Privacy Policy

01Introduction

This Privacy Policy describes how Signal Quest collects, uses, stores and protects your information. It applies to all services — Android application, website, associated APIs and social features — in accordance with the GDPR and applicable French law.

02Data collected

2.1Identification and account

• –Email address — authentication and important communications
• –Username — public identifier visible to the community
• –Password — stored hashed with bcrypt, never in clear text
• –Avatar, role (user / moderator / admin) and FCM token for Android push notifications

The email address, username and password are required to create and manage the account: without them, the account cannot be created (Art. 13(2)(e) GDPR).

2.2GPS location

2.3Mobile network data (Android)

Collected through the TelephonyManager API: signal quality (RSRP, RSRQ, RSSI, SNR, SS-RSRP, SS-SINR…), cell identification (Cell ID, eNB, gNB, PCI, TAC, LAC), frequencies (EARFCN, NR-ARFCN, bands, Carrier Aggregation), technology (2G→5G SA), operator (MCC/MNC), Timing Advance and NQS Score.

2.4 – 2.8Performance, messaging, social, media, gamification

• –Speed test — throughput, ping, latency, jitter, connection type, device model; each test, public or private
• –Messaging — content encrypted end to end; public key on our servers, private key encrypted locally (PBKDF2, 210,000 iterations); attachments, reactions, scheduled/ephemeral messages; SRTP calls via LiveKit
• –Social — friendships, blocks, presence status (configurable), custom status, message privacy
• –Photos & media — cell tower photos (moderated), EXIF metadata if present, reactions, comments, reports
• –Gamification — points, level, badges, public leaderboard, consecutive days, event history
• –Trusted devices — WebAuthn public key (Passkey/PRF) or Android Keystore; private keys never leave your device. Bug reports — technical context, screenshots attached voluntarily

2.9Android permissions & diagnostics

An Android permission is not, on its own, a legal basis under the GDPR. Where processing relies on consent, that consent is requested in addition to the system’s technical permission.

03Use of data

We use your data only for: collaborative mapping, authentication and security, gamification, aggregated network statistics, messaging and calls, configurable notifications, moderation and improvement of the service.

04Legal basis (GDPR)

In accordance with the GDPR, each processing operation relies on an explicit legal basis:

05Data sharing

5.1Public vs private data

5.2Service providers

These providers process your data only on our behalf, under data processing agreements (DPAs) compliant with the GDPR:

DPF: EU-US Data Privacy Framework. SCC: Standard Contractual Clauses approved by the European Commission.

06Data retention

We keep your data only as long as strictly necessary for the purposes for which it was collected and, where applicable, to comply with our legal obligations (accounting, security). At the end of these periods, data is deleted or irreversibly anonymised.

What happens to measurements when an account is deleted. The coverage measurements and speed tests you record (position, technology, signal level, throughput, timestamp) remain linked to your account for the periods above, and are then irreversibly anonymised. If you delete your account before these deadlines, your measurements are immediately dissociated from any identity and kept in this anonymised form for the benefit of the community map. You can export your data at any time (Settings › Privacy) or request the complete erasure of your measurements — before or after deleting your account — by writing to privacy@signalquest.fr.

07Your rights (GDPR)

In accordance with the GDPR, you have the following rights over your personal data, whatever your country of residence:

08Data security

• –Encryption in transit — HTTPS / TLS 1.3 for all communications
• –Passwords — bcrypt hashing with salt, never in clear text · HttpOnly + SameSite=Lax tokens
• –Messaging E2EE — keys generated on the client side; our servers cannot read your messages · private keys in the Keystore / WebAuthn
• –Database — restricted-access PostgreSQL, encrypted connections, encrypted daily backups · OVH VPS hosting in France · SRTP calls via LiveKit

09Cookies and local storage

We only use strictly necessary functional cookies, exempt from consent under Article 82 of the French Data Protection Act (CNIL deliberation no. 2020-091):

10International transfers

Signal Quest’s main infrastructure is operated from France (OVH). However, some features rely on providers that may process data in the United States.

Google / Firebase (FCM push, Crashlytics, AdMob) and Amazon Web Services (S3 / CloudFront) are certified under the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023). For providers not covered by that decision (e.g. Groq or the Resend fallback), transfers are governed by the Standard Contractual Clauses (SCC) approved by the European Commission. A copy of these safeguards can be obtained on request from privacy@signalquest.fr (Art. 13(1)(f) GDPR).

11Protection of minors

In France, Signal Quest is intended primarily for people aged 15 and over. Below that age, any use involving processing based on consent requires the consent of the holder of parental responsibility.

If we discover that a minor’s data has been collected in breach of the applicable rules, we will take the necessary measures (deletion or restriction of the account). Report such cases to privacy@signalquest.fr.

12Changes

We may change this Policy to reflect changes in our practices or in legal requirements. In the event of a substantial change, you will be informed by email, in-app notification and a banner on the site. The updated version takes effect as soon as it is published.

13Contact and CNIL

This Policy is to be interpreted in light of French law and the GDPR (EU 2016/679), without prejudice to the mandatory rights of consumers and data subjects.