Privacy Policy

Who is responsible

The data controller is B3ni15, a private individual based in Hungary. Contact: [email protected].

What we store

• Your Discord profile from sign-in: id, username, display name, avatar, and email address with whether Discord verified it.
• Connected accounts: each account's token (encrypted, see below), username, avatar, the label you gave it, and whether the token still works.
• Settings per account: which quests to farm, auto-accept and auto-watch, whether to show the game you're "playing", and for VIP: Rich Presence, custom status text and farming hours.
• Run history: which quests ran, their type, progress, result, reward size and when.
• Sign-ins: for each session, the IP address, browser (user agent), when it started and when it was last used.
• Notifications: if you turn on push notifications, the subscription your browser hands us (a push-service address and encryption keys) and which kinds you want; if you add a Discord webhook, its URL and which events it gets.
• Your original custom status, saved at the start of a run so it can be put back, and deleted as soon as it is.
• An activity log of security and admin actions (such as role changes or bans), naming the Discord ids involved.

Why, and on what basis

• To run the service you signed up for (performance of a contract): your profile, tokens, settings, run history and notification choices.
• To keep accounts secure and the service free of abuse (legitimate interest): sign-in IP addresses and browsers, new sign-in alerts, the activity log, and keeping a ban after deletion.
• With your consent: push notifications, and personalised ads where you agreed to them in the cookie message.

How a token is protected

The moment a token reaches our server it is sealed with public-key encryption (X25519 + AES-256-GCM) before it touches the database. The website only holds the public key and cannot decrypt it again. Only the separate farming worker holds the private key; it decrypts a token in memory while it acts on that account, and never writes the plain token anywhere. The database (Cloudflare D1) is also encrypted at rest.

What we do on your Discord account

• Read the account's quest list and orb balance, accept quests, and report quest progress.
• During a run, set the custom status (the ad on free accounts, or a VIP's own text), re-apply it if it gets changed, and put the original back at the end.
• Keep a connection to Discord open to show presence: the quest's game while a run goes, and a VIP's custom Rich Presence — permanently, if they chose "Always". Images given as links are registered with Discord through the Rich Presence application you chose.
• For VIP and admin accounts with auto-accept or auto-watch on, check the quest list about every 5 minutes. To spot brand-new quests for notifications, one administrator's account is checked every 10 minutes — your account is not used for that.

All of these requests come from our servers, not from your device.

Who else processes your data

• Cloudflare hosts the database and carries traffic to the site.
• Discord receives the requests we make on your connected accounts, and the messages sent to your webhook.
• Your browser's push service (for example Google, Mozilla or Apple) delivers push notifications; their contents are encrypted end to end, so the push service can't read them.
• Google AdSense shows ads on our public pages to visitors who aren't VIP, and sets its own cookies — see the Cookie Policy.

We don't sell your data or share it with anyone else.

How long we keep it

• Sign-ins, with their IP address and browser: until the session ends — at most 7 days, or when you sign out. Ended sessions are deleted within the hour.
• Push subscriptions: until you turn notifications off, your browser drops the subscription, or you delete your account.
• Everything else: for as long as your account exists.
• When an account is banned and then deleted, we keep only a one-way hash of its Discord id and the ban reason, so the ban can't be undone by deleting and signing in again. Nothing else about it is kept.

Your rights

You can ask to see, correct, export or delete your data, object to processing based on legitimate interest, and withdraw consent at any time. Much of it is self-service:

• Delete everything: Settings → Danger zone. It stops every run and erases your login, connected accounts, tokens, settings, history, sign-ins, notification subscriptions and activity-log entries at once, with no recovery.
• Disconnect one account: Accounts → Disconnect.
• End sessions: Settings → Where you're signed in.
• Notifications and webhooks: Settings.
• Export run history: as CSV from History (VIP), or ask us by email.

For anything else, email [email protected]. You may also complain to a data protection authority; in Hungary that is the NAIH (naih.hu).

Age

Disquest Helper is only for people aged 16 or older.

Changes to this policy

When we materially change what we collect or how we use it, you'll be asked to accept the updated policy the next time you open the dashboard.