QuestGo Privacy Policy
Version: v1 Last updated: 3 October 2026
This Privacy Policy explains what information QuestGo ("QuestGo", "we", "us") collects, how we use it, who processes it on our behalf, and the choices available to you. QuestGo helps children with their homework through guided practice, explanations and feedback, with a parent or guardian in control of the account. This policy is written for the parent or guardian who sets up and manages the account.
QuestGo is currently available by invitation while we refine the product. Features and this policy may be updated over time; we describe how we handle changes in section 12.
1. Who this applies to
QuestGo accounts are created and controlled by a parent or guardian ("you"). Your child uses QuestGo under your account and supervision. You accept this policy on behalf of yourself and the child(ren) using your account.
2. Information we collect
Parent account
- Email address and password (handled by our authentication provider; we never store your password ourselves).
- A family name you choose.
Child profile (entered by you)
- A display name or nickname (you choose what to enter — it need not be a full or legal name).
- School level (optional).
- Birth year (optional; year only — we do not collect a full date of birth).
- A chosen on-screen companion.
- A 4-digit PIN you set for your child to enter the child area. We store only a one-way hash of the PIN, never the PIN itself.
Worksheets and images
- Worksheet pages/images you upload. These are stored privately (see Security).
- Uploaded images may themselves contain identifying information — for example, a child's handwritten name on a worksheet. We do not ask you to include this, and we cannot detect or remove it; such content is processed as part of the image (see AI processing).
Learning activity
- Your child's answers, attempts, progress, and the learning content QuestGo generates from your worksheets.
Voice recordings (only if you enable voice features)
- When your child uses the AI reading feature, their microphone recording is captured in the browser and sent for processing. QuestGo does not store the raw recording after it has been processed (see Retention).
Technical
- A signed session cookie to keep you (and the child area) logged in. We do not currently use third-party analytics or advertising trackers.
3. How we use information
- To run QuestGo: create your family and child profiles, process worksheets into activities, present teaching and feedback, and track learning progress.
- To generate spoken audio for learning (text-to-speech).
- To transcribe and assess reading when you enable voice features.
- To personalise and support your child's learning over time.
We do not sell your or your child's personal information, and we do not use your child's data to train QuestGo's own AI models.
4. AI processing and AI providers
QuestGo uses artificial intelligence to deliver its core features, and currently relies on OpenAI's API services for AI processing. Depending on the feature, the following may be sent to OpenAI:
- Worksheet content and images — to read and structure the worksheet. Because images are sent as uploaded, any identifying information visible in an image (such as a handwritten name) is included in what is processed.
- Worksheet text, questions and your child's responses — to generate learning activities, explanations and feedback.
- Text — to generate spoken audio (text-to-speech).
- Voice recordings — when voice features are enabled, to transcribe and assess your child's reading.
Our structured (non-image) requests to the AI provider are designed not to include unnecessary identifiers such as your child's name, account identifier or birth year; a coarse school level may be included so activities are pitched appropriately. This does not change the fact that an uploaded image may contain identifying information, as noted above.
Training vs. retention — what this means in plain terms:
- OpenAI does not use API inputs and outputs to train its models by default, and QuestGo does not opt in to sharing children's API inputs or outputs for model training. QuestGo also does not use children's data to train QuestGo's own AI models.
- OpenAI may temporarily retain certain API data in accordance with its applicable data-retention and safety policies. This provider-side handling is governed by OpenAI, not by QuestGo.
- Separately, QuestGo does not store the raw voice recording after processing (see Retention). This statement refers to QuestGo's own storage and is separate from OpenAI's processing and retention.
5. Service providers who process data
| Provider | Role | What they process | Location |
|---|---|---|---|
| Supabase | Authentication, database, file storage and related backend services | Account, child profile, worksheets/images, answers, learning progress, consent records, generated audio | Primary QuestGo application data hosted in Singapore (AWS ap-southeast-1) |
| OpenAI | AI processing | Worksheet content/images, learning responses, text for speech, and (if voice enabled) voice recordings | Processing may occur outside Singapore |
Using these providers means some information — including worksheet images and, if enabled, voice recordings — is transferred to and processed by them. We rely on these providers' own security and data commitments for the processing they perform.
6. Children's information
QuestGo is designed to be set up and controlled by a parent/guardian. We collect the minimum child information needed to run the service and avoid unnecessary identifiers (we do not collect NRIC, full legal name, home address, or school name). You are responsible for what you choose to enter and upload.
7. Retention
- Parent/account information, child profile, worksheets/images, answers/attempts, learning progress and other information necessary to provide the service are kept while your account is active.
- Raw voice recordings are processed in memory and are not stored by QuestGo after processing — they are not written to our storage, database or logs. (Any temporary provider-side retention is governed by the AI provider, as described in section 4.)
- Results derived from a reading session (such as transcription, assessment or practice suggestions) may be kept to support your child's learning.
- Generated speech audio may be cached to avoid regenerating identical audio; the cache is keyed by the content of the text, not by your child or family identity.
8. Your choices and requests
- Deletion: you can request deletion of your account or your child's data by contacting privacy@questgo.sg.
- Consent: you provide consent during setup. You can view your current consent status in Settings › Privacy, and contact privacy@questgo.sg to change it. Withdrawing voice consent stops future AI reading assessment but cannot undo processing already completed. (Consent changes are handled by request; Settings › Privacy shows your status and links, and does not by itself withdraw consent.)
- Access/correction: you can view and edit your child's profile in the app, and contact privacy@questgo.sg with any other request.
9. Security
- Data access is restricted per family using database row-level security.
- Uploaded worksheet images and generated audio are stored in private buckets that are not publicly accessible.
- Child PINs are stored only as one-way hashes.
- Data is encrypted in transit.
- High-privilege system keys are confined to server-side code and are never exposed to the browser.
No system is perfectly secure, but we take measures appropriate to the service and the sensitivity of the data.
10. Data location and transfers
QuestGo's primary application database and storage are currently hosted in Singapore (on Supabase, AWS Singapore region). Some service providers, including our AI provider, may process information outside Singapore. By using QuestGo and enabling the relevant features, you acknowledge this processing and transfer.
11. How we protect personal data under the PDPA
We aim to handle personal data in line with Singapore's Personal Data Protection Act (PDPA), including collecting only what we need, using it for the purposes described here, and responding to access, correction and deletion requests.
Data Protection & Privacy Contact For questions about personal data, access or correction requests, consent, or deletion requests, contact privacy@questgo.sg. This mailbox is actively monitored.
12. Changes to this policy
We will update the version number when this policy changes materially and, where a change affects what you previously agreed to, ask you to review the updated consent.
13. Contact
- Privacy, personal-data and deletion requests, and data-protection matters: privacy@questgo.sg
- Product support and account issues: support@questgo.sg