Privacy Policy
SideQuest asks two people to walk somewhere they have not been and write down what they found. That only works if you know exactly what stays on your phone, what reaches us, and what a partner can see. This page says what we collect, where it lives, who else sees it, and for how long.
1. Who we are, and how to reach us
SideQuest is an iPhone app made by BLACK LAYERS CORP. (blacklayers.ca), an Alberta corporation. It gives two people a short, curated outing in Calgary, revealed one stop at a time. Our designated Privacy Officer is Abdul Hafeez. For any question, request or complaint about your personal information, write to info@blacklayers.ca with "SideQuest privacy" in the subject line, or call +1 (587) 429-6200. We answer within 30 days. BLACK LAYERS CORP. · 5 Mitchell Rd NW, Calgary, AB T3R 2G3, Canada
2. The short version
• You can use SideQuest without an account. In guest mode nothing you write leaves your phone. • If you sign in with Apple, your memories sync to our database in Montréal so you can keep them across devices. • We never track your location. You type in your start area. If you allow location, it only draws your own dot on the map while the app is open, and the position is never stored or sent. • A partner who joins your adventure sees the adventure name, the current stop, the clues and your display name. Never your memories, photos, purchases or email. • Purchases go through Apple. We never see your card. • No ads, no tracking, no analytics SDK, no crash reporting in this version. • You can delete your account and everything with it from inside the app.
3. What we collect, and why
Apple sign-in identifier and relay email (only if you sign in) • When you choose Sign in with Apple, Apple gives us a stable identifier for your account and, if you allow it, your email address. If you choose "Hide My Email", we receive an Apple relay address instead of your real one. We use these to sign you in and to find your data. We do not send marketing email. • Guest mode does not create any of this. The app works fully without an account. Session and progress • Which adventure you started, which stop you are on, when you started, and whether you finished. This is what lets the app resume where you left off and lets a partner follow along. In guest mode it stays on your phone; when signed in it is stored in our database. Memories and photos • A memory is a short note you write at a stop, with an optional photo. In guest mode memories stay on your phone. When signed in, the note is stored in our database and the photo in Firebase Storage, in a folder only your account can read. Memories are private. They are never shared with a partner and never shown to anyone at Black Layers. Purchase entitlement mirror • When you buy an adventure or the Calgary City Pass, Apple tells us the original transaction identifier and the product identifier. We keep those two values so the app can unlock what you paid for, restore it on another device, and refuse access if Apple later revokes the purchase. We never receive your card number, billing address or Apple ID password. Partner link • When you invite a partner, we create an eight-character invite code tied to your session. It is single-use and expires after 24 hours. The partner who redeems it is linked to your session by their own identifier (or a temporary guest identifier). The partner sees the adventure name, the current stop, the clues and your display name. On-device preferences • Your chosen duration, budget, mood, start area, walking and access preferences, and app settings are stored on your phone. They are not sent to us. What we do NOT collect • Your precise or background location. Ever. • Your contacts, calendar, photos library (beyond the single photo you choose to attach to a memory), browsing history or other apps. • An advertising identifier. We do not use one. • Analytics events, usage statistics or crash reports. There is no analytics or crash-reporting SDK in this version. • Your payment card or banking details. Apple handles payment.
4. Location
You enter your start area by hand. SideQuest does not need your location to work. If you choose to allow location access, the app uses it only while it is open and in the foreground, only to show your own dot on the map so you can orient yourself. The position is read on your phone and drawn on your screen. It is not stored, not sent to our servers and not shown to a partner. We never request "Always" location permission and we never track you in the background. You can revoke location access at any time in iOS Settings › Privacy & Security › Location Services. The app keeps working.
5. Where your information lives
Guest mode: on your phone. Nothing is uploaded. Signed in: our database (Cloud Firestore) and photo storage (Firebase Storage) are hosted by Google Cloud in Montréal, Québec (region northamerica-northeast1). Firebase security rules and Firebase App Check restrict every document and photo to the account that owns it; the only exception is the small set of session fields a partner is allowed to read (section 7). One thing cannot be kept in Canada, and we say so rather than pretend: Sign in with Apple and Firebase Authentication (a Google service) process your sign-in identifier and relay email in the United States. Information processed outside Canada is subject to the laws of that country, including lawful access by its authorities.
6. Purchases
Your first adventure is free. Further single adventures (CA$6.99) and the Calgary City Pass (CA$24.99) are non-consumable Apple In-App Purchases. Prices are set in the App Store and may differ in your country. Apple processes the payment under its own privacy policy. We receive the original transaction identifier and the product identifier, which we store as described in section 3 to unlock content and enforce access. Refunds are handled by Apple at reportaproblem.apple.com; we cannot issue them.
7. Sharing with a partner
Only you can start the sharing. You create an invite code in the app and give it to your partner by whatever means you choose. The code is eight characters, works once, and expires after 24 hours. While linked, your partner's phone can read from your session: the adventure name, the current stop number, the clues for that stop and your display name. Your partner cannot see your memories, your photos, your purchases, your email or your location. You can end the link at any time from the app, and it ends on its own when the session expires. The partner may leave the adventure at any time. Nothing about a partner is stored beyond the link to the session.
8. Who else sees your information
Our service providers, each of which processes only what its function needs: • Apple — Sign in with Apple, In-App Purchase, and delivery of the app. • Google Firebase (Google Cloud) — authentication, database, photo storage and App Check, in Montréal except for authentication as noted in section 5. Nobody else. We do not sell personal information, we do not share it with advertisers, and there are no advertising or analytics partners. We disclose information to authorities only under a valid Canadian production order or warrant, or where there is an imminent risk to someone's life or safety.
9. How long we keep it
• Adventure sessions and invite codes: expire after 24 hours and are deleted within 30 days. • Memories and photos: until you delete them, or delete your account. • Purchase entitlement records (original transaction identifier and product identifier): for the life of your account, plus any period Apple requires us to keep them to honour restores or revocations. • Sign-in record: until you delete your account. • On-device preferences: until you change them or remove the app.
10. Deleting your account
Open Settings › Account › Delete in the app. Deletion does not require an email to us. Within 30 days we remove your Firestore documents (sessions, memories, entitlement mirror), your photos in Firebase Storage, and your sign-in record. Any active invite code stops working immediately. If you delete the app without deleting your account, your synced data remains until you sign in again and delete it, or write to us and ask. Deleting your account does not cancel or refund an App Store purchase; Apple keeps its own record, and you can restore a purchase on a new account by signing in with the same Apple ID and choosing Restore Purchases.
11. Your rights
Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta's Personal Information Protection Act (PIPA) you may: • Ask what personal information we hold about you and receive a copy. • Ask us to correct it. • Withdraw consent, and delete your account. • Complain to us, and to the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner of Alberta. Write to info@blacklayers.ca. We respond within 30 days.
12. Age
SideQuest is recommended for adults, 18 and older. It is not directed at children and we do not knowingly collect personal information from anyone under 13. If we learn that an account belongs to a child, we delete it. If you believe a child is using SideQuest with an account, tell us at the address above.
13. Security
Data travels between the app and Google Cloud over encrypted connections and is encrypted at rest. Firebase security rules deny access by default and allow each account to read and write only its own documents and photos. Firebase App Check ensures that only genuine copies of the app can talk to our database. Purchase unlocks are verified against Apple's signed transaction, never trusted from a client-side flag alone. We keep no copies of your data on laptops or in spreadsheets. No system is perfect; if we ever learn of a breach that affects you, we will tell you and the Privacy Commissioner as the law requires.
14. Analytics and crash reports
There are none in this version. SideQuest 1.0 contains no analytics SDK, no crash-reporting SDK and no advertising SDK. We do not collect usage statistics. If a future version adds crash reporting, this policy will be updated first and the change announced in the app.
15. Language
This policy is currently available in English. A French version is being prepared and will be offered on terms no less favourable. Until then, a French-speaking user may request assistance in French at the address above.
16. Changes
When this policy changes we update the version and effective date at the top and announce the change inside the app. If a change affects what we collect or who we share it with, the app will ask you to accept the new version before you continue.
17. Contact
Privacy Officer: Abdul Hafeez Email: info@blacklayers.ca Phone: +1 (587) 429-6200 Website: blacklayers.ca BLACK LAYERS CORP. 5 Mitchell Rd NW, Calgary, AB T3R 2G3, Canada
© 2026 BLACK LAYERS CORP.