Checkpoint privacy policy

Effective October 26, 2026

This policy explains what Checkpoint (the app at checkpoint.nexus) does with your information. Checkpoint is made by Side Quest Nexus LLC ("we", "us"), which decides how this information is used (in EU and UK terms, the "controller"). If you have a question about it, email hello@sidequest.nexus.

Your account

You sign in with your email address, using a link or a one-time code we email to you, with Sign in with Apple, or with your Discord account. Sign-in is run by our authentication provider, Supabase, and the sign-in emails are sent through Resend. If you use Discord, Discord tells us your Discord user ID, username, avatar and email address; we don't get your Discord password, servers or messages. If you use Sign in with Apple, Apple tells us an account ID, your email address (or a private relay address, if you choose to hide yours) and, the first time only, the name you choose to share; we keep a token from Apple so that deleting your account also ends Checkpoint's access to your Apple ID. We keep:

• your email address and account ID, to sign you in and to know which invitations and permissions apply to you;
• your display name, if your sign-in method provides one;
• which version of the terms you accepted, and when;
• how many questions your account asked each day, to apply the daily limit;
• the games you add to My games, so the app can show them first.

Your conversations

Each question you ask, and the answer Checkpoint gives with its sources, is saved to your account so you can see your past conversations and ask follow-up questions. Only you can see them in the app. The people who run Checkpoint (today, the company's owner) can read them only when needed to run, secure or fix the service. You can delete a conversation in the app at any time. It is then removed from the service straight away, and from our backups within 70 days as they expire.

If you attach a screenshot to a question, it is sent to Anthropic with the question to describe what it shows. We don't keep the image.

We also keep two records of questions that are not attached to your account:

• A shared answer cache: an answer is stored under its question's text for 7 days, so the same question about the same patch can be answered again quickly. Deleting a conversation doesn't remove a cached answer, but it expires within 7 days.
• A question log: each question, which sources the answer used, and a reference to the conversation, so we can find answers that went wrong and see which sources are used. We also use it to suggest common questions for a game, but only a question that at least three different accounts asked, so no one's question is shown to others on its own. We keep it for 12 months. A detailed technical record of how each answer was made (the AI and search steps) is kept for 30 days.

Please don't put personal information about yourself or anyone else in your questions.

Feedback and corrections

If you rate an answer, write a note, report an answer (as offensive, wrong or something else), or flag something as wrong, we keep the question, your rating or note and the date, without your account, to improve Checkpoint. When a report is about a mistake on a community wiki, we may tell that wiki's editors about the mistake, using the question and the wiki text involved, never who reported it.

If you vote for a game to be added, we keep your vote with your account ID, or, if you aren't signed in, with a code made from your IP address and a secret random value (a pseudonymous code; we never keep the address itself), so each person counts once.

AI services

Checkpoint answers with AI models from Anthropic. To answer, our server sends Anthropic your question, the earlier turns of the same conversation, and the game information we've looked up. When web search is on for an answer, Anthropic runs the search for us. We don't send Anthropic your name, email or account ID, unless you write them in a question. Under Anthropic's commercial terms (as of October 2026), Anthropic doesn't train its models on data sent through its API, and it may keep requests for a limited time, for example to detect abuse; see Anthropic's privacy policy.

We also use AI services (Anthropic, and Google's Gemini for video guides) to build each game's knowledge base from public sources. That work doesn't involve your data.

AI can make mistakes. Answers show their sources so you can check them.

Technical information

• Where it runs. Checkpoint runs on a server we operate in Germany (hosted by Hetzner). Connections go through Cloudflare, which keeps its own technical logs, such as IP addresses, to keep the service secure. Supabase stores account data in the United States, and we keep encrypted backups of the service's data with Cloudflare.
• Logs. Our server records basic information about each request: the time, which part of the app was used and whether it worked. These logs don't include your IP address, your email or the text of your questions, and they are rotated by size, usually within days.
• Crash reports and traces. When something breaks, or to see where the service is slow, we send error reports, logs and timing traces to Sentry (in the United States). Before they leave our server, our software is designed to remove your account, email addresses, IP address, request contents, cookies and anything that looks like an ID or key, and to leave out question and answer text.
• Visit counts. When you open a source's link, we count it by day and by website (for example "fextralife.com, 3 visits on Monday"), so we can show sources the traffic we send them. No account, IP address or page address is kept.
• Security. Connections are encrypted (HTTPS), access to the server and data is limited to the people who run Checkpoint, and service keys are kept in a secrets manager. No system is perfectly secure; if a breach affects your data, we'll tell you and the authorities as the law requires.

In your browser

Checkpoint itself sets no cookies and uses no analytics or advertising tools. It keeps your sign-in session and a few settings (such as whether web search is on, and list or grid view) in your browser's local storage, which is needed for the app to work. Signing out removes the session. Cloudflare, which protects the service, may set a strictly necessary security cookie.

When an answer includes a YouTube video guide, Checkpoint shows a preview, served by our own server, and nothing is loaded from YouTube until you press play. When you do, the video plays in YouTube's privacy-enhanced player (youtube-nocookie.com), so YouTube receives your IP address and may store information on your device, under YouTube's terms and Google's privacy policy. Pictures and links in answers come from the games' wikis and stores, which can see your IP address when your browser loads from them.

Checkpoint doesn't track you across other websites, so it works the same whether or not your browser sends a Do Not Track or Global Privacy Control signal. We don't sell or share personal information for advertising.

Why we use your data (legal bases)

Where the GDPR or UK GDPR applies, we rely on these legal bases:

• To provide Checkpoint (your account, sign-in, answering your questions, saving your conversations, sending them to Anthropic to answer): to perform our agreement with you (the terms of use).
• To keep it secure, reliable and fair (the daily limit, logs, crash reports and traces, the question log, Cloudflare's protection): our legitimate interest in running a working, safe service.
• To improve it (feedback, corrections, the question log and the answer cache, game votes): our legitimate interest in making the answers better. You can object to this, as described below.
• Records of your acceptance of the terms, and anything the law requires us to keep or disclose: our legitimate interest in showing what was agreed, and our legal obligations.
• Playing a YouTube video: your consent, given by pressing play. You can withdraw it by not playing videos.

Who we share it with

Only the service providers named above, and only what each needs to do its job for us: Supabase (accounts), Resend (sign-in emails), Anthropic (answers), Sentry (error reports, without your account or questions), Cloudflare (network and backups) and Hetzner (the server). They act on our instructions under data processing terms. If you sign in with Apple or Discord, that company runs that step under its own privacy policy. We may also disclose information if the law requires it, or to a buyer or successor if the business is sold, under this policy. We don't sell personal information or use it for advertising.

International transfers

We're a US company, and Checkpoint's server is in Germany. Supabase, Resend, Apple, Discord, Anthropic and Sentry process data in the United States, and Cloudflare operates worldwide. When personal data goes from the EU, UK or Switzerland to the United States, the transfer relies on the European Commission's standard contractual clauses (with the UK addendum) in each provider's data processing terms, or on the EU-U.S. Data Privacy Framework where a provider is certified. Email us for a copy of the relevant safeguards.

How long we keep it

• Your account, conversations and My games list: until you delete them or delete your account (in the app, or by asking us).
• Your record of accepting the terms: for as long as you have an account.
• Daily question counts: 90 days.
• The shared answer cache: 7 days.
• The question log: 12 months. Detailed records of how each answer was made: 30 days.
• Feedback and corrections: 24 months.
• Game votes: 12 months.
• Crash reports and traces: as long as Sentry keeps them under our plan (90 days or less).
• Backups: daily backups for 14 days and weekly backups for 8 weeks, so deleted data is gone from them within 70 days.

Your choices and rights

Wherever you live, you can ask us to:

• give you a copy of your data, including your conversations in a portable format;
• correct it;
• delete your account and everything linked to it;
• limit how we use it while a request or complaint is looked at;
• stop using it for purposes based on our legitimate interests, such as improving Checkpoint, unless we have a strong reason the law accepts;
• withdraw a consent you gave, without affecting what happened before.

Email hello@sidequest.nexus from the address you sign in with. We'll answer within one month (if a request is complex, we may take up to two more months and will tell you why). We won't treat you differently for using these rights. If you're in the EU, UK or Switzerland, you can also complain to your local data protection authority.

Children

Checkpoint isn't meant for children under 13, and we don't knowingly let them use it. Where the law sets a higher age for agreeing to online services on your own, you need a parent's permission. If you think a child under 13 has an account, email us and we'll delete it.

Changes to this policy

If we change this policy, we'll update it here and change the date at the top. If a change matters, we'll tell you by email or in the app at least 30 days before it applies.

Contact

Side Quest Nexus LLC, a Washington limited liability company
522 W Riverside Ave Ste N
Spokane, WA 99201
United States
hello@sidequest.nexus

This policy covers the Checkpoint app. Our company privacy policy covers this website, email with us and payments.