Privacy notice · last updated 27 September 2026

Privacy

This notice covers newquest.app, the dashboard at newquest.app/dashboard, Pocket (on the web at newquest.app/pocket now, and in the phone apps when they are released) and the MCP server at mcp.newquest.app. It is written plainly on purpose. Where something is not decided yet, it says so instead of guessing.

Who we are

New Quest is a product of Quezzies LTD, registered in England and Wales, company number 16590159. Registered office: 11 Mercer Avenue, Ebbsfleet Valley, Swanscombe, DA10 1BG. The person answerable for this data is reachable athello@newquest.app and answers in person.

What we store

• Your world. Books, characters, stat blocks, locations, maps, items, factions, scenes, and the event log that records how each of them changed. This is the product. It exists because you put it there. An AI you connect can read it but cannot change it: the connection is read-only.
• Your account. Email address, name and avatar if you set one, and which sign-in method you used. This comes from Clerk, our authentication provider.
• Your connections. Which MCP clients you have authorised, so you can see them and revoke them.
• Your payments. Whether you have an active subscription, which plan, and the Stripe identifier for it. Card numbers go to Stripe and never touch our servers.
• Operational logs. Requests hitting our Workers, with IP address and user agent, kept short term so we can debug faults and block abuse.
• Usage analytics. Which pages are opened and left, with book, character, scene and map ids taken out of the address, and a short list of named product events: creating, writing, importing, publishing and exporting a book, creating and sharing a character, uploading a map, viewing a connected AI client, recording a pronunciation, and reaching a trial or storage limit. These carry counts, yes-or-no flags and formats, never your words or the names you invent. They are not linked to your account: each page load gets a new random identifier that is never stored on your device, and no profile of you is kept. Like any web request, each one reaches PostHog with your IP address and browser details; PostHog discards the IP address, so events are stored without it and without any identity, which also means there is nothing in analytics to erase when you delete your account. There is no autocapture of clicks or typing, no session recording, and nothing at all from private reading links or the page shown after an account is deleted.

Files are stored as you wrote or uploaded them: scene text with its saved versions and alternative drafts, saved-writing snapshots, map images, the Word and text manuscripts you import, library copies you send from your browser, and the copies behind private reading links. Each save also records a random identifier for the device or browser that made it, used only to tell your devices apart in history. Nothing else is collected. There is no advertising pixel and no cross-site tracker on any page of this site.

Signing in with Google

If you choose Google sign-in, Google tells us your name, email address, profile picture and Google account identifier. That is the whole of it. We do not request access to Gmail, Drive, Calendar, Contacts or any other Google service, and we could not read them if we tried. Google account information is used to create your account, sign you in and email you about your account. It is never sold, never shared with advertisers, and never used to train any model. Revoke our access at any time in your Google account settings; that signs you out and leaves your world data untouched until you delete it.

Signing in with Apple

The iPhone app, once released, offers Sign in with Apple. The first time you use it, Apple tells us an identifier for your Apple Account that only New Quest receives, an email address and, if you choose to share it, your name. That is the whole of it. The email address is either your own or, if you choose Hide My Email, a private relay address that Apple forwards to you. We keep the address and name as your account's email and name, and the identifier to recognise you when you sign in again. We use this only to create your account, sign you in and email you about your account, on the same terms as Google sign-in above. You can stop using Sign in with Apple for New Quest in your Apple Account settings; if you used Hide My Email, our emails then stop reaching you, and your world data stays untouched until you delete it.

Your prose, and the model you connect

New Quest's servers do not call an AI model. Not for you, not for us. The intelligence in the product is a model you choose, running on your own account with that provider, under that provider's terms and privacy policy. It reaches your work in one of two ways: a model you connect through MCP, or, in the New Quest desktop app, Codex running on your own computer under your own ChatGPT sign-in. A feature that lets you ask your desktop for help from the browser or your phone is being built and is switched off. When it is on, we hold your request until your desktop collects it, and your desktop then asks your model.

When your model asks New Quest for a character or a scene, we answer with your data. What that model then does with the answer is between you and the provider you chose. If you paste a draft scene into a tool that extracts state changes, the extraction happens in your model, not here. This is the single most important thing to understand about the product, so it is worth being blunt about: we are storage, search and rules, and the reason the running cost is nearly nothing is that our servers never send your book to anyone.

What never happens

• We do not train models on your work. Not our models, not anyone else's. There is no exception for anonymised, aggregated or sampled use.
• We do not sell your data or share it with data brokers.
• We do not read your world data except when you ask us to help with a fault, and then only what is needed to fix it.
• We do not publish anything you have not published yourself.

The things you choose to make public

Two features are public by design and both are opt in. A character card published at newquest.app/s/ shows that character's name, role, status, description, voice, goals, fears, capabilities, possessions and stat block to anyone with the link. Secrets, knowledge and relationships are deliberately withheld from that page, because that is where spoilers live. A published tier list at newquest.app/t/ shows its books and its title.

Unpublishing takes the page down immediately. It cannot recall a screenshot somebody already took, so publish accordingly.

Where your data lives

Everything runs on Cloudflare: Workers for the application, D1 for the database, R2 for uploaded files, Durable Objects for live state. Our storage is configured to the European Union jurisdiction, so the primary copies sit on EU infrastructure. Cloudflare operates a global network, so requests are served from the point of presence nearest you and logs may be processed elsewhere for the seconds that takes.

Four other companies hold a slice. Clerk handles authentication and stores your sign-in details. Stripe handles payment and stores your billing details. PostHog holds the anonymous usage analytics above, in its EU region. Resend sends our emails, so it handles your email address, your first name and, for the weekly chronicle email, your writing statistics such as word counts. All four are processors acting on our instructions.

How long we keep it

World data stays until you delete it. Deleting a book or an entry takes it out of your library straight away; the stored copy is marked deleted rather than erased at once, and it is erased with the rest of your account. When you delete your account, access to your cloud writing stops as soon as the request is accepted, and your books, history, files and account details are erased within 30 days of that. We keep a deletion record indefinitely, as proof that the erasure happened and so that it stays in force. It holds only internal identifiers for your account, books, files and erased records, with a one-way fingerprint of each erased record rather than its text; the dates your account was created and deleted; the request's reference, its dates and the choices you confirmed; and a log of each erasure step. It holds no email address, name, writing or IP address. If you ever started a checkout with us, we also keep the Stripe reference numbers for your customer record, subscriptions, checkouts, invoices and payment events, with the prices and dates they recorded, because UK tax law requires payment records to be kept for six years. We delete them six years after your last billing event, which we count as the day your erasure finished or, if later, the last checkout, subscription or invoice event Stripe sent us about your account after your request. Operational logs roll off inside 30 days. Stripe keeps its own payment records as the law requires of it.

Your data is also in backups of the database. We keep private copies of it for no more than 35 days each, and use them only to restore the service after a fault and to test that such a restore works. Cloudflare, which hosts the database, keeps its own history of changes for up to 30 days. So a deleted account can remain in a backup for up to 35 days after it is erased. If we ever restore from a backup, deleted accounts are erased from the restored copy again before the service reopens.

Export and delete, whenever you like

Every book exports as clean Markdown or JSON in one click, from the dashboard, at any time, on any plan. That is a deliberate design commitment rather than a feature we might reprioritise: a story bible you cannot take with you is a hostage. Account deletion has its own page in the dashboard, and it means deletion. Email us and we will help you use it, or, if it is not open yet, tell you when it opens and confirm when your request is accepted.

Your rights

You can ask for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, and object to processing. The export button answers the first without asking anyone. The delete page in the dashboard answers the third; email us and we will help you use it, or, if it is not open yet, tell you when it opens and confirm when your request is accepted. For any of these, email hello@newquest.app and a human replies. If we get it wrong you can complain to your local data protection authority.

Cookies

Sign-in cookies from Clerk, so you stay signed in, and any security cookies that sign-in needs. When you connect an AI client, a cookie carries that sign-in to the consent screen and expires after two minutes. We set no other cookies. The dashboard also keeps things in your browser that it needs to do what you ask: unsaved writing and recovery copies, so a dropped connection does not cost you words, and display choices such as paper mode. Analytics stores nothing on your device at all, neither a cookie nor anything in browser storage. No advertising cookies, no cross-site tracking, no consent banner to click through, because nothing is stored that you did not ask for.

Pocket keeps more on your device, because it is built to keep working without a connection. In your browser's storage for newquest.app, or in the phone app's own storage, it keeps writing you have not sent yet, the books you download to it, the ideas you capture, your notes and, once asking your desktop is switched on, the questions you send it. Each of these is stored under the account that made it. It also keeps a few display choices, such as which prompts you have dismissed. Signing out does not clear any of it, so writing you have not sent is still there when you sign back in. Clearing this site's data in your browser settings removes it, and so does uninstalling the phone app. Removing Pocket from a home screen may not, depending on the browser. Pocket loads no analytics.

Children

New Quest is not built for children and is not intended for anyone under 16.

Changes

When this notice changes, the date at the top changes with it. If a change actually affects you rather than tidying wording, we email you before it takes effect.

Asking us things

hello@newquest.app. A person reads it.