Privacy Policy

1. Data Controller

Warpen Kft. (Warpen Korlátolt Felelősségű Társaság — French name: Warpen SARL)
A Hungarian limited liability company (korlátolt felelősségű társaság), with a share capital of HUF 3,000,000
Registered office: 1054 Budapest, Honvéd utca 8, 1st floor, door 2, Hungary
Registered with the Court of Registration of the Budapest-Capital Regional Court (Fővárosi Törvényszék Cégbírósága) under company number Cg. 01-09-455928
Hungarian tax number (adószám): 33040967-2-41 — EU VAT number: HU33040967 — EUID: HUOCCSZ.01-09-455928
Email: [email protected]
Represented by Alexandre Vuillerot, managing director.

2. Personal Data Collected

2.1. Account Data

• Email address (required*) — Account creation, communication
• Password (hashed, required*) — Authentication
• Display name (optional) — Personalization, leaderboards
• Avatar / profile picture (optional) — Profile customization
• Social identifier (Google, Apple) — Third-party login

* Email and password are required for standard accounts. For Google or Apple login, the social identifier replaces the password. Anonymous mode is available with limited features.

2.2. Usage and Progress Data

• Lessons completed, modules and learning paths
• Quiz answers and scores
• Experience points (XP), daily streaks
• League and leaderboard participation
• Daily activity and login history
• Energy, Coins and Tokens (balances and transactions)
• Financial preferences and objectives

2.3. Technical Data

• Unique device identifier (Device ID)
• Device model, operating system and version
• Application version
• IP address (retained for 30 days maximum)
• Language and timezone
• Platform (iOS / Android)

3. Purposes and Legal Bases

In accordance with Article 6 of the GDPR, each processing operation relies on a legal basis:

• Contract performance (Art. 6.1.b): account creation and management, service delivery, lesson and quiz personalization, subscription and purchase management, gamification
• Consent (Art. 6.1.a): push notifications
• Legitimate interest (Art. 6.1.f): statistical analysis and service improvement, fraud detection and security
• Legal obligation (Art. 6.1.c): compliance with legal and tax obligations

4. Recipients and Processors

Your data may be shared with the following processors:

• Hetzner Online GmbH (Germany, EU) — Application, API and database hosting
• Cloudflare, Inc. (USA, SCCs) — Website hosting and delivery
• Resend, Inc. (USA, SCCs) — Transactional email delivery
• PostHog (European Union instance) — Usage analytics
• Sentry / Functional Software, Inc. (USA, SCCs) — Error monitoring
• RevenueCat, Inc. (USA, SCCs) — Subscription management
• Expo (650 Industries, Inc.) (USA, SCCs) — Push notifications relay (APNs/FCM)
• Apple Inc. / Google LLC (USA, SCCs) — Distribution and payments

We never sell your personal data to third parties.

4.1. Transfers Outside the EU

Some processors are located outside the EU (USA). These transfers are governed by Standard Contractual Clauses (SCCs) adopted by the European Commission, in accordance with Article 46.2.c of the GDPR.

5. Data Retention

• Account data: account lifetime + 3 years after deletion
• Progress data: account lifetime, deleted upon closure
• Technical data (logs, IP): 30 days
• Billing data: 10 years (legal accounting obligation)
• Push notification data: until consent withdrawal

Upon expiration of retention periods, data is deleted or irreversibly anonymized.

6. Your Rights

Under Articles 15 to 22 of the GDPR, you have the following rights:

• Access (Art. 15) — Confirm whether your data is processed and receive a copy
• Rectification (Art. 16) — Correct inaccurate or incomplete data
• Erasure (Art. 17) — Request deletion of your data ("right to be forgotten")
• Restriction (Art. 18) — Request restriction of processing
• Portability (Art. 20) — Receive your data in a structured, machine-readable format
• Objection (Art. 21) — Object to processing based on legitimate interest
• Withdrawal of consent (Art. 7.3) — Withdraw your consent at any time
• Automated decisions (Art. 22) — Not be subject to solely automated decisions

6.1. How to Exercise Your Rights

Write to [email protected] or by post to the registered office. We will respond within a maximum of 30 days (Art. 12.3 GDPR).

6.2. Account Deletion

You can delete your account from the Application settings. Deletion results in the erasure of your personal data, subject to legal retention obligations.

6.3. Complaint to the Supervisory Authority

If you believe your data processing does not comply, you may lodge a complaint with the lead supervisory authority, the NAIH (Nemzeti Adatvédelmi és Információszabadság Hatóság, Falk Miksa utca 9-11, 1055 Budapest, Hungary — naih.hu), or with the authority of your country of residence (in France: the CNIL, www.cnil.fr).

7. Data Security

We implement appropriate technical and organizational measures in accordance with Article 32 of the GDPR:

• Encryption in transit: TLS protocol (HTTPS)
• Encryption at rest: sensitive data encrypted on servers
• Passwords: hashed with bcrypt (never stored in plain text)
• Restricted access: principle of least privilege
• Secure hosting: Hetzner Online GmbH (Germany, EU) for the application and data; Cloudflare for the website
• Monitoring: continuous monitoring via Sentry

8. Cookies and Trackers

8.1. On the Website

The finquest-app.com website uses no advertising cookies or analytics trackers and sets no third-party cookies. No audience-measurement solution (Google Analytics, PostHog, etc.) is integrated, so no consent is required. The only information stored locally by your browser is your theme preference (light/dark), via local storage (localStorage): a strictly functional item that is never sent to our servers.

8.2. In the Mobile Application

The application uses third-party SDKs (PostHog, Sentry, Expo) that may collect technical data. In accordance with CNIL recommendations (September 2024), we obtain your consent for non-essential trackers and only request strictly necessary permissions.

9. Leaderboards and Social Data

By participating in leagues and leaderboards, the following information may be visible to other users: display name (or pseudonym), avatar, experience points and ranking. No other personal data is shared.

10. Minors

The Application is intended for individuals aged 18 and over. We do not knowingly collect data from minors. If we discover that a minor has created an account, we will promptly delete it.

11. Policy Updates

We reserve the right to update this policy at any time. In case of substantial changes, you will be notified by in-app notification and email. The last update date is shown at the top of this page.

12. Contact

For any questions regarding your data protection:
Email: [email protected]
Post: Warpen Kft. — 1054 Budapest, Honvéd utca 8, Hungary