Privacy notice
The full notice, for the adult who holds the account.
There is a version written for children tooDavid Nunes Cuba, trading as FacilForge ("we") runs FacilQuest. We are the data controller for everything described here.
- Address: Suite RA01, 195-197 Wood Street, London, E17 3NU, United Kingdom
- Contact for anything in this notice: contact@facilforge.com
- ICO registration reference: ZC232413, registered 27 August 2026. The register is public, so this number is checkable by anyone reading this notice. It expires 26 August 2027 and must be renewed before then, or this line becomes false and the fee lapses
- Last updated: 9 September 2026
Who this notice is about
You, and each child you add to your family. You hold the account. Your children do not: they sign in to a profile you created, on a device you enrolled.
What we hold about your child
| What | Why we need it |
|---|---|
| Their first name | To tell one child's profile from another's, and to name them in the notification you receive when they finish a mission. We do not ask for a surname and there is nowhere to put one |
| Their nickname | It is what they see in the app, and what they chose |
| Their date of birth | Optional. Missions and rewards work without it. If you leave it blank we never ask again |
| A PIN | So a sibling cannot open their profile. We store a hash, never the PIN |
| Their missions, and what happened to each one | This is the product |
| Their points, XP and (if you turn it on) pocket money | Same |
| Their theme, sounds, and how their character looks | So the app looks like theirs. None of it identifies anybody |
Your child's sign-in is anonymous: it carries no email, no phone number and no password.
What we hold about you
Your display name, the email address you sign in with, and — only if you allow notifications — a push token for your device. Enrolled devices are stored as a hash, not as a device identifier we could read.
If you joined the waiting list
You do not have to have the app for us to hold something about you. If you gave us your email address on facilquest.com before FacilQuest was released, we hold that address and the date you gave it, and nothing else. No name, and no record of whether you opened anything.
We hold it because you asked us to, which is consent - and consent you can withdraw at any time by writing to contact@facilforge.com, at which point the address is deleted rather than marked unsubscribed.
It is used for one email, the day the app is on the stores. It is not a newsletter, it is not shared with anyone, and it is not connected to any account you later create. Nobody can read that list through the app or the website: it has no read path at all.
What we do not collect
We do not collect location. We do not ask for contacts or photos. We do not use advertising identifiers.
There is no analytics or tracking SDK in this app. Not Firebase, not Segment, not Amplitude, not Mixpanel, not PostHog, not an ad-attribution SDK. Nothing about your family is profiled, scored, or used to predict behaviour, and nothing is sold or shared for advertising. Ever.
Who else sees it
Four processors, and no one else:
- Supabase stores the data and runs sign-in, on servers in the European Union. Supabase Inc is a United States company, so its staff can reach the data from outside the UK for support. That is covered by the contract we hold with them, which carries the standard clauses and the UK Addendum.
- Expo relays push notifications to your phone.
- Apple or Google deliver that notification to the device.
- RevenueCat runs the subscription. It receives your own account identifier and whether you are subscribed. Nothing about your children reaches it - not a name, not a nickname, not a date of birth. The app hands it your identifier and nothing else.
A notification carries your child's first name and an identifier — nothing else. There is no room in it for anything else: the table it is built from has a first-name column and no message column at all, and a test asserts that a surname cannot reach it.
We do not sell your data. We do not share it with advertisers. There is no fourth party.
Why we are allowed to hold it
Running your family's missions and rewards is the service you asked us for, so
our basis for that is contract. Keeping accounts secure — PIN lockouts,
device enrolment, rate limits — rests on legitimate interests. Push
notifications are your choice, and refusing them breaks nothing. See
section 4 of docs/compliance.md for the reasoning.
How long we keep it
Until you delete it, or until the family has been unused for 24 months, whichever comes first. After 24 months of inactivity we anonymise the family automatically.
Deleting it
In the app: More > Delete account and data.
This anonymises rather than erases row by row, and the distinction is worth being honest about. Balances are derived from an append-only ledger that siblings share, so deleting rows outright would silently change what a different child is owed. Instead we destroy everything that could identify anyone: names, nicknames, dates of birth, PINs, enrolled devices, the sign-in itself, your own identity, and any message you ever typed when sending a mission back. What survives is arithmetic that no longer points at a person, and it cannot be reversed.
Your rights
You can ask us for a copy of the data, ask us to correct it, ask us to delete it, or object to how we use it — for your children as well as yourself. Write to contact@facilforge.com and we will answer within one month.
Today, deletion is instant and in the app; a data export is not built yet, so a request for a copy is handled by hand. That is a real limitation and we would rather state it than imply a self-service export exists.
If you are not happy with our answer you can complain to the Information Commissioner's Office at ico.org.uk.