Who handles your information
QuestSeat is operated by STORMSCAPE PTY LTD, ABN 37 693 663 731, ACN 693 663 731. This policy explains how QuestSeat handles personal information. It is effective from 2 November 2026.
QuestSeat is a testing preview and live Stripe collection is disabled. This policy applies to information handled during testing and through the features available to you. A test payment does not establish that live collection is available.
Information we handle
Depending on your use of QuestSeat, information can include:
- Identity and contact: names, email addresses, account and participant identifiers, verification records and connections to a GM’s workspace. A GM can include a guest without email; people sharing an inbox can still have separate records.
- Campaign participation: schedules and time zones, invitations, applications, private questions and replies, group size and availability, membership, expected participation, skips and GM-recorded attendance.
- Agreements and money: accepted dates, arrangements, amounts, currencies, terms and collection authorisations; subscription, trial, plan and founding history; charges, attempts, receipts, fees, waivers, refunds and provider references. GM-recorded direct payments are distinguished from processed payments.
- Content and reports: public writing, saved drafts, images, descriptions, attribution, video references, reviews, private feedback and issue histories. Free text may contain further personal information; provide only what the task needs.
- Access and operation: access-link and session records, browser continuity state, mail delivery records, audit events and diagnostic information used to investigate faults or protect the service. Browsers also send connection information to deliver pages and services.
Information comes from you, from the GM managing your table and from providers performing a relevant task. A GM’s entry is not necessarily independently verified by QuestSeat.
How information is used
Information supports private access, publication choices, game questions and joining, campaign operations, attendance, agreements, financial records, operational messages, support and moderation. It also helps investigate errors, misuse and security concerns.
Session facts, accepted terms, participation choices and payment outcomes inform the joining, skip, cancellation and collection rules shown in the app. Expected attendance, actual attendance and payment status remain separate: payment does not prove attendance or a particular experience.
An email address provided for access or an operational message does not itself subscribe you to marketing. Any separate marketing choice needs its own explanation.
Participation and age information
QuestSeat participation is for GMs and players aged 18 or older, including existing, invited, externally paid, complimentary and no-email participants. When age eligibility information is provided, we use it to administer this participation rule and address concerns about eligibility.
We distinguish a person’s own declaration from a GM’s attestation. Related records can identify the person, who made the statement, and the policy version and time recorded. These are private assertions, not independently verified age. Do not send a date of birth, identity-document copy or face scan for an eligibility declaration. Stripe’s own merchant-identity requirements are separate.
Age declarations, service or table acceptance and financial consent are separate. An age-related participation restriction does not remove access to records, support, refunds or cancellation, subject to ordinary identity and authorisation checks. Reports or existing records can still contain information about a minor. We assess the actual circumstances when handling that information, including correction and removal requests.
Public content and private records
Published GM, world and campaign pages contain the author’s chosen writing and artwork with public game facts. Publication and discovery opt-in are separate. An unlisted page can be read by anyone with its link; it is not confidential membership access. Saved drafts are separate from the published version.
Saved private roster contacts, preparation, meeting links, questions, applications and money records are not automatically inserted into public pages. Check your authored text and images: private details included in that material can become public.
Public reviews show the chosen display name, rating, review text, strengths and review month. Private feedback is not public, but is available to the owning GM. Email addresses and private campaign/session records are not automatically added to a public review; identifying details in the author’s own prose can still be public. Source labels do not independently verify attendance or endorse a GM.
Withdrawing a review removes its public display while revision and moderation history may remain. Unpublishing or leaving a table also differs from erasing the underlying records.
GMs, support and other recipients
Your GM receives the information needed to consider your request and run your table, including participation and arrangements within that workspace. GMs may keep separate records and use their chosen play or communication tools; ask them about handling outside QuestSeat.
A GM issue and a QuestSeat platform report have different audiences. The owning GM can see their GM issues. A platform report is available to its author and configured QuestSeat operators; campaign ownership alone does not give a GM access. Issue messages and actions form a retained history rather than an editable public conversation.
Authorised operators may access private records for support, maintenance, security, moderation or financial reconciliation. Investigation or claim-related sharing must relate to those purposes or another basis allowed by law and be limited to relevant information. Information may also be disclosed when law requires it.
Providers and overseas handling
QuestSeat uses Amazon Web Services for application, database and media storage configured in Sydney, Australia; Resend for transactional email with sending configured in Tokyo, Japan; and Cloudflare for DNS and global proxy delivery. Each handles information relevant to its function. A configured region does not establish every provider activity’s location.
Where Stripe checkout is enabled, card details are entered through Stripe’s hosted service. QuestSeat uses processor references, authorisation evidence and outcomes. Card setup is different from a payment. Do not send full card details through messages, reviews or issue reports.
Information can be handled outside Australia, including Tokyo email sending and Cloudflare’s global delivery network. Administration, support and other provider processing may involve further countries. These service regions are not an exhaustive list of processing locations, and Sydney hosting does not mean all processing occurs in Australia.
Access links, cookies and browser storage
Private email links verify access to an identity or action. Verification links expire and are single-use. Delivery records can contain the recipient, message and full link; expiry does not remove every message or stored copy. Keep private links secure.
A functional session cookie maintains verified access. Browser history and session storage help restore search choices, selected campaigns, scroll, focus and return paths. That browsing state grants no private access. Unsaved editor writing can exist only in the open page until saved or explicitly downloaded.
Saved tables keeps up to 40 public campaign identifiers in this browser’s local storage. The app sets no automatic expiry; entries can remain until you remove bookmarks or clear site data. Browser storage restrictions may make saving unavailable. No account is required, and QuestSeat does not sync the list between devices. To display Saved tables, your browser sends the identifiers to QuestSeat to retrieve currently eligible public listing and image information. Unavailable listings are omitted from that lookup; their local bookmarks remain until removed.
Images are processed and re-encoded for display. That output process does not retain original image metadata, but visible images, descriptions and attribution may still identify someone.
A YouTube or Vimeo embed loads after you choose to load it. Your browser then connects to that provider, which receives connection information such as your IP address and applies its own practices. External play links also lead to separate services.
Retention and removal
There is no single deletion period for all records. Relevant purposes include an active account or table, outstanding money, refunds, disputes, reports, agreement or authorisation evidence, security investigations, recovery and applicable record-keeping obligations. Information is kept while needed for those purposes or an applicable obligation, rather than for one fixed period that applies to every record.
Financial, agreement, review, issue and audit history can remain after its current display or status changes. Older copies can also remain in database backups, recovery snapshots, diagnostic records and versioned media. One backup setting does not determine deletion of every copy. Unpublishing, withdrawing a review, leaving or token expiry is not universal erasure.
Storm manages request-driven retention reviews and a monthly review of information no longer needed. We remove or de-identify information when it is no longer needed, subject to applicable obligations and relevant holds. Where information needs to remain, we record the continuing purpose or reason. Reviews and removal decisions consider retained copies as well as records visible in the app.
Access, correction and privacy concerns
Storm is the operator contact for privacy requests and complaints about information held by QuestSeat. Email [email protected], including if you cannot sign in. You can also open Report an issue and choose the QuestSeat platform destination when that option is available. Verified email access is required for that form; the page explains when platform reporting is unavailable.
Write to STORMSCAPE PTY LTD, 8B Daly Street, Kurralta Park, SA 5037, Australia.
Describe the information or concern and the outcome sought. Identity and request scope may need confirmation before private records are released or changed. Do not include full card numbers, passwords or private access links. For a GM’s separate off-platform records, contact that GM.
We assess access, correction, complaints and removal requests while protecting other people’s privacy and accurate historical evidence. If a request cannot be fulfilled, we explain the reason and the available escalation options. The Office of the Australian Information Commissioner explains complaints within its jurisdiction. Testing status does not suspend rights under applicable law.
Policy changes and separate consent
We identify the effective date when this policy changes. A policy change does not replace separate payment authorisation, service or table agreement, publishing choices or marketing consent. Reading this policy does not itself authorise a payment or subscribe you to marketing.