Privacy Policy

1. Information We Collect

SISO Quest is operated by Brand Alive Communication Limited (BAC) ("BAC", "we", "us", "our"), which is the data controller responsible for the personal information described in this policy. When you register and use SISO Quest, we collect:

• Account data — full name, username, email address, phone number, date of birth, state, and country, and — for School Mode — the school you belong to
• Game data — game sessions, scores, levels, and answers submitted
• Wallet data — transaction history, coin balances, and top-up records
• Technical data — IP address (for rate-limiting and fraud prevention), browser type, and access times
• Communications — messages sent through the platform, feedback, and support requests

2. How We Use Your Information

We use your information to:

• Provide and improve the SISO Quest game experience
• Process transactions and maintain wallet balances
• Display leaderboards and calculate rankings
• Send notifications about game events and account activity
• Detect and prevent fraud, cheating, and abuse
• Respond to your support requests and feedback

3. Authentication & Cookies

We use a secure, HttpOnly cookie named siso_token to keep you signed in. This cookie is never accessible to JavaScript, protecting your session from cross-site scripting attacks. If you tick "Remember me" when signing in (the default) it lasts 30 days; if you don't, it ends when you close your browser. Either way it ends when you sign out. We do not use third-party advertising cookies.

4. Data Sharing

We do not sell your personal data to third parties. Your username, state, and game scores may appear publicly on leaderboards. If you opt in when submitting feedback, your comment may be shown publicly without any other identifying information. We may share data with authorities if required by law.

5. Google Sign-In

If you use Google Sign-In, we receive your Google user ID, email address, display name, and profile picture from Google. We do not receive or store your Google password. Your use of Google Sign-In is also subject to Google's Privacy Policy.

6. Data Security

We protect your data using industry-standard measures including bcrypt password hashing (cost 12), CSRF token validation on all state-changing requests, HttpOnly and Secure cookie flags, and prepared SQL statements to prevent injection attacks. No system is perfectly secure, and we encourage you to use a strong, unique password.

7. Data Retention

We retain your account data for as long as your account is active. If you delete your account, your personal information is removed from our database immediately. Game session records and anonymised analytics may be retained for longer periods for service improvement.

8. Your Rights

You have the right to access, correct, or delete your personal data at any time. You can update your profile information in the Profile section of your dashboard, or permanently delete your account from the Danger Zone in profile settings.

9. Children's Privacy

SISO Quest accepts players of all ages, including school students who join through School Mode. If you are under 18, a parent or legal guardian must agree to you using SISO Quest and to us processing the information described in this policy. We collect only what the service needs, the same as for adult players. A parent or guardian can ask us to see, correct or delete a child's information, or to close the account, by emailing talktosiso@sisoquest.com. Paid features — buying coins, wallet top-ups and withdrawals, and matches with an entry fee — are for players 18 and over only.

10. Contact Us

If you have any questions or concerns about this Privacy Policy, email talktosiso@sisoquest.com, or if you have an account, reach out via the Help & Contact page.