Privacy Policy

This Privacy Policy explains how QuestBoard ("QuestBoard", "we", "us", or "our") collects, uses, discloses, and protects your personal information when you use our website, progressive web app, and related services (collectively, the "Platform").

QuestBoard is a community odd-job marketplace operating in the Philippines. We are committed to protecting your privacy in accordance with Republic Act No. 10173 (the Data Privacy Act of 2012), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC). Where users access the Platform from other jurisdictions, we also aim to align with generally accepted data-protection principles, including the EU General Data Protection Regulation (GDPR).

1. Who We Are (Data Controller)

QuestBoard is the personal-information controller responsible for the data described in this policy. For privacy questions, requests, or complaints, contact our data-protection point of contact at aaronjohn.tamayo29@gmail.com.

2. What Information We Collect

We collect only the information needed to run the marketplace, verify trust between neighbors, mediate payment, and keep the Platform safe.

2.1 Information you provide directly

2.2 Information collected automatically

2.3 Sensitive / regulated information

Government identification documents and payment identifiers (GCash number, ID images) are treated as sensitive personal information under the Data Privacy Act. We apply heightened safeguards to them (see Section 6). We do not knowingly collect information from children under 18; the Platform is intended for adults.

3. How We Use Your Information

• Provide the service — create your account, display your profile, let you post, browse, claim, and complete quests.
• Identity & trust verification — review submitted ID/GCash documents to grant "verified" status, required to post quests.
• Mediate payment via escrow — record agreed prices and payment references so an administrator can confirm funds and release payouts. The platform fee (10%, charged on top of the worker's payout) is calculated from the agreed amount.
• Enable communication — deliver private chat messages and price negotiations between a quest's poster and worker.
• Reputation — compute and display ratings and recent feedback.
• Safety & moderation — review conduct reports, investigate abuse, and act on violations.
• Notifications — send real-time and push notifications about your quests, messages, and transactions (where you opt in).
• Security & operations — monitor request logs, detect fraud, debug issues, and maintain service integrity.
• Legal compliance — comply with applicable laws and respond to lawful requests.

Legal bases: depending on the activity, we rely on your consent (e.g. push notifications, submitting verification documents); the performance of a contract with you (operating the marketplace); our legitimate interests (security, fraud prevention, service improvement); and compliance with legal obligations.

4. How We Share Your Information

We do not sell your personal information. We share it only as described below.

4.1 With other users

Your name, profile photo, general location, bio, verification status, member-since date, reputation scores, and public work history are visible to other logged-in users on your public profile. Within a quest, the poster and worker can see each other's messages, proposed and agreed prices, and acceptance status. We never expose your email, GCash number, or verification document images on public profiles.

4.2 With QuestBoard administrators

Administrators can view escrow transactions, verification submissions (including ID/GCash images via short-lived signed links), and conduct reports in order to verify identity, mediate payment, and moderate the community.

4.3 With service providers (processors)

Payments are made directly between users and to the platform via GCash outside our servers — we record reference numbers and amounts, but we do not process or store card details or bank credentials.

4.4 For legal reasons

We may disclose information when required by law, court order, or lawful request, or to protect the rights, safety, and property of QuestBoard, our users, or the public.

5. Data Retention

• Account, profile, quest, transaction, and rating records are retained while your account is active and as needed for an accurate transaction and reputation history.
• Verification documents are retained while your account is verified; you may request deletion (subject to anti-fraud and legal-retention needs).
• Server request logs are retained for a limited period for security and debugging.
• Push subscriptions are deleted when you disable notifications or the push service reports them invalid.

5.1 Deleting your account

You can permanently delete your account yourself at any time from your Profile page. Deletion is immediate and irreversible. When you delete your account, we:

• Permanently erase your profile (city, bio, GCash number), your government-ID verification image (deleted from our image host, Cloudinary), your saved push-notification devices, and all active sessions and sign-in credentials (password and any linked Google sign-in), so the account can no longer be accessed.
• Anonymize the records we are required to keep for accounting, fraud-prevention, and dispute-resolution purposes — chiefly your past transaction (escrow) history in our administrative ledger. Your name is replaced with "Deleted account" and your email is scrambled to a non-identifying value; the transaction amounts, references, and dates remain for our books, but they no longer identify you.

To protect the other party and any funds in play, you cannot delete your account while you have an open quest posted or an escrow deal in progress. Cancel or complete those first, then delete. If you would prefer us to action a deletion on your behalf, contact us at aaronjohn.tamayo29@gmail.com.

6. How We Protect Your Information

• Verification documents are stored as Cloudinary authenticated assets — never publicly reachable — viewable only through short-lived signed URLs for administrators.
• Passwords are stored hashed, never in plain text.
• Sessions use secure, HTTP-managed cookies.
• Private chat URLs use unguessable identifiers to prevent enumeration.
• Access to sensitive data is restricted to administrators on a need-to-know basis.
• Images are size-capped and compressed on upload.

No method of transmission or storage is 100% secure, but we take reasonable and appropriate technical and organizational measures to protect your data.

7. Your Rights

Under the Data Privacy Act of 2012, you have the right to be informed, to access, to object, to rectify, to erasure or blocking, to damages, to data portability, and to lodge a complaint with the National Privacy Commission.

To exercise any of these rights, contact us at aaronjohn.tamayo29@gmail.com. You may withdraw consent (e.g. disable push notifications) at any time without affecting prior processing. You may also file a complaint with the National Privacy Commission.

8. Cookies

We use a single essential session cookie to keep you securely logged in. We do not currently use third-party advertising or analytics cookies. See our Cookie Policy for details.

9. International Transfers

Some service providers (e.g. Google, Cloudinary, web-push services) may process data on servers outside the Philippines. Where this occurs, we take steps to ensure your information continues to receive an adequate level of protection consistent with the Data Privacy Act.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the revised version with an updated "Last updated" date and, where changes are material, provide additional notice. Continued use of the Platform after changes take effect constitutes acceptance.

11. Contact Us

Questions, requests, or complaints about your personal data: aaronjohn.tamayo29@gmail.com.