privacy policy

updated 10 november 2026. this policy describes the current private preview of next quest.

who runs this site

ewan operates next quest. for questions, access, correction or deletion requests, contact support@ewanlew.is.

what we collect and why

your next quest account has its own identity and display name. when you connect steam or choose steam sign-in, we retrieve and store your steam id, steam display name, avatar url and available game library, including game ids, names and playtime. steam sign-in refreshes the connection’s profile and attempts a library refresh; you can also request a refresh from settings. private or unavailable steam libraries remain unavailable to us. we do not receive or store your steam password.

when email sign-in is available and you use it, we store your verified email address as a sign-in method. we send a one-time link to verify it; there are no next quest passwords. email addresses are not shown to group members. verification records contain the requested address, hashed tokens and an expiry, and linking is tied to your current session.

we store your selected store region, ratings, group names, memberships, group rankings, game notes, completed-game status and invitation records you create. we use this information to provide your account, show group preferences, calculate rankings and operate invitations. authentication records keep your session secure. we do not use steam data for unsolicited marketing.

who can see it

members of a group you join can see your display name, avatar, group rankings, group game notes and shared-library matches. your account solo list, its notes and personal library ratings are private. group owners can remove members, transfer ownership and permanently close their groups. anyone with a valid invitation link can see the group name and current members’ display names and avatars before signing in and choosing to join, so share links carefully.

storage and service providers

the account and group database is stored with neon in aws london, united kingdom. the current application server runs on the operator’s computer. guest solo games and scores stay in indexeddb in your browser. creating a new account automatically copies that browser’s solo list, settings, scores and completion status into your private account solo list. the browser copy remains intact; later sign-ins do not import it again. signed-in solo changes are saved with your account and available on other devices. creating a group from your list copies its games, scores and completion status into that group, where its members can see them. your theme and guest store-region preferences are also stored in your browser. account store-region preferences are stored with your account. prices use your chosen region or an automatic country estimate from the hosting service or browser language; we do not request precise location.

steam handles sign-in and supplies game and profile data. loading artwork or avatars contacts steam’s image services, which receive normal connection information such as your ip address. steam’s own processing, international transfers and privacy controls are explained in valve’s privacy policy. infrastructure providers may process connection and diagnostic information to deliver and secure their services.

game searches send your search terms to steam and, when configured, igdb from our server. steam also receives your selected store region for prices. native game artwork can load from igdb, epic and riot image services, which receive normal connection information such as your ip address. we do not send your scores or group membership to these catalog services. epic and riot account connections and library imports are not currently supported.

mailgun receives the recipient address and sign-in message to deliver your requested link. our sending domain uses mailgun’s us region. open and click tracking are disabled for these messages. general account notifications and marketing emails are not implemented.

cookies and retention

we use necessary sign-in cookies: an application session lasts up to 30 days, steam verification state lasts up to 10 minutes, email verification state lasts up to 15 minutes, and account-merge verification lasts up to 15 minutes. email links work once and must be opened in the browser where they were requested. expired email verification and email request-limit records are cleaned up on subsequent email requests. request limits store a hash of the requested email and expire after an hour. signing out revokes the current session. invitation links expire after the duration selected by the owner; a new link, membership removal or ownership transfer invalidates earlier links. expiry prevents access but does not necessarily immediately erase the database record.

account, library and group records are retained until removed, deleted through account settings or deleted by the operator following a request; there is currently no automatic inactivity-deletion schedule. removing a group member deletes their rankings and notes in that group, while marking a game complete retains its rankings. removing a game hides it from the group but retains its scores, notes, date added and completion status so a member can undo or re-add it; these records remain until the owner closes the group or the operator deletes them following a request. closing a group permanently deletes its memberships, curated games, group rankings, notes and invitations, while retaining members’ accounts, personal libraries and ratings. removed account solo games retain scores, notes and dates for undo and re-addition until the account is deleted or the operator deletes the records. clearing browser site data removes local solo data and preferences, but does not delete your account solo list. exported backups remain wherever you saved them. provider backups may retain deleted records until their configured retention period ends.

your choices

you can edit your display name and connect or disconnect sign-in methods in settings, keeping at least one method connected. disconnecting steam removes its synced ownership snapshot but keeps your next quest profile, personal ratings, groups and group rankings. disconnecting email removes that sign-in address. disconnecting either method revokes pending verification links for the account and signs out other sessions. disconnected methods no longer grant access to the account.

when a sign-in method belongs to another account, you can verify both accounts and choose to merge them. you review conflicting scores and sign-in methods before confirming. merging combines your solo lists and groups, retains your current profile and settings, removes the duplicate account and signs out other sessions.

you can permanently delete your account from general settings after transferring or closing any groups you own. deletion removes your private solo list, pre-ranks, synced library, sign-in methods, memberships and group scores. other members’ accounts and shared groups remain. your browser’s guest solo list is not deleted.

you can use solo mode without signing in, change your ratings, remove solo games, export your solo library, change your store region, close a group you own and sign out. to request a copy, correction or deletion of server-held data, contact the operator above. changing steam privacy settings does not automatically delete an existing snapshot here. we will review requests and explain any information we need to verify account ownership.

steam data and attribution

next quest is independent of valve and is not endorsed by steam. steam and its associated marks belong to valve; game artwork and names belong to their respective owners.

steam data is provided as available, with faults and without warranties of accuracy, availability, fitness for a purpose or non-infringement. to the extent allowed by applicable law, valve and its suppliers are not liable for losses or damages arising from use of steam data or services. if you disagree, stop using the steam-connected features. statutory rights and liabilities that cannot legally be excluded are unaffected. see the steam web api terms.

changes

we will update this page when data use, providers or storage locations change. we will review this policy before public deployment and keep the contact details current.