sidelegal

Privacy Policy

Last updated: 25 October 2026

This Privacy Policy explains how QuestDrop AB ("Side", "we", "us") collects, uses, and shares information when you use the Side mobile application (the "App") and the side-social.com website. Side is operated from Sweden, and we act as the data controller for the personal data described below under the EU General Data Protection Regulation (GDPR).

If you have any questions, contact us at hello@side-social.com.

Note on naming: The App is published as "Side". The legal entity, certain internal identifiers, and the questdrop:// link scheme retain the "QuestDrop" name.

1. Who can use Side

Side is not directed to children under 13 (or the minimum digital-consent age in your country, which is 16 in some EU member states). You must meet this minimum age to create an account. If we learn we have collected personal data from a child below the applicable age without verifiable parental consent, we will delete it. To report such an account, email hello@side-social.com.

2. Information we collect

Information you provide:

  • Account information — name, username, and either your email address (via email, Google Sign-In, or Apple Sign-In) or your phone number (via phone sign-in, verified by a one-time SMS code).
  • Profile content — profile photo and any biographical details you add.
  • User-generated content — activity photos and videos, captions, posts, comments, replies, emoji reactions, and messages in direct and group chats.
  • Social connections — friends, friend requests, group chats, and quest invitations.

Contacts (optional):

  • If you sign in with a phone number, we store a one-way hash (SHA-256) of that number so friends who have you in their contacts can find you on Side.
  • If you allow Contacts access, the App hashes the phone numbers in your address book on your device and checks those hashes against our index to suggest people you know who are already on Side. Names and other contact details never leave your device, and the hashes of your contacts' numbers are only looked up — we do not store them.
  • A hashed phone number is still personal data (it can be linked back to the number), so we treat it as such. We use contact data only to suggest friends — never for marketing, and we never contact people in your address book.
  • Accounts created with Apple or Google Sign-In have no phone number and are not in the index.

Information collected automatically:

  • Location data — with your permission, we use your device location to show map quests near you, to attach a location to quests you create, and to place check-ins (a photo or memory pinned to where it was taken) on the map. A check-in's location is stored with it and is shown to the people you share it with. Location access can be revoked in iOS Settings at any time; the App still works without it.
  • Device & push data — a Firebase Cloud Messaging (FCM) push token and device identifiers, used to deliver notifications.
  • Usage & product-interaction data — in-app events (screens viewed, features used) via PostHog analytics (hosted in the EU) and Google Analytics for Firebase, used to understand and improve the App. We do not use this data for cross-app tracking or advertising, and you can turn analytics off at any time in Settings → Privacy → Share Usage Analytics (this disables both PostHog and Google Analytics).
  • Crash & diagnostic data — if the App crashes, a crash report (device model, OS version, and the App's state at the time of the crash) is collected via Firebase Crashlytics so we can find and fix bugs.

Information that stays on your device: the home-screen widget (your streak and the daily activity) and personalised reminder notifications are prepared on your device and are not sent to us.

Permissions we request: camera, microphone, photo library, location, contacts, and notifications. Each is requested in context and is optional — declining limits the related feature only.

3. How we use your information

Website analytics: we use EU-hosted PostHog to measure page visits, referral sources and successful waitlist signups. Signup events include platform and country, never email addresses. This analytics is cookieless, has no identified visitor profiles, automatic click tracking or session recordings, and respects browser Do Not Track settings. We use these aggregate measurements to understand which channels bring visitors to Side. Existing waitlist signups are not backfilled.

  • To provide and operate the App (authentication, feed, activities, check-ins, social features, chat).
  • To suggest friends from your contacts, if you allow it.
  • To deliver notifications you've enabled.
  • To show map quests near you.
  • To maintain safety — reviewing reported content and enforcing our Terms and Community Guidelines.
  • To analyse and improve the App.
  • To comply with legal obligations.

Legal bases (GDPR): performance of our contract with you (core app functionality); your consent (location, contacts, camera, microphone, photos, push notifications); and our legitimate interests (security, abuse prevention, crash reporting, product improvement).

4. How we share information

We do not sell your personal data. We share it only with:

  • Other users — content you post (profile, posts, check-ins and their locations, comments, reactions, messages) is visible to the users you share it with. Messages in a group chat are visible to everyone in that group.
  • Other apps, when you choose — if you share a post or card to another app (e.g. Instagram or Messages), that app receives what you share and its own privacy policy applies.
  • Service providers (processors) acting on our behalf:
    • Google Firebase — our database (Firestore), file storage, and server functions are hosted in the EU. Firebase Authentication (including sending SMS verification codes for phone sign-in), Cloud Messaging (push notifications), Crashlytics crash reporting, and Google Analytics for Firebase are global Google services that may process data in the United States.
    • Google Sign-In and Apple Sign-In — authentication.
    • PostHog (product analytics) — hosted in the EU.
  • Legal / safety — where required by law or to protect users' rights and safety.

Where data is transferred outside the EU/EEA (e.g. Firebase Authentication or Crashlytics processing in the US), we rely on appropriate safeguards such as the EU Standard Contractual Clauses.

5. Data retention

We keep your personal data for as long as your account is active. When you delete your account (see Section 7), we delete your profile, your phone-number hash, posts, check-ins, map quests you created, comments, replies, reactions, direct conversations, your messages in group chats, quest invitations, friend connections, uploaded images and videos (profile pictures, activity evidence, and group photos), and your analytics profile and its associated events in PostHog. Group chats you were in continue for their remaining members, without you and without your messages. Crash reports in Firebase Crashlytics are retained for 90 days and then deleted automatically. Moderation records (e.g. reports filed by or about you) may be retained for a limited period for safety and legal purposes, and backups are purged on a rolling cycle.

6. Your rights

Subject to applicable law (GDPR and others), you may:

  • access the personal data we hold about you;
  • correct inaccurate data (much of which you can edit in-app);
  • delete your account and associated data;
  • object to or restrict certain processing;
  • request portability of data you provided;
  • withdraw consent (e.g. revoke camera/location/notification permissions in iOS Settings).

To exercise these rights, use the in-app controls or email hello@side-social.com. You also have the right to lodge a complaint with your local supervisory authority; in Sweden this is the Integritetsskyddsmyndigheten (IMY).

7. Deleting your account

You can permanently delete your account from Settings → Delete Account in the App. This runs a server-side process that removes your data as described in Section 5. Deletion is irreversible.

8. Security

We use Firebase Authentication and access-controlled Firestore/Storage rules to protect your data. No method of transmission or storage is 100% secure, but we work to protect your information using industry-standard measures.

9. Changes to this policy

We may update this Policy. When we make material changes, we'll update the "Last updated" date and, where appropriate, ask you to re-accept within the App.

10. Contact

QuestDrop AB Email: hello@side-social.com