Privacy Notice

1. Who We Are

Q Crowd is a crowd-sourced theme park queue and crowd intelligence service.

The controller or responsible business for personal data is:

Mr M K Butler, trading as Q Crowd
Contact: hello@qcrowd.app
Privacy contact: privacy@qcrowd.app
Registered address: Cherry Tree Cottage, Woodham, New Haw, KT15 3TU, United Kingdom

If we appoint a UK representative, EU representative, Data Protection Officer, or privacy agent, we will list those details here.

2. What This Notice Covers

This Privacy Notice explains how we collect, use, store, share, and protect personal data when you use the Q Crowd app, website, APIs, emails, live activities, notifications, support channels, or related services.

It should be read with the Q Crowd Terms and Conditions.

3. Summary

Q Crowd uses data to:

• create and secure your account;
• verify your email and help reset your password;
• detect whether you appear to be in a park, near a ride, in a queue, on a ride, or leaving an area;
• let you submit queue, ride, and crowd reports;
• build Q Crowd queue and crowd estimates;
• show third-party posted wait times separately from Q Crowd estimates;
• send service emails, prompts, live activity updates, and operational messages;
• diagnose faults, prevent abuse, and improve the service.

We do not sell personal data. We do not publish your raw location trail to ordinary users. We do not use raw account-level location trails for targeted advertising.

4. Personal Data We Collect

Account Data

We collect account information such as email address, nickname, account creation time, password hash, authentication token records, email verification status, and password-reset or email-verification token records. Verification and reset tokens should be stored hashed, not in plain text.

Park Visit And Queue Data

We collect information about park visits, selected parks, selected rides, queue lane, party size or party composition counts, queue start time, boarding time, ride completion time, queue exit time, queue outcome, report source, correction choices, and related timestamps.

Party composition is intended to count group size only. Do not enter names or identifying details about children or other party members.

Location Data

When location features are enabled, we may collect latitude, longitude, accuracy, timestamp, acquisition source, location permission status, park visit link, queue session link, ride or queue trace purpose, trace sequence, and diagnostic context. We may also record failed or missed location callbacks so we can understand gaps in background tracking.

Some location data may be collected while the app is in the background or the phone is locked if you have enabled the relevant device permissions and an active park/queue session is running.

You can control location permissions in your device settings. Turning location off may prevent park validation, queue validation, assist prompts, live activity accuracy, and some reports from working.

Queue And Ride Breadcrumbs

During active queue or ride sessions, Q Crowd may collect periodic breadcrumb points to understand how queue lines, ride paths, and exit areas work. These points may be grouped into learned trace sessions for review and future detection. Reviewed traces should not be shown to ordinary users with account identifiers.

Device, App, And Diagnostic Data

We collect technical data such as app version, platform, device type, environment, client session identifiers, request timestamps, API responses, diagnostic events, sync/outbox status, crash or error context if available, and basic server logs such as IP address and user agent.

Communications Data

We collect information needed to send account verification, password reset, and service emails. We may store email delivery attempts, provider status, response metadata, retry-after values, and redacted diagnostic details. We should not store raw verification or reset tokens in logs.

Third-Party Posted Wait Data

Third-party posted wait times and operating statuses are not usually personal data by themselves. If they are connected to your queue session, we may store the posted wait shown at the time you joined, boarded, exited, or cancelled so we can compare it with your observed wait.

5. How We Use Personal Data

We use personal data to:

• provide and maintain Q Crowd;
• create, authenticate, and secure accounts;
• verify email addresses and process password resets;
• validate park visits, queue entries, ride phases, and crowd reports;
• generate Q Crowd estimates, confidence indicators, freshness indicators, and summaries;
• prompt you to confirm or correct likely queue/ride events;
• provide live activity, lock-screen, watch, notification, or app-state updates;
• detect stale, inaccurate, duplicate, abusive, or fraudulent signals;
• debug crashes, sync failures, location gaps, and network issues;
• monitor service health, costs, rate limits, and security;
• comply with legal obligations and enforce our Terms.

6. Legal Bases For UK And EEA Users

Where UK GDPR or EU GDPR applies, our legal bases may include:

• Contract: to provide the Q Crowd service you request, including account, queue, ride, and park-session features.
• Consent: for device permission access such as location permissions, push notifications, or similar device-controlled permissions where required. You can withdraw device permission through your device settings.
• Legitimate interests: to secure the service, prevent abuse, maintain quality, debug issues, improve estimates, and understand aggregated service performance, balanced against your privacy rights.
• Legal obligation: where we must keep or disclose information to comply with law.

We do not use Q Crowd prompts or estimates to make decisions that produce legal or similarly significant effects about you.

7. Children And Young People

Q Crowd is not directed at children under 13. If you are under 16, or if local law requires parent or guardian consent, you should use Q Crowd only with permission and supervision from a parent or legal guardian.

We do not knowingly collect personal data from children under 13 in the United States. If we learn that we have collected personal data from a child under 13 without required consent, we will take reasonable steps to delete it.

Because theme park apps may be accessed by young people, Q Crowd should use high-privacy defaults, clear language, data minimisation, and separate just-in-time notices for location features.

8. Sharing Personal Data

We may share personal data with:

• cloud hosting, database, monitoring, and infrastructure providers;
• email providers such as Azure Communication Services;
• app stores, operating systems, push notification, live activity, or device platform providers where needed to deliver app features;
• analytics, diagnostics, security, or support providers if used;
• professional advisers, insurers, auditors, or legal authorities where necessary;
• another organisation if Q Crowd is involved in a merger, acquisition, financing, reorganisation, or sale, subject to appropriate safeguards.

We may share aggregated or de-identified information about queue trends, ride signals, service performance, or crowd patterns where the information does not reasonably identify you.

We do not sell personal data. We do not share personal data for cross-context behavioural advertising unless this Privacy Notice is updated and any legally required choices are provided.

9. International Transfers

Q Crowd may process data in countries other than where you live. If UK or EEA data is transferred internationally, we will use appropriate safeguards where required, such as adequacy decisions, approved contractual clauses, or other lawful transfer mechanisms.

10. Retention

We keep personal data only for as long as reasonably needed for the purposes described in this Notice, unless a longer period is required by law.

Current intended retention patterns:

• raw location observations: normally limited, currently intended around 30 days unless needed for diagnostics, security, legal, or reviewed learned-trace purposes;
• journey, diagnostic, and live-action records: normally limited, currently intended around 90 days unless needed for diagnostics, security, or legal purposes;
• queue, ride, and park-session records: kept while useful for your account, service integrity, reporting, and aggregated estimates;
• email verification and password reset tokens: short-lived and stored hashed; delivery/audit records may be kept for security, deliverability, throttling, and abuse prevention;
• learned trace sessions: may be kept longer if reviewed and needed to improve queue/ride detection, with access restricted and public exposure removed.

11. Your Choices

You can:

• choose whether to create an account;
• choose whether to enable location permissions, background location, notifications, live activities, or similar device features;
• correct or dismiss prompts where Q Crowd detects a possible queue or ride event;
• stop using Q Crowd at any time;
• request access, correction, deletion, restriction, portability, objection, or withdrawal of consent where applicable.

If you withdraw location permission, Q Crowd may retain previously collected data where we have another lawful basis to keep it, such as security, integrity, legal compliance, or aggregated service improvement.

12. UK And EEA Rights

Depending on where you live, you may have rights to:

• access your personal data;
• correct inaccurate data;
• delete personal data;
• restrict processing;
• object to processing based on legitimate interests;
• receive a portable copy of certain data;
• withdraw consent where processing is based on consent;
• complain to a data protection authority.

UK users can contact the Information Commissioner's Office. EEA users can contact their local supervisory authority.

13. United States Privacy Rights

Depending on your state, you may have rights to know, access, correct, delete, or receive a copy of personal information, and to opt out of sale, sharing, targeted advertising, or certain profiling.

Q Crowd does not currently sell personal data or share it for cross-context behavioural advertising. If this changes, we will update this Notice and provide required choices.

To exercise privacy rights, contact privacy@qcrowd.app. We may need to verify your request before acting on it. If your request is denied, you may have a right to appeal depending on your state.

14. Security

We use reasonable technical and organisational measures to protect personal data. No system is perfectly secure. You are responsible for keeping your account credentials and device secure.

15. Automated Prompts And Estimates

Q Crowd may infer that you are near a ride, in a queue, on a ride, or leaving an area based on location and timing data. These inferences are used to show prompts, improve estimates, and protect signal quality. You can confirm, correct, or dismiss prompts.

16. Third-Party Links And Services

Q Crowd may use or link to third-party services. Their privacy practices are governed by their own notices. Q Crowd is not responsible for third-party privacy practices.

17. Changes To This Notice

We may update this Privacy Notice. If changes are material, we will take reasonable steps to notify you, such as showing the updated notice in the app or requiring renewed acknowledgement.

18. Contact

Privacy questions and requests: privacy@qcrowd.app

General contact: hello@qcrowd.app