Doc Legal
Privacy Policy
The short version. Rep counting happens entirely on your phone — no workout video, image or camera frame is ever uploaded, recorded or stored. What we keep is your account, the numbers your workouts produce, and the profile details you choose to enter. System Quest is a paid subscription, so we also keep a record of whether your subscription is active — never your card details, which only ever go to Apple. The app sends us crash reports, and a record of how far you get through sign-up and which features you use, tied to an account ID and never your name or email, so we can fix bugs and see what works. There is no advertising and no sale of data. You can delete everything from inside the app.
1. Who this covers
System Quest ("the app") is an iOS fitness game published by an independent developer based in Vietnam. This policy explains what the app and this website collect, why, and what you can do about it. Questions go to support@systemquest.fit, which is also the contact address for any data-protection request.
2. The camera
The app asks for camera access so it can count your reps. It is worth being precise about what that means, because it is the most sensitive permission the app requests:
- Pose detection runs on your device, using Google's MediaPipe pose model bundled inside the app. It works with no network connection.
- Each camera frame is analysed in memory to estimate the position of your joints, then discarded. Frames are never written to storage.
- No video or photograph of your workout is recorded, saved, uploaded or transmitted — not to us, not to a third party.
- What leaves the camera screen is a number: how many reps were counted, for which movement.
You can revoke camera access at any time in iOS Settings. Without it, rep counting cannot run and you would have to log workouts manually.
3. What is collected
| Data | Why | Where it lives |
|---|---|---|
| Email address, name and account identifier from Sign in with Apple or Google | To create your account and let you sign back in on a new device. If you use Apple's Hide My Email, we only ever see the relay address. | Clerk |
| Display name | Shown on your player profile in the app. | Convex |
| Training records — reps, exercise, date, personal bests, lifetime totals per movement | The point of the app. Drives your rank, streak, daily quest and progress screens. | Convex |
| Game state — rank, division, rank points, coins, streaks, quests completed | Your save file, so progress survives reinstalling or changing phone. | Convex |
| Optional profile — gender, date of birth, height, weight, unit preference, profile photo | Personalises the app. All optional; the app works fully without any of it. Leave blank or clear at any time in Settings. | Convex |
| Onboarding answers — training frequency, goal, motivations, how you found us | To set a fair starting rank, and as our own analytics — we look at these answers in aggregate to understand who the app is for, which motivations are common, and where people found us, so we know what to build next. Your goal also shapes what the app shows you. These answers stay in our database and are not sent to our analytics provider. | Convex |
| Excluded exercises | So the app stops setting you quests for movements you have told it you can't or won't do — for example because of an injury. | Convex |
| Reminder preference — on/off and a time of day | So your reminder setting follows you to a new phone. Reminders are scheduled locally by iOS; there is no push server and no push token. | Convex |
| Subscription status — which plan you are on, whether it is active, in a free trial or expired, and the renewal date. Includes an anonymous purchase identifier linked to your account. | To unlock the app for you, on every device you sign in on, and to show your plan in Settings. We never see or receive your card, bank or payment details — the payment itself happens inside Apple's App Store and only the outcome reaches us. | RevenueCat, and Apple |
| Usage events — which onboarding screens you reach, when you open the app, when you finish a set or clear the daily quest (the move and the count), and whether a purchase went through, was cancelled or failed. Each event also carries the app version, device model, iOS version, language and time zone. Tied to your account identifier. | To see where new players drop out of onboarding, how many come back after a day or a week, and whether the subscription offer works, so we know what to fix. Your IP address is discarded and no location is derived from it. No screen recording. | PostHog |
| Crash reports — the error, the code that failed, the app version, device model and iOS version, and the last few taps and log lines before the crash. Also a small record of each app session (when it started, how long it ran, whether it crashed). Tied to your account identifier. | To find and fix crashes, and to know what share of sessions crash. A crash on your phone is otherwise invisible to us. No IP address, device name, camera frame or screenshot is included. | Sentry |
| Sign-in session token | Keeps you signed in. | iOS Keychain, on your device |
Height, weight, date of birth and gender are fitness-related information. They are entered by you, used only inside the app, and are never sold, shared or used for advertising. The app does not read from or write to Apple Health.
4. What is not collected
- No session recording and no attribution. The app does not record your screen, and it does not report installs to ad or attribution networks.
- No advertising and no advertising identifier (IDFA). No ad networks.
- No tracking across other apps or websites, so the app does not ask for tracking permission.
- No Screen Time or app-usage data. Quest Lock (iOS 18 and later, off by default) asks for Screen Time access so it can lock the apps you pick until the daily quest is done. Apple hands the app an opaque token for your selection, not app names, and the token only works on the phone that made it. The selection, the lock times and the lock itself stay on your device and are never sent to us or anyone else. The app cannot see which apps you use or for how long. Turning Quest Lock off, or revoking Screen Time access in iOS Settings, removes the lock.
- No location data. The app never requests location access.
- No contacts, calendar, microphone or Apple Health access.
- No workout video, photo or camera frame — see section 2.
- Nothing is sold or shared with data brokers. Ever.
5. Who processes data on our behalf
The app is run by one developer, so a small number of infrastructure providers do the hosting. Each one only ever receives what it needs to do its job. Every third party we share data with is contractually required to provide the same or equal protection of your data as this policy describes, and none of them is permitted to use it for their own purposes. We use no advertising networks and no tracking across other apps, so there are no recipients beyond the providers listed here:
- Clerk — authentication. Holds your sign-in identity: email, name and provider account ID. Privacy policy.
- Convex — the database and file storage holding your player record and profile photo. Privacy policy.
- Expo (EAS) — builds the app and delivers over-the-air updates. When your app checks for an update, Expo's servers receive the request, including your IP address and basic device and app-version information. No account data is involved. Privacy policy.
- RevenueCat — manages subscriptions. It receives your account identifier and the outcome of a purchase from Apple, so the app can tell whether your subscription is active. It never receives payment details, and it is not an analytics or advertising service. Privacy policy.
- PostHog — product analytics. Receives the usage events in section 3, tagged with your account identifier. Never your email, name or profile. Privacy policy.
- Sentry — crash reporting. Receives crash reports, tagged with your account identifier. Never your email, name or profile. Privacy policy.
- Apple and Google — only as your chosen sign-in provider. They tell us you signed in successfully and pass on your email and name. We never receive your password.
- Apple — as the payment processor for subscriptions. Your purchase is a transaction between you and Apple: Apple holds your payment method, takes the payment, issues receipts and handles refunds and cancellations. We are told only that a subscription exists and when it renews or ends. Privacy policy.
- Apple — as the App Store and TestFlight operator, Apple may provide us with aggregate, non-identifying statistics such as install counts and, where you have opted in with Apple, crash reports. This comes from Apple, not from anything the app sends.
- Railway — hosts this website. Its servers keep standard request logs, which include IP addresses, for operational and security purposes. This website sets no cookies, runs no analytics, and loads no third-party fonts, scripts or embeds.
6. Where data is stored and transferred
Our providers operate infrastructure in the United States and other countries, so your data will be processed outside your own country, including outside the European Economic Area and the United Kingdom. Where transfers of EEA or UK personal data are involved, our providers rely on the European Commission's Standard Contractual Clauses. By using the app you understand your data is processed in these locations.
7. How long it is kept
Your account and training history are kept for as long as your account exists, because a streak and a rank are only meaningful if they persist. There is no automatic expiry.
When you delete your account, your player record, every logged set, your daily activity history and your profile photo are erased from the database, and your sign-in identity is deleted at Clerk. This is a real deletion, not a deactivation — the data is gone and signing in again creates a brand-new player starting from scratch. Provider backups may retain residual copies for a short period before rotating out.
Usage events are kept by PostHog for up to one year and crash reports by Sentry for up to 90 days, then deleted automatically. Ask at the contact address below and we will delete yours sooner.
Records of subscription transactions are kept longer, by RevenueCat and by Apple, because both of us need them for accounting, tax and refund purposes. These are purchase records rather than training data, and they are retained only for as long as the law requires.
8. Deleting your account and data
In the app: Settings → Actions → Delete Account. You will be asked to type
DELETE to confirm. Deletion is immediate and cannot be undone.
If you cannot reach that screen — for example you have already uninstalled the app — email support@systemquest.fit from the address on your account and we will delete it for you. You can also clear individual profile fields or remove your profile photo at any time in Settings without deleting the account.
Deleting your account does not cancel your subscription. Subscriptions are held by Apple, not by us, and deleting an app account has no effect on billing — nor does simply deleting the app from your phone. Cancel it yourself in Settings → SUBSCRIPTION → Manage in the app, or in iOS Settings → your name → Subscriptions. Cancel before you delete the account, since afterwards the in-app route is gone.
9. Your rights
Depending on where you live, you may have the right to access a copy of your data, correct it, delete it, restrict or object to processing, withdraw consent, and receive your data in a portable format. The app already gives you direct access to all of this: your data is visible on your profile and progress screens, editable in Settings, and deletable in one place.
For anything the app does not cover, email support@systemquest.fit. We aim to respond within 30 days. Where we process personal data of people in the EEA or UK, the legal bases are: performance of a contract (running your account and saving your progress), your consent (optional profile details, the profile photo, notifications and camera access), and legitimate interests (keeping the service secure and working). EEA and UK users have the right to complain to their local supervisory authority.
California residents: we do not sell or share personal information as those terms are defined under the CCPA/CPRA, and we do not process it for cross-context behavioural advertising. Exercising any right here will never result in a worse experience in the app.
10. Children
System Quest is not directed to children under 13, and we do not knowingly collect personal data from them. If you believe a child has created an account, email us and we will delete it. Some jurisdictions set a higher age of digital consent, up to 16 — if you are under that age in your country, please use the app only with a parent or guardian's permission.
11. Security
All traffic between the app and our servers is encrypted with HTTPS/TLS. Your session token is stored in the iOS Keychain. Every database query is authenticated and scoped to your own account, so one player's data cannot be read by another. Passwords are never handled by the app — sign-in is delegated to Apple or Google. No system is perfectly secure, and we cannot guarantee absolute security.
12. Health and safety
System Quest is a fitness game, not a medical device, and nothing in it is medical advice. Rep counting is an estimate produced by a camera and can be wrong. See the Terms of Use for what that means before you train.
13. Changes to this policy
If this policy changes, the version and effective date at the top change with it, and the current version always lives at systemquest.fit/privacy. If a change materially affects how your data is handled, we will tell you in the app before it takes effect.