Privacy Policy

This Privacy Policy describes what information Quest ("we," "us") collects when you use the Service, why, and who else it goes to. It's written to actually describe what Quest does, not generic boilerplate — if you spot something here that no longer matches how the product actually works, that's a bug, tell us.

1. Information you provide directly

If you sign up as a resident: name, email, phone (optional), budget, move-in date, preferred cities, a lifestyle questionnaire (daily rhythm, cleanliness, social energy, noise tolerance, guests, culture/ language, diet), a free-text bio, income source, and any safety requirements you choose to set (e.g. needing a confirmed LGBTQ+ affirming, sober-living, or elder-friendly home) — these are requirements you set for a host, never information a host uses to screen you.

If you list a room or property: similar property and lifestyle details, photos, and safety/household declarations you choose to make about your own home.

If you use "My Nesting Card": a public, shareable summary of your resident profile (first name, budget, cities, lifestyle tags, trust badges) — off by default, visible only if you turn it on yourself, and never includes your email or phone number.

2. Identity verification

If you choose to verify your identity, your government ID and selfie are submitted directly to Stripe Identity, our identity-verification processor — Quest never receives or stores the document itself, only the verification outcome (verified / pending / failed) and, if you provide one, a school or work email used to verify institutional affiliation.

3. Payment information

Payments are processed entirely by Stripe. Quest never sees or stores your card number — we only receive confirmation that a payment succeeded and which match it unlocked.

4. Messages

If you message a match through Quest, the message content is stored so the conversation persists, and delivered in real time to the other person in that specific conversation. We don't read your messages except as needed to investigate abuse reports or as required by law.

5. Automatically collected information

Signing in sets an authentication session cookie so you stay signed in — that's the only cookie Quest itself sets. Our bot-protection provider (Cloudflare Turnstile) processes some request metadata (like IP address) to distinguish humans from bots on public forms; Quest doesn't otherwise use third-party analytics or ad-tracking cookies today.

6. Who we share it with

We use a small number of service providers to run Quest:

• Supabase — database, authentication, file storage, and realtime messaging
• Stripe — payment processing and identity verification
• Resend — transactional email (portal links, match notifications)
• Cloudflare — bot protection (Turnstile)
• Google — optional sign-in (Google OAuth)
• Vercel — application hosting

We don't sell your personal information, and we don't share it with anyone for their own advertising purposes. Other Quest users only ever see what this Service is designed to show them: a host sees a resident's lifestyle fit and (only after paying to unlock) contact info; a resident sees a listing's public details. Protected-characteristic fields are never shown to a host as a reason to decline someone — see our Terms of Service.

7. How long we keep it

We keep your information for as long as your account is active, plus a reasonable period afterward for legal, security, and record-keeping purposes. You can request deletion of your account and associated data at any time — see Section 9.

8. Security

We use industry-standard measures to protect your data, including row-level access controls in our database and delegating all payment and ID-document handling to PCI-compliant, purpose-built processors (Stripe) rather than handling that data ourselves. No system is perfectly secure, and we can't guarantee absolute security.

9. Your rights

You can access, correct, or request deletion of your personal information by signing in and editing your profile, or by emailing [privacy@quest.surf]. Depending on where you live, you may have additional rights under laws like the GDPR or CCPA — contact us and we'll do our best to accommodate the request.

10. Children's privacy

Quest isn't intended for anyone under 18, and we don't knowingly collect information from anyone under 18.

11. Changes to this policy

If we make a material change, we'll update the date at the top of this page. We encourage you to review it periodically.

12. Contact

[privacy@quest.surf] · [business mailing address]