Privacy Policy

Last updated: 2 October 2026

This policy explains what personal data QuestKey ("we") collects when you use questkey.io (the "Platform"), why, and what rights you have. It is written to meet the transparency requirements of the EU General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law No. 6698 (KVKK).

1. Who is responsible

The data controller is QuestKey. Contact: a direct message to @questkeyio on X.

2. What we collect

Category	Data
Account	Your wallet address; for the X (Twitter) account you link: its ID, username, display name, profile picture, creation date and follower count
Platform activity	Completed tasks, information you submit for tasks (e.g. an in-game username), XP, XP conversions, opened boxes and $QKEY amounts
Security and device	IP address, browser and device (user agent), connected wallet app, installed wallet extensions, connected network, screen size, language and time zone
Errors and support	Error logs generated on the Platform, and the description and optional contact detail you enter in a bug report

We do not ask for your name, ID number, phone number or any special category data. We never store your X password or X access tokens.

3. Why we use it (and legal bases)

To run the Platform for you — wallet sign-in, task verification, XP, boxes and rewards. Basis: performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5/2-c).
To prevent fraud and multi-account abuse so rewards stay fair. Basis: legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5/2-f).
To find and fix bugs and keep the Platform secure. Basis: legitimate interests.
To comply with the law and respond to lawful requests. Basis: legal obligation (GDPR Art. 6(1)(c); KVKK Art. 5/2-ç).

We do not sell your data and do not use it for advertising.

4. Cookies

We only use cookies the Platform needs to work: a session cookie that keeps you signed in (7 days) and short-lived security cookies during sign-in (up to 10 minutes). Your wallet connection is remembered in your browser's local storage. We use no advertising, marketing or third-party analytics cookies.

5. Who we share it with

Only the service providers we need to run the Platform:

Supabase — database hosting (servers in Germany)
Vercel — website hosting (global infrastructure)
X Corp. — linking your X account and verifying tasks
Reown / WalletConnect — mobile wallet connections

Some of these providers process data outside your country (including outside the EU and Turkey). Where required, such transfers rely on appropriate safeguards such as standard contractual clauses. We may also disclose data to authorities where the law requires it.

Blockchain data is public. On-chain actions such as $QKEY withdrawals are recorded permanently and publicly on Robinhood Chain together with your wallet address. We cannot change or delete blockchain records.

6. How long we keep it

We keep personal data only as long as needed for the purposes above or as required by law, then delete or anonymise it — or earlier if you ask us to delete it. For error logs we keep only the most recent occurrences of each error. Blockchain records are outside our control.

7. Your rights

Depending on where you live, you can ask to access, correct or delete your data, restrict or object to its processing, receive a copy (portability), and object to decisions made solely by automated means. You can also complain to your data protection authority (in Turkey, the KVKK Authority; in the EU, your local supervisory authority).

To make a request, contact us via a direct message to @questkeyio on X. Include the wallet address you use on QuestKey; we may ask you to sign a message with it to confirm it is yours. We respond within 30 days, free of charge.

8. Age

The Platform is not intended for anyone under 18. If you believe a minor has given us data, contact us and we will delete it.

9. Changes

We may update this policy. The current version is always published on this page with its date.