1.Who we are
DropQuest (“DropQuest”, “we”, “us”) runs the price-tracking service at dropquest.gg, its API at api.dropquest.gg and the related apps. We are the data controller for the personal data described here.
This policy is written to meet the EU/UK General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law No. 6698 (KVKK). For any privacy question or request, write to [email protected].
2.Data we collect
You can browse deals, prices and game pages without an account. In that case we only process the technical data listed under Security and technical data.
Account data. When you sign in with Google or Apple we receive and store your account ID at that provider, your email address and whether it is verified, and, where the provider shares them, your name and profile picture. With Apple you may use a private relay email address.
Preferences. Display name, country, currency, language, time zone, theme, preferred stores, alert frequency and quiet hours. Your country is first guessed from the country of your connection (see Region detection) and you can change it at any time.
Things you create. Your watchlist (games, target prices, discount thresholds, notes), autobuy rules and budget, purchase reminders, notifications and API keys. API keys are stored only as a hash and a short prefix.
Linked Steam account (optional). If you link Steam we store your Steam ID, profile name, avatar and profile URL, and we regularly import your owned games (including playtime and last-played date) and your wishlist. Steam only shares this if your Steam game details are public.
Alert channels (optional). Depending on what you turn on: your email address for email alerts; the push subscription or device token issued by your browser or phone, plus a device name such as “Chrome on Windows”; your Telegram chat ID; the Discord webhook URL you paste in.
Security and technical data. For each signed-in session we keep the IP address, browser user agent and timestamps so you can review and revoke sessions. We keep a security log of account events (sign-ins, sign-out from all devices, linking or unlinking accounts, creating or revoking API keys, account deletion) with the IP address. Our servers write short technical request logs (IP address, time, requested URL) to keep the service running and to stop abuse, and use your IP address for up to 60 seconds for rate limiting.
We do not collect payment card details, store passwords or government IDs, and we do not use your data for advertising or profiling.
3.How we use it and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Creating and running your account, syncing it across devices | Account data, preferences, things you create | Performance of our contract with you (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)) |
| Showing prices for your region and currency | Country, currency, connection country | Contract; legitimate interest in showing relevant prices |
| Sending the alerts you asked for | Alert channels, watchlist, notifications | Contract; you can switch each channel off at any time |
| Importing your Steam library and wishlist | Steam data | Your request when you link the account; you can unlink at any time |
| Keeping accounts and the service secure, preventing abuse and fraud | Security and technical data | Legitimate interest (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)) |
| Answering your messages and requests | Your email and what you send us | Contract or legitimate interest |
| Meeting legal obligations | Only what the obligation requires | Legal obligation (GDPR Art. 6(1)(c); KVKK Art. 5(2)(ç)) |
We only send service emails (alerts you set up and messages about your account). We do not send marketing email.
4.Region detection
Our traffic passes through Cloudflare, which tells our servers the country of your connection. We use that country only to pick a sensible default region and currency for prices, and when you sign up, to set your initial country. We do not store your location beyond that country code.
6.Store links and affiliate partners
When you click “Buy”, you leave DropQuest. Many store links go through the CheapShark redirect, and some stores use affiliate networks (for example Impact for Humble Bundle). These partners may set their own cookies on their domains to record that the visit came from a deal site, which can earn a small commission at no extra cost to you.
We do not send your name, email or account data to these partners. Ad blockers may block or warn about these redirects; you can always open the store directly instead.
8.International transfers
Some providers above process data outside your country, including in the United States and the EU. Where the law requires it, we rely on appropriate safeguards such as the European Commission’s standard contractual clauses and the mechanisms provided under KVKK Article 9.
9.How long we keep it
| Data | Kept for |
|---|---|
| Account data, preferences, watchlist, autobuy rules, Steam data | Until you delete them or your account |
| Read notifications | 180 days |
| Unread notifications | 365 days |
| Notification delivery records | 30 days |
| Signed-in sessions (IP address, user agent) | Up to 60 days, then removed within 7 days after expiry |
| Security log | 365 days (if you delete your account, its entries lose their IP address, details and link to you) |
| Server request logs | A short period for troubleshooting, then rotated |
| Rate-limit counters | 60 seconds |
10.Your rights
Under GDPR and KVKK Article 11 you have the right to:
- know whether we process your data and get a copy of it (Settings → Danger zone → Export my data gives you a JSON copy of your account data);
- have inaccurate data corrected (most of it you can edit yourself in Settings);
- have your data deleted (see Deleting your account below);
- object to processing based on legitimate interest, and restrict processing;
- receive your data in a portable format;
- learn who we share your data with and, under KVKK, object to an outcome against you that arises solely from automated analysis;
- claim compensation for damage caused by unlawful processing.
To use a right that Settings does not cover, email [email protected] from the address on your account. We answer within 30 days. You can also complain to your data protection authority; in Türkiye that is the Personal Data Protection Authority (KVKK).
11.Deleting your account
Go to Settings → Danger zone and confirm. Your profile, sign-in methods, sessions, API keys, settings, devices, watchlist, notifications, linked accounts, imported games, autobuy rules and purchase reminders are deleted right away.
Security log entries stay until they expire (up to 365 days) so we can investigate abuse, but without your IP address, details or any link to your account. Short-lived server logs expire on their normal schedule.
You can also unlink Steam, turn off any alert channel or revoke any session or API key at any time without deleting your account.
12.Security
All traffic is encrypted with HTTPS. Session tokens and API keys are stored only as hashes, and sign-in uses short-lived signed tokens. No system is perfectly secure; if we learn of a breach that affects you, we will notify you and the authorities as the law requires.
13.Children
DropQuest is not intended for children under 16. If you believe a child has given us personal data, contact us and we will delete it.
14.Changes to this policy
We will update this page when our practices change and change the date at the top. If a change is significant, we will tell signed-in users by email or in the app before it takes effect.
15.Contact
Questions, requests or complaints: [email protected].
See also: Terms of Service