Privacy notice · last updated 13 August 2026

Privacy

This notice covers newquest.app, the dashboard at newquest.app/dashboard and the MCP server at mcp.newquest.app. It is written plainly on purpose. Where something is not decided yet, it says so instead of guessing.

Who we are

New Quest is a product of Quezzies LTD. The person answerable for this data is reachable athello@newquest.app and answers in person.

What we store

• Your world. Books, characters, stat blocks, locations, maps, items, factions, scenes, and the event log that records how each of them changed. This is the product. It exists because you typed it or because the AI you connected wrote it on your instruction.
• Your account. Email address, name and avatar if you set one, and which sign-in method you used. This comes from Clerk, our authentication provider.
• Your connections. Which MCP clients you have authorised, so you can see them and revoke them.
• Your payments. Whether you have an active subscription, which plan, and the Stripe identifier for it. Card numbers go to Stripe and never touch our servers.
• Operational logs. Requests hitting our Workers, with IP address and user agent, kept short term so we can debug faults and block abuse.

Uploaded files, currently map images, are stored as you uploaded them. Nothing else is collected. There is no advertising pixel and no cross-site tracker on any page of this site.

Signing in with Google

If you choose Google sign-in, Google tells us your name, email address, profile picture and Google account identifier. That is the whole of it. We do not request access to Gmail, Drive, Calendar, Contacts or any other Google service, and we could not read them if we tried. Google account information is used to create your account, sign you in and email you about your account. It is never sold, never shared with advertisers, and never used to train any model. Revoke our access at any time in your Google account settings; that signs you out and leaves your world data untouched until you delete it.

Your prose, and the model you connect

New Quest does not call an AI model. Not for you, not for us. The intelligence in the product is whichever model you connect through MCP, running on your own account with that provider, under that provider's terms and privacy policy.

When your model asks New Quest for a character or a scene, we answer with your data. What that model then does with the answer is between you and the provider you chose. If you paste a draft scene into a tool that extracts state changes, the extraction happens in your model, not here. This is the single most important thing to understand about the product, so it is worth being blunt about: we are storage, search and rules, and the reason the running cost is nearly nothing is that we never send your book to anyone.

What never happens

• We do not train models on your work. Not our models, not anyone else's. There is no exception for anonymised, aggregated or sampled use.
• We do not sell your data or share it with data brokers.
• We do not read your world data except when you ask us to help with a fault, and then only what is needed to fix it.
• We do not publish anything you have not published yourself.

The things you choose to make public

Two features are public by design and both are opt in. A character card published at newquest.app/s/ shows that character's name, role, status, description, voice, goals, fears, capabilities, possessions and stat block to anyone with the link. Secrets, knowledge and relationships are deliberately withheld from that page, because that is where spoilers live. A published tier list at newquest.app/t/ shows its books and its title.

Unpublishing takes the page down immediately. It cannot recall a screenshot somebody already took, so publish accordingly.

Where your data lives

Everything runs on Cloudflare: Workers for the application, D1 for the database, R2 for uploaded files, Durable Objects for live state. Our storage is configured to the European Union jurisdiction, so the primary copies sit on EU infrastructure. Cloudflare operates a global network, so requests are served from the point of presence nearest you and logs may be processed elsewhere for the seconds that takes.

Two other companies hold a slice: Clerk handles authentication and stores your sign-in details, and Stripe handles payment and stores your billing details. Both are processors acting on our instructions.

How long we keep it

World data stays until you delete it. Deleted entities are soft deleted first so an accident is recoverable, then cleared. Delete your account and everything goes with it, including backups on their normal rotation, within 30 days. Operational logs roll off inside 30 days. Payment records are kept as long as tax law requires, which is the one thing we cannot delete on request.

Export and delete, whenever you like

Every book exports as clean Markdown or JSON in one click, from the dashboard, at any time, on any plan. That is a deliberate design commitment rather than a feature we might reprioritise: a story bible you cannot take with you is a hostage. Deletion is in the same place and it means deletion.

Your rights

You can ask for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, and object to processing. The export and delete buttons already answer the first and third without asking anyone. For the rest, email hello@newquest.app and a human replies. If we get it wrong you can complain to your local data protection authority.

Cookies

A session cookie from Clerk, so you stay signed in. That is the whole list. No advertising cookies, no cross-site tracking, no consent banner to click through, because there is nothing to consent to.

Children

New Quest is not built for children and is not intended for anyone under 16.

Changes

When this notice changes, the date at the top changes with it. If a change actually affects you rather than tidying wording, we email you before it takes effect.

Asking us things

hello@newquest.app. A person reads it.