[ TABOR ]
Privacy Policy
LAST UPDATED JUNE 2026
Draft notice
This is a working draft prepared for review. Have it checked by a qualified data-protection attorney before public launch, especially for EU (GDPR) and South African (POPIA) compliance.
Who we are
TABOR ("we", "us") operates the TABOR mobile app and the tabor.quest website (the "Service"). We are the data controller for your personal information. Contact: support@tabor.quest. POPIA Information Officer and EU representative details will be published here before launch.
What we collect
- Account: email address, display name, and a chosen handle.
- Profile: your faith status, class, training level, goals, birth year (for age verification), streaks, XP, and progress.
- Content you create: guild messages, posts, prayers, reviews. Direct messages are end-to-end encrypted and can only be read on your device and the recipient's; we store only ciphertext and cannot read them.
- Commerce: orders, shipping address, and donation records (handled by our payment provider; we do not store full card details).
- Usage & device: basic analytics and diagnostics, only where you have consented.
How we use it & lawful basis
- To provide the Service (your account, the app's features, orders) — basis: performance of a contract.
- Safety & moderation (preventing abuse, enforcing our rules) — basis: legitimate interest and legal obligation.
- Analytics and marketing email — basis: your consent, which you may withdraw at any time.
- Legal compliance (e.g. retaining financial records, responding to lawful requests).
Who we share it with (sub-processors)
We use trusted providers who process data on our behalf under data-processing agreements:
- Supabase — database, authentication, storage.
- Vercel — website and API hosting.
- Resend — transactional and announcement email.
- Printful and print partners — order fulfilment.
- Payment provider — processing purchases and donations.
Your rights
You can access, export, correct, or delete your data, and object to or withdraw consent for processing. In the app: Settings → Privacy & Data (Download my data) and Settings → Delete my account. You may also email support@tabor.quest. We respond within one month and at no charge.
How we protect your data
All traffic is encrypted in transit (TLS). Data is encrypted at rest. Access is restricted by row-level security so users can only reach their own data. Direct messages are end-to-end encrypted. The master service key is held server-side only and never shipped in the app.
Retention
We keep your data while your account is active. On deletion we erase your personal data, except records we are legally required to keep (e.g. financial/order records for tax), which are retained only as long as the law requires and then deleted.
Children
TABOR is for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has registered, contact support@tabor.quest and we will remove the account.
Cookies & analytics
The website uses essential cookies to function and, only with your consent, analytics. You can manage consent in the app (Settings) and via the website's consent notice.
Breach notification & changes
In the event of a data breach affecting your rights, we will notify the relevant regulator and, where required, affected users without undue delay. We may update this policy; material changes will be announced in-app or by email.