SideQueso Privacy Policy

Effective date: [EFFECTIVE DATE]
Last updated: [LAST UPDATED DATE]

SideQueso is run by Jade Trail Enterprises, LLC, doing business as SideQueso ("SideQueso," "we," "us"). We are based in New Jersey.

Contact: adventure@sidequeso.com
Mailing address:

1. The short version

If a parent or guardian chooses to give us an email address for news and offers, we use it only to send that news. It is kept separate from your child's play data, and you can unsubscribe anytime.

SideQueso is a learning game. Families play Quests (story-driven quizzes). Many players are kids.
A parent or guardian makes every purchase. Kids do not buy anything.
When a parent buys a Quest, we do not ask for a name, email address, or phone number. Stripe, our payment processor, handles the card. Stripe may ask for a country or ZIP code.
We do not show ads. We do not sell your data or share it for advertising. We do not use kids' data to build profiles or to target ads.
We do not send email receipts for these purchases. You get an on-screen receipt.
Each purchase gets a Family Code. It lets you unlock the purchase on other devices. We store only a scrambled (hashed) version of it. We cannot read it back to you.
Parents can ask to see, stop, or delete their family's data any time. See Section 10.

2. Kids and families (Children's Privacy)

This section is our notice under the Children's Online Privacy Protection Act ("COPPA"). SideQueso is made for kids in about Grades 3 to 12. Many of our players are under 13. We treat SideQueso as a service that kids use.

2.1 Parents buy. Kids play.

Only a parent, guardian, or another adult with permission may buy a Quest, a Premium upgrade, or a pack.
Kids under 13 should play with a parent's permission.
Your purchase is your consent. When a parent pays by credit or debit card, that is how we confirm a grown-up is involved. By paying, a parent agrees to what this policy says about how we handle their child's play data. The card issuer notifies the card owner of each charge. Your statement will show SIDEQUESO.
Free play (such as the Daily Challenge) needs no purchase. See 2.3.

2.2 What we collect from children

We do not ask kids for their real name, address, email address, phone number, photo, voice, or location. In group and family play, a player can type any name they like. It is shown to the others in that room (see 2.4).

Our games use a few random IDs to work. These are "persistent identifiers" under COPPA:

Identifiers used for game operations
What	Why we need it
A random guest ID from our sign-in provider (Supabase "anonymous" sign-in). It is a random number, not a name.	To save quest progress, scores, and rewards.
A device cookie named `sidequeso_purchase_device`. It lasts up to 1 year. We store only a scrambled (hashed) version of it on our server.	To connect a purchase to the device that bought it.
Game progress and rewards: Quests started, answers checked, scores, treasures, diamonds, mementos, cards.	To run the game and save progress.
A Family Code (hashed).	To unlock the same purchase on another device.
A partner code, if you came from a library or other partner link.	To credit the partner. See Section 7.
IP address (see Section 4).	Security and abuse prevention.

We use these for internal operations only, which means:

making the game work and saving progress,
keeping you signed in as a guest,
stopping fraud and abuse and keeping the service secure,
fixing bugs and keeping the service running,
following the law.

What we do NOT do with them (our promises, and how we keep them):

No behavioral advertising. We run no ads.
No profiles of kids. We do not combine IDs to learn who a child is.
No selling. No sharing for advertising. We use no ad trackers.
No contacting a child. We have no email, phone, or chat address for a child.
No using these IDs for anything except the purposes above.

Our kid-facing pages show no advertising. Analytics is covered in Section 4.

2.3 Free play and the Daily Challenge

Kids can play the free Daily Challenge and browse Quests without a purchase. This also uses the random guest ID above, so we can save a score and rewards. We collect no name or contact information for free play. We use the ID only for the internal operations listed in 2.2.

2.4 Things kids should not type or draw

Some features let a player type text (for example, character chat) or draw a picture. That text and those drawings are sent to an AI provider (xAI, when it is the provider in use) to get a reply. We do not filter them for personal information. We do not control how the provider handles them.

Parents, please tell your kids not to type or draw their real name, school, address, phone number, email, or anything else personal.

In group and family play, player names are free text that players type. Everyone in the room can see them. The names are kept only while the room is active. Please use a nickname, not a real name.

2.5 Email sign-in is for adults

SideQueso has an optional adult sign-in that uses an email address (see Section 3.3). It is for parents, guardians, teachers, librarians, and other adults. Kids under 13 should not use it. Sign-in does not check age, so we count on adults to use it. If we learn that an account belongs to a child under 13 and we do not have a parent's permission, we will delete it.

2.6 Who sees children's data

We do not sell or share children's data.
Service providers process it for us, only to run SideQueso (Section 5).
Libraries and partners do not receive any child's data. They get only totals, such as how many purchases came through their code.
We may disclose information if the law requires it, or to protect safety or security.

2.7 Parent rights

A parent or guardian can:

Review what we have about their family.
Refuse further collection or use, and ask us to stop.
Delete their family's data.

How: email adventure@sidequeso.com with your Family Code. The full steps are in Section 10. We will never ask you to pay to use these rights. We will not make a child give more information than needed in order to play.

2.8 How long we keep children's data

We keep data only as long as we need it to run the service. We do not keep children's personal information forever. We have no automatic schedule that deletes old guest play data. A parent can ask us to delete it at any time (Section 10).

Retention of children's data
What	Why	How long
Game progress and rewards tied to a random guest ID	Save progress	As long as needed to run the service, or until a parent asks us to delete it.
Hashed device cookie value and hashed Family Code	Link purchases to devices and restore access	As long as the purchase record, or until a parent asks us to delete them.
Record tied to an IP address for the restore-code limit	Stop guessing attacks	Removed when a later restore attempt is processed. On a quiet day it can stay longer.
Raw IP address in rate-limit tools	Stop abuse	Short-lived.
Server and provider logs	Security and fixing bugs	Set by each provider.
Purchase record (price, date, Quest IDs, Stripe payment ID, partner code)	Accounting and refunds	As long as we need it for those purposes. It has no name or email.

2.9 Questions

Email adventure@sidequeso.com. We will reply within 30 days. See the FTC's COPPA guidance at ftc.gov.

3. What we collect, by situation

3.1 Anonymous Quest purchases (the main way families buy)

You can buy and play without an account. We do not ask for your name, email, or phone.

Stripe shows a secure card form. Stripe processes the card and may ask for a billing country or ZIP code. SideQueso does not receive or store your card number, name, email, or billing address for these purchases.
Stripe may also collect device and browser data, and your IP address, to prevent fraud. Stripe's own policy applies: stripe.com/privacy.
We keep a purchase record: what you bought (Quest or pack, Quest IDs, Premium or not), the price, the time, the processing fee, the partner code (if any), and Stripe's payment ID.
We keep a hashed device cookie value and a hashed Family Code. A hash is a one-way scramble. It cannot be turned back into the code.
A random guest ID links the purchase to your game progress.
The Family Code unlocks your purchase on another device. It does not copy game progress from one device to another.
No email receipt. You get an on-screen receipt with a "Print or save receipt" button.
The Family Code is shown once. Save it. We cannot look it up later.

Our systems link a purchase to a random ID and a device. They do not know who you are. But a card payment can still be traced by Stripe and your bank, and you can contact us with your code. So we call this "no name or email collected," not "no data."

3.2 Free play, Daily Challenge, and browsing

Random guest ID, game progress, scores, rewards, and the technical data in Section 4. No name or email.

3.3 Adult accounts (optional)

Some adults create an account or sign in with an email link (for example, to buy through an account or to manage an organization). For these we collect:

email address,
display name (optional),
sign-in data from our sign-in provider,
usage data, progress, rewards, and purchases tied to the account,
payment status from Stripe (we do not store card details).

We may send account and service emails (sign-in links, purchase confirmations for account purchases) through our email provider.

We may also send optional emails to account holders, such as encouragement to keep playing and Quest recommendations. These are off unless you opt in. Every one has an unsubscribe link, and you can change your choice in your account preferences.

Accounts are for adults. Anonymous purchases are separate from accounts.

3.4 Organizations and Quest Studio users (adults)

If you create Quests or run a library or organization page, we also collect your organization name, contact details, and any source material you upload. Source URLs, PDFs, and images are sent to our AI provider (xAI) to help create Quest drafts. Do not upload children's personal information or student records.

3.5 Emails to us, surveys, and signups

If you email us or fill in a survey or waitlist form, we keep what you send so we can reply. These are for adults only. Do not send us a child's personal information.

4. Technical data, cookies, and storage

When you visit, our servers and providers see your IP address, browser type, and the pages you request.

For purchases and game play, our app does not write IP addresses to its database, except a record tied to your IP address that limits restore-code attempts (see 2.8).
Our rate-limit tools use the raw IP address for a short time.
Our hosting and database providers (Render, Supabase) keep their own logs, which can include IP addresses.
Our error tool (Sentry) is set to not collect personal information by default. For anonymous checkout pages, we drop error reports entirely.

Cookies and browser storage we use:

Cookies and browser storage
Name	Where	What it does	How long
`sidequeso_purchase_device`	Cookie (secure, same-site, not readable by page scripts)	Links a purchase to your device	Up to 1 year
Supabase sign-in session (`sb-...`)	Browser storage	Keeps your guest or account session	Until it expires or you clear it
`sidequeso_org_attribution_v1`	Browser storage	Remembers the partner code you arrived with (code and channel only)	No expiry. Until you clear it
`quest_guest_id` and daily-challenge status keys	Browser storage	Guest play and Daily Challenge state	Until you clear it
`cookie_consent`	Browser storage	Remembers your cookie choice	Until you clear it

Analytics. We use Google Analytics (GA4) only if you click "Accept All" in the cookie banner. It is not used on the home page, landing page, Quest pages, quiz pages, or anonymous checkout. It can load on the email sign-in page and in Quest Studio (for adult creators). You can change your choice in Privacy & Cookie Settings.

You can clear cookies and storage in your browser. If you do, you may lose access on that device until you enter your Family Code.

5. Who we share data with

We do not sell personal information. We do not share it for advertising. We use service providers who act on our instructions:

Service providers
Provider	What they do	Notes
Stripe	Card payments. Pays partner libraries (Stripe Connect).	Collects card and fraud data under its own policy. Keeps payment records as the law requires.
Supabase	Database and sign-in.	Stores our data. Keeps its own logs.
Render	Hosts our servers.	Keeps its own logs.
Sentry	Error monitoring.	Set not to collect personal info. Anonymous checkout errors are dropped.
Resend	Sends account and service emails.	For account holders.
xAI	AI features: typed chat text, drawings, and Quest Studio.	See 2.4 and 3.4. We do not control its retention.
Google (Analytics)	Optional analytics.	Only with consent. See Section 4.
Redis / cache provider	Short-lived rate-limit counters.	Stores short-lived counters.

We may also share information if required by law, to protect safety or rights, or in a sale or merger of our business (with the same protections for your data).

Some pages load fonts or code from content-delivery networks (such as Google Fonts, jsDelivr, unpkg, Cloudflare, or Stripe). Those companies can see your IP address when your browser loads them.

6. How we use information

Provide the game and save progress.
Process purchases, refunds, and restore codes.
Pay partner libraries their share.
Prevent fraud and keep SideQueso secure.
Fix bugs and keep the service running.
Answer parent and customer requests.
Meet legal duties.
Improve SideQueso using summary counts that do not identify anyone.

We do not use children's data for ads, profiles, or sale.

7. Libraries, schools, and other partner organizations

Libraries and organizations can put SideQueso QR codes and links in their buildings and newsletters. Each partner has a partner code in the link (for example ?org=your-library).

What happens:

Your device opens a link with a partner code.
Our page saves the code and the channel (QR, email, or other) in your browser. The code does not expire on its own. It also tells our server a visit happened. The server records only the partner, the channel, and the time. It does not record your IP address, device, or any ID in that record.
If you buy, the partner code is saved on the purchase record so the partner gets credit.

What partners get: credit and payment for sales, and totals. Partners never get a child's data, a Family Code, or progress. Our monthly partner report shows totals only. Stripe pays partners their share through Stripe Connect. The payment record shows our internal sale number and amount, not who bought.

About partners' own data: we keep a partner's name, partner code, and payout status. Stripe collects the identity and bank details a partner needs to be paid (we do not see bank details).

Partners are separate from us. A library's own privacy rules apply to what it does. We do not ask libraries to collect any information from kids for us.

8. Security

We use reasonable safeguards, including:

encrypted connections (HTTPS),
hashing for Family Codes and device cookie values,
limits on guessing Family Codes,
admin tools that only authorized administrators can use.

No system is perfectly secure. If a breach affects your personal information, we will tell you as the law requires.

9. Your choices and rights (everyone)

You can ask us to:

tell you what we have about you or your family,
correct it,
delete it,
give you a copy,
stop using it (where we use it),
close an adult account.

Parents of children under 13: see Section 2.7 and Section 10.

We will reply within 30 days. If we need longer, we will tell you why. If we say no, you can appeal by replying with "Appeal" in the subject. We will answer the appeal within 45 days.

10. How to review, stop, or delete your family's data

Step 1. Email us at adventure@sidequeso.com. Subject: "Privacy request." Say whether you want to see, stop, or delete.

Step 2. Prove it is your purchase. Send your Family Code. We never show it back to anyone, and we store only a hash. Only the person who bought the Quest has it.

Lost your code? Tell us the purchase date, the amount, the card brand, and the last 4 digits of the card. We will try to find the payment. If we confirm it is yours, we can issue a new code. If we cannot confirm it is yours, we cannot act. This protects your family from someone else deleting your data.

Step 3. We act within 30 days. We handle these requests by hand. We will:

See: send you a summary of what we hold for that code.
Stop: unlink devices and end further use. (Tell us if you want us to keep the purchase.)
Delete: delete the progress and rewards we can link to that code, unlink all devices, and turn off the Family Code.

Step 4. We confirm by reply to your email when done.

What this means for your purchase:

Deleting turns off access. The Quests you bought will stop working with that code. A refund is a separate request (see our Terms). Deleting does not automatically refund you.
A refund also turns off access.

What we cannot delete:

Payment records kept by Stripe and your bank. Stripe keeps them as its policy and the law require. Contact Stripe about those.
Our purchase record (price, date, Quest IDs, payment ID, partner code). We keep it for accounting and refunds. It has no name or email. After a deletion request we remove the device and Family Code links from it.
Our record of your request.
Data in backups and provider logs until they expire on their normal schedule.
Summary counts that do not identify anyone.

11. State and U.S. privacy notes

New Jersey. New Jersey has a consumer privacy law (the NJ Data Privacy Act). We follow its main ideas whether or not it applies to us: we tell you what we collect, we do not sell data, we do not do targeted advertising, and we honor access, correction, and deletion requests. Data about a known child is treated as sensitive. We handle children's data under COPPA.
Other states. Some states (such as California) give extra rights. If you live in one, you can use the same request process in Section 9. We do not sell or share personal information, and we do not use it for targeted advertising.
Teens (13 to 17). We do not use teen data for targeted advertising, sale, or profiling.
United States only. SideQueso is meant for users in the United States.
Student records. We do not collect school records. Schools that need a data-privacy agreement can email us.

12. Changes to this policy

We may update this policy. If we make a material change to how we collect, use, or share children's data, we will tell parents before the change applies to a new purchase, and we will ask for new permission where the law requires it. We will post the new date at the top.

13. Contact

Email: adventure@sidequeso.com
Mail:

Also see our Terms of Service and Privacy & Cookie Settings.

By using SideQueso, you agree to this Privacy Policy and our Terms of Service.