Privacy Policy

1. Who we are

Quest Robux is run by Matias Calancea. We are the controller of your personal data, which means we decide how it is used and are responsible for protecting it.

2. What we collect

Account: your email address and your password. We store your password only as a salted hash, so nobody can read it, including us.

Quest Points: your balance, your points history, your level, which tasks and quests you finished, and your gift card requests and the gift card code, which is stored encrypted.

Logins: a random login token for each device you sign in on, stored only as a hash, with the time it was created and last used. If you ask to reset your password, a one-time code, also stored only as a hash.

Security: your internet (IP) address and the email you type when logging in or resetting your password are held in server memory for up to one hour to limit repeated attempts. They are not written to disk.

Quests run by partners: if a quest is provided by a partner, the partner tells us the quest was completed, using your account’s anonymous ID. We don’t give partners your email address.

Support: the messages you send from the Help tab, the topic you pick, and the answers from our automatic account check and from us. The account check reads only data listed above; it doesn’t collect anything new. If we reply, you get a notification in the app.

3. What we never collect

We don’t collect payment card or bank details, your location, your contacts, or special categories of data (such as health, religion or biometrics).

The app contains no advertising, analytics or tracking tools, and we don’t track you across other apps or websites. Because of that, there is nothing for “Do Not Track” or Global Privacy Control signals to switch off; we treat everyone as having opted out.

4. Why we use your data

To create and run your account, log you in, track your Quest Points, and review and deliver gift card requests. Legal reason: we need this to run the app you signed up for (GDPR Article 6(1)(b)).

To email you a one-time code when you ask to reset your password. Legal reason: we need this to run the app you signed up for (GDPR Article 6(1)(b)). We don’t send marketing emails.

To answer your support messages automatically, to read them so we can fix problems in the app, and, if we reply, to tell you in the app. Legal reason: we need this to run the app you signed up for (GDPR Article 6(1)(b)).

To keep the service secure: limiting repeated login attempts, preventing fraud and duplicate gift card claims, and keeping a record of admin actions on gift card requests. Legal reason: we have a genuine need to protect the app and its users (GDPR Article 6(1)(f)). You can object to this by emailing us.

To meet legal obligations, such as responding to a lawful request from authorities. Legal reason: the law requires it (GDPR Article 6(1)(c)).

You must give an email address and password to create an account; without them we can’t provide the service.

Gift card requests are checked automatically against your balance, stock and your account status. When a request passes these checks it is usually delivered right away; otherwise it waits for a person to review it. We don’t use your data to profile you. If you think an automatic decision about your request was wrong, email us and a person will review it (GDPR Article 22).

5. Who we share it with

Our hosting provider, which runs our server and stores our database.

Our email provider, which sends our password reset emails. It gets your email address only to send those emails to you.

These providers process data only on our instructions under data processing agreements. We do not sell your personal information, and we do not share it for targeted advertising.

6. Transfers outside the EU

Some providers, such as our email provider, are in the United States. When your data is transferred outside the European Economic Area, we rely on the EU–US Data Privacy Framework where the recipient is certified under it, or otherwise on the European Commission’s Standard Contractual Clauses. Contact us for a copy of the safeguards.

7. How long we keep it

Account, Quest Points, gift card and support data: until you delete your account.

Password reset codes: at most 15 minutes, and deleted as soon as they are used.

IP addresses and typed emails used for rate limiting: at most one hour, in memory only.

When you delete your account, we erase your data from our server straight away. We keep no backups.

8. Your rights

Wherever you live, you have the right to: access your data and get a copy; correct it; erase it; restrict how we use it; receive it in a portable format; and object to how we use it. We won’t treat you differently for using these rights.

You can delete your account yourself in the app. For any other request, email us from the email address on your account so we can confirm it’s you. It’s free, and we reply within one month (up to three months for complex requests, in which case we’ll tell you).

We do not sell your personal data, use it for targeted advertising, or use it to make automatic decisions with legal or similarly significant effects, so there is nothing to opt out of.

If you disagree with our answer to a request, reply to it and we will review it again. If you’re still not satisfied, you can complain to the data protection authority or consumer protection authority where you live.

9. Children

You must be 16 or older to create an account, and we don’t knowingly collect personal data from anyone under 16.

10. Security

Passwords, login tokens and reset codes are stored only as hashes, gift card codes are encrypted, and on your phone your login is kept in the system’s secure storage. Only you can see gift card codes delivered to your account.

If someone ever gets access to your data without permission, we will tell you and the authorities as soon as possible.

11. Roblox

Quest Robux is not affiliated with, endorsed by or connected to Roblox. Quest Points are not Robux and have no cash value.

12. Changes

You can read this policy at any time in the app under Settings → Privacy Policy, and from the login screen.

If this policy changes, we’ll show it to you again in the app before you continue, so you always know what applies. We will never use data already collected in a materially different way without telling you first.