Privacy policy

Djinn Foundry S.L. is the data controller for BioQuest. For privacy questions, requests about your data and support, write to [email protected].

• iNaturalist identity. When you sign in with iNaturalist, BioQuest receives your iNaturalist numeric ID, username, display name if you set one, the link to your profile picture and the place text from your iNaturalist profile. BioQuest does not receive your email address.
• iNaturalist credential. BioQuest stores the access and refresh tokens issued by iNaturalist, encrypted, and uses them only on its servers to read your iNaturalist profile and observations. BioQuest requests the iNaturalist “login” permission and does not post, edit or delete anything on iNaturalist.
• Sign-in sessions. The mobile app keeps a BioQuest session token in the device's secure storage; our servers keep only a hash of it. The website uses a sign-in cookie.
• Chosen region. The region you select, stored as an iNaturalist place ID and name.
• Imported observations. Copies of your iNaturalist observations: species and taxon details, quality grade, dates, place names and IDs, latitude and longitude as iNaturalist provides them (obscured where iNaturalist obscures them), and a link to each photo hosted by iNaturalist with its attribution and licence. BioQuest stores the photo link, not the image file.
• Game progress. Points, levels, streaks, quests, badges, your species list, outings (including a centre point calculated from observation coordinates), discoveries you have reviewed, saved target species, campaign contributions, recommendations and your public dossier setting.
• Region search. Text you type into region search is sent to iNaturalist to find matching places. The query and the result are cached for up to 24 hours and are not linked to your account.
• Browser notifications (website only). If you turn on notifications, the push subscription address and keys supplied by your browser.
• Technical data. IP addresses and request details that servers and network providers need to deliver pages and API responses.

Data that stays on your device. Field notes you write in the app, or in the website's offline field pack, are stored only on that device and are never uploaded to BioQuest. Your device's own backup settings may copy them. Photos the app downloads for offline use are kept in the device cache for up to 30 days and are not uploaded.

No advertising, analytics or tracking. BioQuest contains no advertising and no analytics or tracking tools. We do not sell personal data, share it for advertising or track you across other companies' apps and websites.

We process this data to provide the service you ask for: signing you in, importing your observations from iNaturalist, calculating progress, and showing your collection, regional atlas, targets and, if enabled, your public dossier. The legal basis is the performance of our contract with you (Article 6(1)(b) of the General Data Protection Regulation, GDPR).

Technical data is processed to keep the service running and secure, based on our legitimate interest (Article 6(1)(f) GDPR).

Public dossier. Anyone can open bioquest.happyberg.com/u/ followed by your iNaturalist username. If you turn the dossier on, it shows your display name, username, level, points, species and badge counts, current streak, recent badges and up to 50 recent species names with their confirmation status, but only if you turn the dossier on. It shows no coordinates, notes or saved targets. The dossier is off by default; you can turn it on or off in Profile on the website. While it is off, the page shows only your username and that the dossier is private.

Other signed-in users. On the website, signed-in BioQuest users can see your display name, username and ranking on the leaderboard, and your recent discoveries (species name, rarity and time) in the community feed. The public dossier setting does not change this.

• iNaturalist is the source of your observations. Our servers use your credential to read your profile and observations, and send region search text to find places. The app loads photos directly from iNaturalist photo hosts (static.inaturalist.org and inaturalist-open-data.s3.amazonaws.com), which receive your device's IP address. Your use of iNaturalist is covered by iNaturalist's own privacy policy.
• Cloudflare carries public traffic to bioquest.happyberg.com and processes the technical data described above to deliver it. Cloudflare may process this data outside the European Economic Area.
• Browser push services operated by your browser vendor deliver website notifications if you turn them on.
• Authorities, only where the law requires it.

The BioQuest application, database and job queue run on servers managed by Djinn Foundry S.L. in Spain, not on a third-party cloud hosting platform. Cloudflare acts as the network and content delivery provider for public traffic.

• Your iNaturalist identity, credential, region, imported observations and game progress are kept until you delete your BioQuest account. Syncing again updates the imported copies.
• After an account deletion, a receipt containing a hash of the session token, the account ID and an expiry time is kept for 24 hours so an interrupted deletion can be confirmed. A daily maintenance task then removes it.
• Deleted data can remain in server backups until those backups are replaced. Write to us for the current backup period.
• Data on your device stays until you delete it, sign out, delete your account or remove the app.

In the mobile app, open your account and choose Delete BioQuest account. Deletion removes your BioQuest profile, iNaturalist credential, sessions, imported copies and progress from our servers, together with that account's notes and downloaded photos on the device.

BioQuest account deletion never changes or deletes anything on iNaturalist. Your iNaturalist account, observations, photos and identifications stay as they are. Notes you exported and device backups are outside our reach.

After deletion, a receipt with a hash of the session token, the account ID and an expiry time is kept for 24 hours so an interrupted deletion can be confirmed, then removed. Deleted data can remain in server backups until those backups are replaced.

If you cannot use the app, email [email protected] with your iNaturalist username and ask for deletion.

Under the GDPR you can ask for access to your data, correction, deletion, restriction of processing, a portable copy, and object to processing based on legitimate interest. Send requests to [email protected]. We reply within one month.

You can also complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (www.aepd.es).

BioQuest is not directed at children under 14. Do not use BioQuest if you are under 14.

All traffic uses HTTPS. iNaturalist credentials are stored encrypted, and mobile session tokens are stored on our servers only as hashes.

When this policy changes, we update this page and its effective date.