Oikia Quest

Privacy Policy

Effective / last updated: 1 November 2026

This policy describes how Oikia Quest, a private building administration web application operated by Konstantinos Magarisiotis, processes personal information in connection with Google sign-in and the management of buildings, apartments and their members. For privacy questions or requests, email lootgaragehome@gmail.com.

1. Information we collect

• Google sign-in and account data: when you choose Google sign-in, Google supplies a Google account identifier, verified email address and basic profile details such as your name and profile image, which may be retained in Supabase Auth. We also process an internal user ID, sign-in provider, authentication state and session data.
• Building information: a building's name and optional address, apartment names and floor labels, optional area measurements, gas allocation weights and common expense coefficients, and the building creator's account ID.
• Membership and invitations: member IDs, resident/administrator roles, apartment associations (such as owner, tenant or resident), invited email addresses, invitation status, and creation and acceptance timestamps.
• Support correspondence: anything you voluntarily send when contacting the operator.
• Technical information: service providers may process IP addresses, browser/device characteristics and security/request logs to deliver and protect the service.

2. How we use information

We use Google account data only to sign you in, identify your verified email and link you to the buildings and invitations you are authorized to access. We use building and membership information to provide apartment setup, building administration, invitation acceptance and role-based access. Technical information supports security, debugging and reliable service delivery. The current release does not read or request your Gmail messages, Google Drive files, Google Contacts or Google Calendar data.

3. Who can access the information

Building administrators may view and manage their building's apartments, memberships, roles and invitations. An invited person must sign in with the matching verified Google email to accept an invitation. Residents are limited to the building and apartment records for which they have authorization. The application operator and authorized service providers may process the data where necessary for hosting, security, maintenance, support or legal compliance. Data is not publicly listed for unauthenticated visitors.

4. Sharing and service providers

We use Google for optional account authentication, Supabase for authentication and database services, and Cloudflare for hosting and delivery. We may use an email provider to deliver account authentication messages. Oikia Quest currently stores invitation records but does not automatically email building invitations; this feature is planned. If support is contacted by email, the correspondence is processed by the email provider. The Supabase database is hosted in the EU (Ireland), but not all service-provider processing or support activity is necessarily restricted to the EU.

We do not sell personal information, use Google account information for targeted advertising or use it for unrelated marketing. We do not request access to Google account services beyond basic sign-in identity information.

5. Browser storage and security

Supabase Auth stores session information in your browser so you can remain signed in. The service worker stores a generic offline page and supporting assets, not building records, private API responses, meter readings or authentication tokens. We use role-based authorization and database row-level security to restrict access to building information. No system can guarantee absolute security; protect your Google account and sign out on shared devices.

6. Retention and deletion

Account and building records are retained while they are necessary for the operation and administration of the building, for legitimate support or security purposes, and where applicable legal obligations require retention. Administrators can update building information and member assignments. The initial application does not yet offer a self-service account deletion page. For access, correction, export, objection or deletion requests, contact lootgaragehome@gmail.com or your building administrator. Requests affecting shared building records may require the building administrator's involvement. Removal of building access does not necessarily erase shared records or the underlying Supabase identity, which may also be used in other Loot Garage applications.

Service-provider backups and security logs may retain some information temporarily under their respective retention policies. Data already copied by authorized members cannot be automatically recalled.

7. Your choices and rights

You may choose not to sign in, in which case you can view only public pages. If you are a building member, you can request information about personal data held about you, correction of inaccurate details, restriction or deletion where applicable, or assistance with another privacy right under applicable law, including GDPR where relevant. You can also withdraw Google account access in your Google Account settings; this does not by itself delete building records. Requests can be sent to the contact address above.

8. Changes to this policy

We will update this page if Oikia Quest adds material new processing activities, such as gas readings, invoice records, email invitation delivery, maintenance or document storage. Any such activity must be reflected in this policy before the feature is made available to residents. The latest version and its date will appear on this page.