Privacy notice

What we store

• Your account: email, the name you choose, and your password, stored only as a one-way hash (we can't read it).
• If you ask for a password reset: a one-time link, stored only as a hash, that stops working after 45 minutes or once used. We email you only for password resets and to tell you your password changed. No newsletters, no marketing.
• Your character: what you tell us when you create it and later: name, age, body stats, activity, where you train and your equipment, sports, injuries to protect, usual wake and sleep times, goals, and, only if you add them, habits you want to break, stress level and money details. You can change any of it at any time.
• Your play: quests, logs, notes, moods, the optional photos you attach, streaks, chapters, bosses and items.
• If you turn on reminders: the browser push address for each device you choose.
• If you join a party: the display name you pick for that party. Party members see only that name, your level and shared quest progress, never your profile, notes, photos or money.
• If you start or accept a friend challenge: the display name you pick for it. Your friend sees only that name and a count (for example workout days this week), nothing else.
• If you tap Share on a trophy, title or level: a public card with that achievement only, at a random link. It never shows your name or anything else about you. Deleting your account deletes your cards.

Who can see your data

• Only you. Your body stats, habits, notes, photos and money are never shown to party members, other players or anyone else.
• The basic plan needs only the basics. Everything extra is optional and only makes your plan more personal.

How money details are protected

Your income, spending plan, assets, debts, spending and income entries, repeating entries, money check-ins, money boss amounts and coach chat messages are encrypted with AES-256-GCM before they're stored, using a key kept separately from the database. Each value is locked to your account, so a copy of the database alone wouldn't reveal them. They're decrypted only on our server to show them to you and to work out your next money step. Quests that mention an amount store a placeholder; the amount is filled in only when the page is shown to you. The month a spending entry belongs to is kept unencrypted so a month can be listed quickly; it never includes an amount or category.

Money amounts are never sent to party members, advertisers, analytics, error logs or an AI provider. The AI coach sees only progress words such as "emergency fund about 40% done" or "has high-interest debt: yes", and anything that looks like a rupee amount is removed from what it sees. You can delete every money detail in one step from Wealth or Settings.

Your circle, reflections and check-ins

The first names in your Bonds circle (and who they are to you, how often you want to talk and when you last did), your morning sleep-and-mood check-ins and your one-line night reflections are encrypted the same way, locked to your account. Quests that mention someone from your circle store a placeholder; the name is filled in only when the page is shown to you. Names are never sent to the AI coach, party members or logs.

Rozquest never messages, calls or contacts anyone for you. It only suggests; you decide. Use first names or nicknames only: phone numbers, emails and links are refused. Remove someone any time from Journey → Bonds; deleting your account removes everything.

Habits, skills and side-hustle stages store only which item you picked and the days you ticked; side-hustle income goes into your encrypted money tracker.

Our own usage stats

To learn which parts of the game help people and where they get stuck, Rozquest counts a few simple events on its own server: for example “opened the landing page”, “signed up”, “finished a quest” (with its life area, like body or wealth), “reached level 3” or “came back after 7 days”.

• Each event is tied to a random ID, not your email or name. It never includes health values, money amounts, notes, names of people or anything you type.
• When you first visit we keep where you came from in broad terms only: campaign tags in the link (utm), the website that linked to us (its domain, never the full address) or a friend's invite code. This is stored with your random ID when you sign up.
• With each event we also keep coarse context: the kind of device (phone, tablet or computer), the browser and operating system family (for example Chrome on Android), and the country and city our host works out from your connection. We never store your IP address or the full browser string, and cities with very few players are grouped as “other” in the owner's charts.
• Inside the app we count which screen you opened (for example Today or Journey), at most once every few minutes, to see which parts get used.
• Three small first-party cookies hold the random ID, the source, and which of two landing page headlines you saw (we test which one explains Rozquest better). There are no third-party scripts, pixels or ad networks.
• If your browser sends Do Not Track or Global Privacy Control, we record nothing and set none of these cookies.
• Only the site owner sees the totals, as charts and a CSV of totals. Deleting your account deletes your events too.
• We never sell or rent this data, or any other data about you, to brands or anyone else.

What we don't do

• No ads, no selling or sharing your data, no third-party trackers or analytics scripts. Our own usage stats are described above.
• No bank or health-app connections. Everything comes from what you type.

How AI works here

• Daily limits. Each player gets 20 AI coach chats and 3 AI plans (quest picks and generated plans) a day. They refill at midnight UTC, which is 5:30 AM in India. The coach screen shows how many are left.
• Why there are limits. The AI runs on free tiers from Google Gemini, Groq and OpenRouter. Free tiers have daily quotas shared by everyone, so the limits keep AI available for every player. There's also a game-wide daily cap.
• It never stops working. If your chats run out, the game-wide cap is reached or the free providers are busy, the built-in coach answers instead, with simpler replies based on the same evidence. Crisis messages always get human help lines first, never AI.
• Unlimited with your own key. You can add your own free Gemini key in Settings → AI coach. It's encrypted, never shown again, and you can remove it any time.
• Privacy. No money amounts, names, emails, notes or photos are sent, only rounded, nameless context (details below). Free providers may keep prompts or use them to improve their models, so please don't type anything into the coach you wouldn't want a provider to see.

The AI coach

The coach always works without AI: built-in, rule-based guidance that never leaves our server. If you turn on Never use AI in Settings, nothing of yours is sent to any AI provider, ever, until you turn it off. When AI is switched on, a reply or a set of quest picks may be written by one of these providers, tried in this order: Google Gemini, Groq, then OpenRouter (free models, which route to the model's host). An optional OpenAI-compatible provider may be tried last. If you save your own Gemini key in Settings, your requests go to Google with your key first.

What a provider may receive: your coach message and the last few chat messages, with amounts, names, emails, phone numbers, links and ID numbers replaced by placeholders; and a rounded summary such as your age band ("30s"), sex, BMI band, activity level, injury areas (not notes), rounded sleep and stress, diet type, work situation, goals, daily minutes, level, streak, rounded stats and money progress words. For quest picks it also gets the names of the curated quests on offer.

What a provider never receives: money amounts, your name or email, your Bonds circle names, notes, injury or habit notes, journal or night-reflection text, photos or your exact body measurements. Crisis messages never go to an AI: they get help lines straight away. Free tiers of these providers may keep prompts or use them to improve their models, which is why only this reduced context is sent. AI replies pass a safety filter (no medicine doses, stock or crypto tips, extreme diets or extreme exercise) before you see them.

Where it lives

Data is stored in a hosted database in Mumbai (India) and served over HTTPS. Money details are encrypted at rest as described above. Sessions use a secure, http-only cookie. Photos are only ever served to you.

Your controls

• Edit your character at any time from Me.
• Delete a photo or note from any quest.
• Delete your account in Settings. This removes your account and every row linked to it straight away, and can't be undone.

For ages 18 and up

Rozquest is for players aged 18 and up. That's an age requirement, not adult content. Sign-up asks you to confirm you're 18 or older, and character creation and profile edits only accept an age of 18 or more. We don't knowingly collect data from anyone under 18. If a minor has an account, it can be deleted at any time from Settings, which removes everything straight away, or email support@rozquest.com and we'll remove it.

About

Rozquest is built and run by Tarun Kapoor on Instagram (opens in a new tab). Contact: support@rozquest.com

Contact and grievances

Questions, requests about your data (access, correction or deletion) or complaints: email support@rozquest.com. It is also our grievance contact under India's IT Rules and the Digital Personal Data Protection Act. Please include the email you signed up with; never send your password.

If you're struggling

Rozquest is not a crisis service. In India, call Tele-MANAS on 14416 (free, 24×7) or 112 in an emergency.