Privacy Policy

Effective date: April 14, 2026 · Last updated: September 14, 2026

Sidequesting is built around a simple idea: your location, your messages, and your plans belong to you and the friends you choose to share them with — not to us, and not to advertisers.

Who we are

Sidequesting is operated by Jorrel Patterson (an independent developer).
Contact: info@sidequesting.io
Website: https://sidequesting.io

What information we collect

Sidequesting stores data on your device and uses cloud services to manage accounts, synchronize squad activity, and support the features described below.

Information you provide

• Account info. An email address for sign-in codes, and an optional password if you set one. No phone number.
• Profile info. A display name, optional avatar, and a public key (auto-generated) for message verification.
• Squad info. Squad names and 6-character join codes.
• User-created content. Festival names, cities, dates, rally-point labels, and other text you enter when creating or configuring a festival or squad.

Information generated by usage

• Schedule picks, check-ins, messages, positions, totems, camp pins, and other squad activity you share within a squad. Stored locally and synced to squad members via cloud or Bluetooth mesh.
• Location data. Precise GPS coordinates for the radar and squad location features. When live radar or pocket mode is enabled, coordinates are sent through our backend provider and shared with your squad members. With your permission, pocket mode also uses location while the app is in the background. Disable location or pocket mode anytime in Settings.
• Motion / compass data. Magnetometer for the compass. Never leaves your device.
• Moderation data. If you report a message, the report (including the reported message text) is sent to us for review. If you block a user, the block is stored so their content stays hidden, and we are notified of the content that prompted it.
• Product analytics and diagnostics. In production, we collect limited account-linked events such as account creation, screen views, and feature use, together with app version, platform, and random session identifiers. Mesh reliability records include random installation and session identifiers, squad identifiers, delivery timing, and nearby peer counts and signal-strength summaries. These records do not include message text or precise GPS coordinates.
• Bluetooth discovery data. Scans for nearby Sidequesting users for mesh relay. We do not log Bluetooth device identifiers.

Information we do NOT collect

We do not collect advertising IDs, browsing history, contacts, photos, or any data unrelated to the features you use. Limited product analytics and diagnostics are described above. No third-party trackers or advertising SDKs.

How we use information

• To run the app. Syncing your schedule, messages, and location between squad members.
• To authenticate you. Sending one-time sign-in codes by email.
• To operate the mesh. Encrypted messages may relay through nearby phones. A device needs the squad's encryption key to read the contents.
• To improve reliability. Product analytics and mesh diagnostics help us understand feature use and fix delivery issues.

We do not use your information for advertising or sell it.

How your information is protected

• Encryption. Messages relayed phone-to-phone over the Bluetooth mesh are encrypted with your squad's key (XSalsa20-Poly1305). Cloud synchronization uses TLS in transit and access controls on our backend. Cloud event content is readable by the backend to provide synchronization and moderation; it is not end-to-end encrypted.
• Device storage. Private keys are stored using the operating system's secure storage. Other app data is stored locally as needed for offline use.
• HTTPS in transit. All cloud traffic uses TLS.
• Row-level security. Backend (Supabase / Postgres) access rules limit app users to reading data from squads they belong to.

Sharing

We do not sell, rent, or share your data with advertisers, data brokers, or analytics providers.

Your data is seen by:

• You, on your devices.
• Your squad members, who receive data you explicitly share.
• Supabase (our backend provider), which stores account and cloud event data needed to operate synchronization. Their privacy policy.
• Push notification services. If you enable notifications, an Expo push token and delivery metadata are processed by Expo and the platform notification services to deliver alerts.

We may disclose information if legally compelled.

Your controls

• Leave a squad from the squad settings screen.
• Delete your account in the app: Home → Settings (gear icon) → Delete account. This removes your sign-in account, profile, account-linked product analytics, memberships, and squads you own. Content you shared in a squad owned by someone else can remain in that squad with its account reference removed; copies already delivered to other devices may also remain.
• Request account and data deletion outside the app: Email info@sidequesting.io with the subject “Sidequesting account deletion” and the email address used for your account. We may verify account ownership before processing the request. Tell us if you also want shared content removed. Retention exceptions are described below.
• Disable location, pocket mode, and Bluetooth from the app or your phone's Settings.
• Export your data by contacting us. Provided within 30 days.

Children

Sidequesting is not directed at children under 13. If you believe a child has provided information, contact us and we'll delete it.

Retention

• Cloud squad activity: retained to support squad history until the squad is deleted or a deletion request is processed. Account deletion removes squads you own. Shared content in other squads may remain as described above.
• Local event log: on your device until you delete the app.
• Account info: until you request deletion.
• Product analytics: account-linked app events are kept for product operations and deleted when the account is deleted.
• Diagnostics, moderation, and public festival records: mesh diagnostics and moderation reports may be retained to investigate reliability or safety issues. Public festival information may remain after the submitting account is deleted. These records are not all automatically removed by account deletion; contact us to request their review or removal.

International users

Sidequesting is operated from the United States. Data is transferred to and processed in the US.

California / GDPR rights

California residents (CCPA) and EU/UK residents (GDPR) have the right to know, request deletion, request correction, and opt out of data sales (we don't sell). Email info@sidequesting.io.

Changes

Material changes will be posted here with an updated date. Continued use constitutes acceptance.

Contact

Questions? info@sidequesting.io