Cookies
Effective Date: December 1, 2026
Questovery Cookie and Tracker Policy
Version 1.2 - effective as of December 1, 2026.
Reference language notice: This English translation is provided for convenience only. In case of discrepancy, inconsistency, or interpretation difference, the French version shall prevail.
This Cookie and Tracker Policy explains how LEZO uses cookies, local storage and software development kits (SDKs) in the www.questovery.com website, the web application and the Questovery mobile applications (the "Application"). It supplements the Questovery Privacy Policy.
1. What this policy covers
A cookie or tracker is information read from or stored on your device, for example a browser cookie, local storage data or an identifier managed by an SDK in the mobile application.
Trackers that are strictly necessary for the service you request, or intended exclusively to enable communication by electronic means, do not require your consent. The audience measurement trackers described in articles 2.3 and 3.2 are used only with your agreement.
2. Website
2.1 Cookies necessary for operation
| Cookie | Purpose | Duration |
|---|---|---|
__Secure-questovery.session_token (without the __Secure- prefix over a non-secure connection) |
Keeping your authenticated session | Seven (7) rolling days, or until the browser is closed where you choose not to stay signed in |
__Secure-questovery.dont_remember |
Remembering the choice not to stay signed in | Until the browser is closed |
__Secure-questovery.state, __Secure-questovery.oauth_state |
Securing sign-in with a Google account | Five (5) minutes |
theme |
Remembering the light or dark display theme | Until the browser is closed |
sidebar_state |
Remembering whether the side menu is open | Seven (7) days |
The former qv_web_cache_release cookie is no longer created. If it remains in your browser, it is deleted when you load a page of the website.
2.2 Browser local storage
| Item | Purpose | Duration |
|---|---|---|
posthog-consent, analytics-consent-proof and choice state held by PostHog |
Remembering your choice regarding audience measurement and its proof: decision, version of the consent text and date | Until the website's data is cleared in your browser |
REACT_QUERY_OFFLINE_CACHE |
Caching data already loaded to speed up display; cleared when the account changes | Seven (7) days at most |
| Display preferences | Remembering the display mode chosen in dashboards and the editor | Until the website's data is cleared in your browser |
Licence cart (questovery:license-cart) |
Keeping the licences you add to the catalogue cart: identifiers of the offer and its publisher, the category, the tariff and, where applicable, the existing licence to renew or top up, currency and quantities, without prices or contact details. When you are signed in and start a payment, the cart also keeps that payment in progress (identifiers of the order, your account and your organization, ordered lines) so that it can be resumed without creating a duplicate | Cart lines: until they are ordered, removed from the cart or the website's data is cleared in your browser; lines concerning an existing licence are removed at sign-in and sign-out. Payment in progress: until the order is paid or abandoned, unpaid lines then returning to the cart |
Pending licence purchase (questovery:on-prem-operating-license-acquisition) |
Resuming, after you sign up or sign in, the licence purchase chosen before you were signed in: ordered lines, category, name of the organization to create, acceptance of the terms and time of the choice, operation identifiers | Until the payment page opens or until you choose "Abandon this attempt". After twenty-four (24) hours, the purchase is no longer resumed automatically: you are only offered to abandon it |
| Resumption keys for other payment flows | Resuming a payment in progress without creating a duplicate | Until the tab is closed |
| Reload keys after an update | Preventing a reload loop after a new version | Until the tab is closed |
These items are necessary for the website to operate or for the service you request, in particular keeping your cart and resuming your purchase; they are not subject to your consent and are not used for any audience measurement or advertising purpose.
2.3 Audience measurement and diagnostics
2.3.1 The website uses PostHog EU Cloud to measure its use and diagnose errors. On your first visit, a banner offers you the choice to accept or refuse audience measurement; both choices are presented in the same way. LEZO is the controller of this processing; PostHog acts as LEZO's processor. No location is derived from your device's IP address.
2.3.2 Before your choice, if you refuse and after you withdraw your agreement, no audience measurement is performed: the audience measurement tool is not loaded, no usage event is sent to PostHog and no audience measurement tracker is placed on your device. Only technical errors are sent to PostHog, through a separate diagnostic tool, without an account identifier, without a persistent identifier, without writing on your device and without geolocation, on the basis of LEZO's legitimate interest in ensuring the stability and security of the website.
2.3.3 If you accept, PostHog stores on your device a cookie and local storage data named ph_<project identifier>_posthog or beginning with ph_, which contain a persistent identifier and session information. Your usage events are then linked to your account identifier, your organization and its plan. Events linked to your account that LEZO's servers send to PostHog, in particular upon a purchase, are sent only if your latest recorded decision is an agreement. These trackers are kept for up to one (1) year. Recording of browsing sessions is not enabled. Enabling it would first require your separate and specific consent, collected separately from the acceptance of audience measurement.
2.4 Support chat
The Crisp support chat is loaded only when you click the chat button; no Crisp cookie is placed before that. Once loaded, it may place crisp-client/* cookies that ensure the continuity of your conversations with support, kept for up to six (6) months under the provider's default settings. When you are signed in, your email address and your organization's name are transmitted to it in order to identify your request.
2.5 Anti-bot check
The sign-up and sign-in forms use Cloudflare Turnstile to verify that the request does not come from a bot. On that occasion, Cloudflare collects technical information about your browser and receives your IP address, and may use its own cookies for this security purpose only.
2.6 Third-party resources
To display certain pages, your browser loads resources from third-party services, which receive your IP address and your browser's technical information on that occasion:
- the map backgrounds, loaded from the OpenStreetMap tile servers
- the payment pages, hosted by Stripe, which uses its own cookies under its policy
The website fonts are hosted by LEZO and are not loaded from any third-party service.
3. Mobile application
3.1 Storage on the device
The mobile application stores on your device the information required for it to operate:
- in the system's secure storage: your sign-in session, the local storage encryption key, your choice regarding audience measurement and any postponement of an optional update
- in the application's local storage, part of which is encrypted: the game and route tracking in progress, the language, a cache of loaded data kept for seven (7) days at most, the game log that allows playing offline, the upload queues for media and route points, your choices regarding route history and photos together with a random device identifier, the active organization and your preferences
- in the application's files: the media cache, copies awaiting upload and media sharing archives, deleted after they are shared
These items are necessary for the service you request and are not subject to your consent.
3.2 Software development kits
| SDK | Purpose | Consent |
|---|---|---|
| PostHog, diagnostics | Sending application errors and crashes, with an anonymous identifier kept in memory and renewed at each launch, without geolocation | Not required |
| PostHog, audience measurement | Measuring use of the application: screens, game events containing quest, team and step identifiers, device characteristics, account identifier and organization; without geolocation based on the IP address | Required: no audience measurement event is transmitted before your agreement or after your refusal or the withdrawal of your agreement, and your account identifier is transmitted to PostHog only after your agreement |
| Expo Updates | Checking for and installing application updates, with a technical identifier generated by the SDK | Not required |
| Cloudflare Turnstile | Anti-bot check at sign-up and sign-in | Not required |
| Apple Maps or Google Maps | Displaying maps | Not required |
| System age range | Limiting certain features where the operating system requires it or provides this indication; the age range stays on the device | Request handled by the system |
| App store review request | Offering to rate the application, through the system interface | Not required |
The mobile application uses no advertising identifier, no advertising tracker and no push notifications.
4. Managing your choices
4.1 On the website, your choice is requested through the banner described in article 2.3; refusing has no consequence on the use of the website. Consent can be given only after ticking the box “I am 15 or older, or a holder of parental authority consents with me”; refusing remains possible without ticking it. Your choice is kept in your browser and, when you are signed in, recorded by LEZO with the version of the consent text presented and, in the case of consent, the ticked confirmation, in order to keep evidence of it. You may change your choice or withdraw your agreement at any time through the “Manage cookies” link, available in the website footer and in your account menu, which displays the banner again. You may also write to [email protected].
4.2 In the mobile application, your agreement is requested after a first action, for example signing in, registering for a game or creating a quest. You may accept or refuse; refusing has no consequence on the use of the application. Consent can be given only after ticking the box “I am 15 or older, or a holder of parental authority consents with me”; otherwise, the choice counts as a refusal. If you close the request without choosing, it is presented to you again later. When you are signed in, your decision is recorded by LEZO with the version of the consent text presented. You may change your choice or withdraw your agreement at any time from the application settings.
4.3 You may also configure your browser to block or delete cookies, and manage the mobile application's permissions in your device settings. Blocking necessary cookies and storage may prevent sign-in or certain features.
5. Retention periods
The lifetimes of the cookies and items stored by the website are set out in article 2. Items stored by the mobile application are kept for the time required for their purpose; the application's local storage and files are deleted when it is uninstalled. Audience measurement data is kept for a target period of thirteen (13) months at most, and diagnostic data for a limited period defined by the diagnostic service's settings. Support conversations are kept for the time required to handle the request, then twenty-four (24) months after closure or the last exchange, unless there is a dispute or claim.
6. Contact
For any question about the use of cookies and trackers in Questovery, you may contact LEZO at [email protected].