1. What we collect
To run DubaiQuest we collect a small, purposeful set of data:
- Account information: your email address, a hashed (never plain-text) password, and the display name you choose.
- Gameplay data: your selected neighborhood, items you've collected, points earned, and leaderboard standings.
- Security & abuse-prevention data: your IP address, timestamps of logins and collection events, and basic request metadata — used for rate limiting, fraud/anti-cheat detection, and account security (e.g. locking an account after repeated failed logins).
- Age & terms confirmation: the timestamp at which you confirmed you are 18 or older and accepted our Terms.
2. What we don't collect
DubaiQuest does not use Google Analytics, Facebook Pixel, or any third-party advertising/analytics trackers. We don't sell or share your data with data brokers or advertisers. This is a privacy-first product decision, not just a legal minimum — the only logs we keep are our own server logs, used strictly for operating and securing the game.
3. Why we collect it
- To create and secure your account and let you log back in.
- To run gameplay: track your collected items and points, and compute leaderboards.
- To detect and stop cheating, spam accounts, and abusive traffic (rate limiting, collection-velocity checks, IP-based throttling).
- To meet our legal obligation to confirm players are 18 or older before creating an account.
4. Data retention
We retain account and gameplay data for as long as your account is active. Security-related audit logs (login attempts, collection events, IP addresses) are retained for a limited period to support fraud investigation and are pruned periodically. If you delete your account, we remove your personal information within a reasonable period, except where we're required to keep minimal records for legal or security purposes (e.g. a record that a banned account existed).
5. Your rights
You can:
- Request a copy of the personal data we hold about you.
- Ask us to correct inaccurate data (e.g. your display name).
- Ask us to delete your account and associated personal data.
- Withdraw consent by simply not using the service — we don't need marketing consent, since we don't send marketing email beyond transactional account emails (verification, password reset).
To exercise any of these rights, contact us using the details below.
6. Cookies & local storage
We use a single, strictly-necessary session cookie to keep you logged in (httpOnly, secure, SameSite). Your browser may also store small preferences locally (like a sound-muted setting) — this stays on your device and is never sent to us.