Privacy Policy

This policy explains what personal data Quiztador collects, why, who we share it with, how long we keep it and what your rights are. It covers the Quiztador app for iOS and Android and the website www.quiztador.com (together, "Quiztador").

1. Who is responsible for your data

PiJa Media & Management AB, Org nr. 556460-3537, Kornhamnstorg 49, 111 27 Stockholm, Sweden ("we", "us") is the controller of the personal data described here.

Questions about privacy, or a request to use any of your rights: info@quiztador.com.

2. What we collect

Your account

• Email address, used to sign in with a one-time code. If you sign in with Apple or Google, we get the email address (and, if you allow it, the name) that service shares with us. With Sign in with Apple we also store a token Apple gives us, so that we can revoke your Apple sign-in when you delete your account.

• Username and your previous usernames (up to five, with dates), and any username change you request.

• Birth year – only the year, never the full date. We use it to decide whether a parent must approve your account and which kind of ads you may see (see section 6).

• Avatar – the character you build from the parts in the app. You never upload a photo of yourself.

• Your acceptance of our terms and this policy: which version you accepted and when, and, if a parent approved for you, the parent's email address.

When you play

• Games: who you play against, the categories you pick, every answer you give and how long it took, scores, wins, losses and rating (Elo).

• Solo mode: your runs, answers, lifelines used and scores.

• Chat messages you send in a game.

• Friends, friend requests and game invitations.

• Questions you write and your votes on other players' questions.

• Gold, purchases and rewards: your gold balance and a history of every change to it, items you own, premium status, and the receipts for purchases made in the App Store or Google Play (we do not get your card details), and rewards you earn by watching ads.

• Invitations: your personal invite code, and who invited you or whom you invited.

• Blocks and reports: players you block, and reports you make or that are made about you, including the reported chat message where relevant.

• Fair play: counters of how you answer (for example how fast and how often correctly), which we use to detect cheating automatically.

From your device

• Push token, if you allow notifications, so we can tell you when it is your turn, someone invited you, sent you a message or a friend request.

• App usage and technical data collected by Firebase Analytics, Crashlytics and Performance Monitoring: which screens you visit and what you do in the game (for example answering a question), crash reports, app performance, device model, operating system and app version, and an app-instance identifier. Firebase Analytics in Quiztador is built without access to your device's advertising identifier (IDFA).

• Diagnostics: only if you switch on "send diagnostics" in the app (it turns itself off after 30 days), we receive a log of what the app did together with your device type, operating system and app version, to help us find bugs.

• App integrity checks (Firebase App Check with Apple App Attest / Google Play Integrity), which confirm that requests come from the real Quiztador app.

• Ad data: see section 5.

• Invite links: on Android the app reads the Google Play install referrer once, so an invite link you followed before installing still works. On iOS the app only reads your clipboard when you tap to paste an invite code.

• IP address: when you ask for a sign-in code, we store your IP address for 10 minutes to stop abuse.

On the website

• When you use the contact form, we receive your name, email address and message by email. Your IP address is stored for one hour to prevent spam.

• The website uses Vercel Analytics, which counts visits without cookies and without identifying you.

• The daily question on the front page sets a cookie (questionAnswered) that remembers that you answered today's question. It expires at the end of the day.

• If you sign in on the website, your browser stores your email address locally while you finish signing in.

3. What other players can see

• Every signed-in player can see your username, avatar, rating, number of games played and won, your gold, your friends list, your statistics per category and against each opponent, and your place on the top lists (daily, rating, solo and question writers).

• Players in the same game see your answers in that game and your chat messages.

• Anyone with your invite link sees your username on the invite page.

• Questions you write are shown to other players once they are published.

Choose a username that does not reveal your real name if you prefer not to share it.

4. Why we use your data, and our legal basis

• To provide the game (your account, sign-in, games, solo mode, chat, friends, top lists, notifications, purchases and gold): this is necessary to fulfil our agreement with you (GDPR article 6(1)(b)).

• To keep Quiztador safe and fair (stopping abuse of sign-in, detecting cheating, App Check, handling reports, blocking and moderation, disabling accounts that break the rules): our legitimate interest in a safe and fair game (article 6(1)(f)).

• To fix and improve the app (Firebase Analytics, Crashlytics, Performance Monitoring, Vercel Analytics): our legitimate interest in a working, stable game. You can object at any time (see section 9).

• Diagnostics you switch on, personalised ads, tracking permission on iOS and push notifications: your consent (article 6(1)(a)), which you can withdraw at any time.

• Non-personalised ads, which pay for the free game: our legitimate interest.

• Parental approval for younger players: to meet the requirement that a parent consents on behalf of children (article 8).

• Purchase receipts: required by Swedish accounting law (article 6(1)(c)).

We do not sell your personal data.

5. Ads

Quiztador is free and is partly paid for by ads, shown through Unity LevelPlay (ironSource and Unity Ads). Premium players see no ads.

• To show ads, the ad network receives your Quiztador player id, information about your device (such as model, operating system, language and IP address) and how you interact with the ads. When you watch an ad for a reward, the ad network tells our server so we can give you the gold.

• Players who turn 18 or younger this year only ever get non-personalised ads, and the app never asks for tracking permission for them. For players who turn 13 or younger this year we also tell the ad network that the player is a child.

• Adults are asked once whether they want personalised ads. Only if you say yes does the ad network get to use your data to personalise ads, and on iOS the app then asks Apple's tracking permission. You can change your mind in your device settings (iOS: Settings > Privacy & Security > Tracking; Android: Settings > Google > Ads).

Unity's own privacy policy explains how it uses data: unity.com/legal/game-player-and-app-user-privacy-policy.

6. Children and parental approval

Anyone can play Quiztador, but younger players need a parent's approval first. When you create an account we ask for your birth year. If you turn 13 or younger this year, the app asks for a parent's email address and sends the parent an email with your username, an explanation, and a link to approve our terms and this policy on your behalf. The link is valid for 14 days. You cannot play until a parent has approved.

We store the parent's email address together with the approval. Requests that are never approved are deleted 30 days after they expire.

A parent who wants to see, change or delete a child's data can contact us at info@quiztador.com.

7. Who we share data with

We use these companies to run Quiztador. They process data on our behalf and only for the purposes above, unless stated otherwise.

• Google (Firebase) – sign-in, database, file storage, server functions, push notifications, Analytics, Crashlytics, Performance Monitoring and App Check. Our database and files are stored in the EU, and our server functions run in Belgium (europe-west1).

• Google (Gemini) – an AI service that helps us review questions (for example whether the answer is correct, the question a duplicate, and how hard it is) and suggest new ones. It receives the question and its answers and anonymous answer statistics, never your name, email or player id. Questions you write are reviewed this way.

• Apple and Google – sign in with Apple or Google, and purchases in the App Store and Google Play. We verify your receipts with them.

• Unity (LevelPlay, ironSource, Unity Ads) – ads, see section 5. For personalised ads Unity acts as an independent controller.

• Postmark (ActiveCampaign) – sends our emails: sign-in codes, parental approval, account deletion and replies to the contact form.

• Vercel – hosts the website and provides Vercel Analytics.

• Expo – delivers app updates to your device, which means it receives your IP address and basic device information.

Some of these companies are based in the United States or may process data there. Such transfers rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

We may also share data if the law requires it, for example with the police.

8. How long we keep your data

• Your account, games, chat and statistics: for as long as you have an account.

• Sign-in codes and the IP address logged with them: 10 minutes.

• Diagnostics: 30 days.

• Contact form IP address: 1 hour. The email itself is kept for as long as we need to handle your question.

• Parental approval requests that were never approved: deleted 30 days after the link expired.

• Purchase receipts: kept after you delete your account, for as long as Swedish accounting law requires.

• Reports about players: kept after an account is deleted, as moderation history.

Deleting your account

You can delete your account in the app (Options) or on the website (Profile). The deletion is carried out after 7 days; until then you can cancel it. We email you when you ask and when it is done. When your account is deleted:

• Your account, profile, email address, birth year, friends, gold history, consents, invitations, solo results and top-list entries are deleted, and your Apple sign-in (if you used it) is revoked.

• In games you played, your username is replaced with "DeletedUser#…" and your avatar is removed, so your opponents' game history still makes sense. The text of your chat messages is erased.

• Questions you wrote that are already published stay in the game, but no longer point to you.

• Purchase receipts and reports are kept as described above.

9. Your rights

Under the GDPR you have the right to:

• get a copy of the personal data we hold about you (access),

• have incorrect data corrected,

• have your data deleted (you can do this yourself, see section 8),

• restrict our use of your data,

• receive your data in a machine-readable format (portability),

• object to our use of your data based on legitimate interest, including analytics,

• withdraw a consent at any time, without affecting what we did before you withdrew it.

Email info@quiztador.com to use any of these rights. We answer within one month.

If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, www.imy.se) or the data protection authority where you live.

10. Security

Data is encrypted when it is sent and when it is stored. Only the staff who need it to run and moderate Quiztador can access personal data, and that access is protected by sign-in and access rules.

11. Changes to this policy

When we change this policy, we publish a new version here. If the change matters for how we use your data, the app asks you to accept the new version before you continue playing.