Privacy Policy

Last updated: 13 September 2026

1. Who we are

NordQuest is an outdoor activity tracking application operated by:

Simon Iversen Software
Enkeltpersonforetak (sole proprietorship)
Org. nr: 936 985 793
Norway

Simon Iversen Software is the data controller responsible for the processing of personal data in NordQuest.

Contact email: simon@nordquest.no
Website: https://nordquest.no

2. Overview

NordQuest is an outdoor exploration service available through a mobile app and web experience. It helps users discover hiking and ski trails, outdoor places, and quests, and lets signed-in users keep private activity history, visits, and progress.

You can browse the map and public quests without an account. Signing in is required for private activity data, saved progress, and account features. Activity routes and personal progress are private to the account holder.

3. Data We Collect

We collect and process data needed to provide the features you use:

• Account and authentication data:
  • Email address
  • Internal user ID
  • Authentication credentials and session tokens handled through Supabase Authentication
  • Authentication method and identifiers or basic profile details returned by an authentication provider, such as Google or Apple, when you choose that sign-in method
  • Account preferences and onboarding choices
• Activity data from a connected service such as Strava or Garmin Connect:
  • Activity type (e.g. hiking, skiing)
  • Distance, duration, and timestamps
  • GPS track and location data
  • Activity IDs and technical sync fields
  • Trail and place matches and progress calculated from the activity
• Location, visit, and progress data:
  • Device location used when you choose a location-based or manual check-in feature
  • Recorded visits, timestamps, trail or place progress, and possible-arrival suggestions and confirmation or dismissal decisions
• Quest data:
  • Quest titles, descriptions, selected places or completion criteria, and images
  • Quest ownership, membership, save or join status, progress, and share-link tokens
• Technical data:
  • App version, device or browser type, timestamps, error details, and performance data
• Product analytics data:
  • App launches and screen views, onboarding choices, provider connection and sync outcomes, map filter changes, manual check-ins, and quest actions
  • Random analytics identifiers stored on the device or browser, the internal account ID when signed in, and technical app and device information
  • Approximate location inferred from the network IP address for product analytics

The mobile app uses the device's current location to evaluate nearby places when you actively use a location feature. NordQuest does not use that feature to create a continuous live-location history. GPS tracks imported from an activity provider are stored as part of the activity data described above.

4. How We Use Your Data

We use this data to:

• Create and authenticate your account, maintain your session, and provide account settings
• Sync activities from a connected third-party service
• Match your activities to known hiking and ski trails and registered points of interest (such as hiking huts)
• Record visits and calculate and display your personal progress and history
• Let you create, save, join, display, and share quests
• Show public maps, places, trails, and quests to guests and signed-in users
• Keep the service reliable, secure, and technically functional
• Understand which features people use, where onboarding or syncing fails, and how to improve the product

Your activity history, routes, matching results, and personal completion statistics are for your own signed-in use. Quest content is handled as described in Section 7.

5. Data Sharing and Disclosure

We do not:

• Sell personal data
• Share data with advertisers
• Use activity data for targeted advertising, marketing, or profiling
• Share individual activity data with other users

Data is disclosed only as needed for the service:

• To infrastructure, hosting, storage, mapping, content-delivery, error-reporting, and analytics providers that support NordQuest
• To Google or Apple when you choose their authentication service
• To Strava or Garmin Connect when you choose to connect or manage that provider integration
• To people who open a quest share link, and to visitors who browse a public quest, as described in Section 7

6. Artificial Intelligence & Automated Systems

NordQuest does not use artificial intelligence, machine learning models, or AI-powered systems to process user activity data. User data is not used for AI or machine learning training.

7. Visibility, Quests, and Sharing

In the current version of NordQuest:

• Your imported activities, GPS routes, matching results, visits, and personal progress are visible only to you while signed in
• There are no public activity profiles or leaderboards
• Public quest content can be browsed by anyone, including guests without an account
• A private quest can be shared through a capability-based share link. Anyone who receives the link may be able to see the shared quest preview, including its title, description, places, criteria, and image, and may be able to join the quest
• Quest sharing does not make your underlying activities or GPS routes visible to other users

8. Web Experience and Browser Storage

The web experience lets guests browse maps, trails, places, and public quests. Signed-in users can create private quests and access supported private features such as their own progress and activity details. Mobile-only actions, including managing activity-provider connections, are handed off to the mobile app.

NordQuest uses browser-local storage and similar device storage to keep an authentication session, complete the secure sign-in flow, remember preferences, and temporarily remember actions such as an intended sign-in destination or pending quest join. The browser may also cache site files and map resources. You can remove this data through your browser settings.

The app's web experience also stores a random analytics identifier and, after sign-in, the internal account ID in browser-local storage. This lets PostHog connect usage across visits and link earlier guest usage to the signed-in account. Signing out resets the analytics identity for subsequent events; it does not delete events already received. Clearing browser storage removes the locally stored identifiers, but new identifiers can be created on a later visit.

NordQuest uses PostHog for app product analytics and Plausible for marketing-website analytics, as described in Section 11. NordQuest does not use advertising cookies.

9. Third-Party Activity Services

Supported third-party activity services are only accessed when you choose to connect them.

Garmin Connect™

When you connect Garmin in the mobile app, NordQuest retrieves activity data needed to calculate your private progress and trail matching. Garmin-derived activity data is available only to the signed-in account holder in the mobile app and to service providers that process it for NordQuest. It is not disclosed to other users, advertisers, or external AI or machine learning services.

Garmin-derived activity data is not displayed on the web in the current release. After you sign in, NordQuest checks the connected activity provider before loading signed-in web content. If your account is linked to Garmin, the web app stops at a blocking screen before account activities, progress, map data, or Garmin attribution is loaded. The screen directs you to the mobile app or lets you sign out. Signed-out guest browsing remains available.

See Garmin's privacy policy for Garmin Connect™ for information about Garmin's own processing.

Strava

When you connect Strava, NordQuest retrieves activity data needed to calculate your private progress and trail matching. Strava-derived activity data is displayed only to the signed-in account holder in supported mobile and web views and is processed by service providers that operate NordQuest.

While your Strava connection remains active, NordQuest keeps the Strava-derived data needed to provide your activity history, route maps, matching results, visits, and progress.

Strava may collect usage information related to NordQuest's use of the Strava API and platform. See Strava's privacy policy and Strava's API Agreement.

After you request deletion of your Strava-derived data or NordQuest account, or disconnect or revoke NordQuest's access to Strava, NordQuest permanently deletes the associated Strava-derived data from systems under its control as soon as practical and no later than 30 days. This does not delete the original activities or your account at Strava.

For other providers, when a disconnect operation succeeds, NordQuest stops future imports through that connection and removes the provider-derived activities, matching results, and associated progress from the active NordQuest account. This does not delete the original data or your account at that provider. You may also need to manage the NordQuest connection in the provider's own settings.

10. Data Retention, Provider Disconnection, and Account Deletion

We keep account, activity, visit, progress, and quest data while it is needed to provide the features you use. Provider-derived data is also subject to the relevant provider's terms. We do not state a single fixed retention period because the period depends on the data and why it is held.

You can delete your NordQuest account from account settings in the mobile app or web experience, or request deletion by emailing simon@nordquest.no. Deleting an account starts NordQuest's deletion process for the account and data linked to it in active systems. Some records or stored files may require additional processing, and limited copies may persist temporarily in backups or security logs according to the relevant service provider's practices. We do not promise immediate deletion of every copy. Except for the Strava-specific 30-day deadline described in Section 9, we do not state an exact backup-retention period. You can email us if you want us to check a deletion request for a particular type of data.

Deleting NordQuest does not delete your Strava or Garmin account or the original activities held by those providers. You can also remove NordQuest from the provider's own connection settings. Browser-local storage and cached files may remain on a device until you sign out, clear site data, or the browser removes them.

Analytics events are stored separately from the account database. Signing out, clearing local storage, or uninstalling the app does not delete analytics events already received by a service provider. Contact simon@nordquest.no to request access to or deletion of analytics data linked to your account.

11. Service Providers, Storage, and Technical Reporting

We use third-party services to operate NordQuest. These services receive the information needed for their role:

Strava

Used only when you choose to connect your Strava account. Activity data is retrieved through the Strava API.

Garmin Connect™

Used only when you choose to connect your Garmin account in the mobile app. Activity data is retrieved through Garmin's developer services.

Supabase

Used for authentication, database, backend functions, and file storage, including user accounts, activities, GPS tracks, visits, progress, quest data, and quest images.

Railway

Used to run backend worker services that process activities, trails, and matching algorithms as part of the NordQuest service.

Sentry

In the mobile app and web experience, Sentry is used for error reporting and sampled performance monitoring. It may receive technical information such as device type, app version, timestamps, error details, and performance traces. We do not intentionally send full activity details or GPS tracks to Sentry.

PostHog

PostHog processes product analytics from the mobile app and app web experience. Events describe feature use, such as opening screens, completing onboarding, connecting a provider, syncing, changing map filters, checking in, and creating, starting, sharing, or viewing the outcome of a quest. Event details use predefined categories, outcomes, and limited counts rather than the content of an activity or quest. The mobile SDK also collects app lifecycle events and technical information such as app version, operating system, device model, screen dimensions, timestamps, and session and device identifiers. On iOS, it can also record rapid repeated taps with their screen position and available screen or interface-element information.

A random identifier distinguishes guest usage. When you sign in, NordQuest sends your internal account ID to PostHog and links guest usage to that account. This analytics data is therefore account-linked, rather than anonymous after sign-in. NordQuest's custom analytics events do not include your email address, name, GPS coordinates or routes, activity details, quest or place identifiers, titles, descriptions, images, search text, or share-link tokens. Session replay and surveys are disabled.

PostHog receives the source IP address when analytics events are sent. Our project has GeoIP enrichment enabled to add approximate location, such as country, region, or city, to analytics events. This location information is linked to your account when you sign in. The project is configured to discard IP addresses. The app sends analytics to PostHog's EU ingestion service. See PostHog's privacy policy for information about the provider.

Plausible

The marketing website uses Plausible to measure page visits, clicks on app-store links, and scroll depth. NordQuest's website events include the destination platform and button position or a scroll-depth percentage; they do not include a NordQuest account ID. Plausible describes its service as cookieless and processes ordinary request information to produce website statistics. See Plausible's data policy.

Web hosting, maps, and content delivery

Netlify serves the NordQuest website and authentication utility pages. Kartverket and Thunderforest supply map tiles, and web resources may be delivered by services such as unpkg and Google Fonts. When a browser requests these resources, the relevant provider receives ordinary request data such as IP address, browser or device information, timestamp, and requested URL. These requests deliver the website and map resources.

Service-provider locations and retention practices vary and may involve processing outside Norway or the EU/EEA. Contact us if you need more information about a particular processing activity.

12. Data Security

We use standard security practices to protect personal data from unauthorized access, loss, or misuse.

13. Your Choices and Rights

You have the right to:

• Access your personal data
• Request deletion of your data
• Disconnect third-party integrations such as Strava or Garmin Connect
• Contact us with privacy-related questions

To request deletion, use the delete account feature in the mobile app or web experience, or email simon@nordquest.no. Depending on where you live, you may have additional rights concerning your personal data.

14. Changes to This Policy

If we change how NordQuest uses personal data or introduce new data features, we will update this Privacy Policy and notify users where appropriate.

15. Contact Information

If you have questions about this Privacy Policy or how your data is handled, you may contact:

Email: simon@nordquest.no
Website: https://nordquest.no

NordQuest is operated by Simon Iversen Software (ENK)
Org. nr 936 985 793
Norway
Contact: simon@nordquest.no