Receives page views, clicks and technical browser data; your nickname, Telegram ID, typed text and card details are not sent to it.

We do not sell data, share it with ad networks, or install ad trackers. Fonts and images are loaded from our server.

6. Retention Periods

• Profiles, points, game history, and certificates are stored as long as the profile exists.
• An unfinished game is retained for up to 24 hours (solo) or 2 hours (team); an empty waiting room is retained for up to 30 minutes.
• A one-time bot login link is valid for 10 minutes.
• Visit statistics are stored with an anonymous browser ID, without name or Telegram ID.
• The photo is deleted immediately when you press “Remove photo.”
• The course of games is kept for a limited time and then deleted automatically.
• Purchase records (quest, amount, order number, date) are kept while the profile exists: they confirm your access to the purchased quest.

7. Notifications

Messages from @kvestora_bot are sent only to those who logged in via Telegram or clicked “Start” in the bot. To stop receiving notifications, block the bot in Telegram or contact us. Besides newsletters, the bot may remind you once about an unfinished purchase or suggest a new quest after you finish a free one.

8. Your Rights

You can change your nickname in the settings. To find out what data is stored about you, correct it, or delete your profile and history, email infokvestora@gmail.com from an address or via a Telegram account linked to your profile. We will respond and fulfill your request within 30 days. Certificates from deleted profiles will become inaccessible.

9. Children

The site features stories for children. If you are under 14, use the website and Telegram login with your parents or with their permission.

10. Changes and Contacts

If the policy changes, we will update this page and the version date. Questions about data: infokvestora@gmail.com, Telegram channel @kvestorauz.