quizzas!
How it plays Download

Privacy Policy

How quizzas! handles personal data in the app and on this website, and how to exercise your rights.

Last updated: September 23, 2026

1. Who is responsible

Fran Garcia Meseguer, operating as quizzas!, is the controller of the personal data described here. Postal address: Antonio Ripoll Javaloyes 5, Planta 5, Puerta B, 03202 Elche, Alicante, Spain.

Privacy and rights requests: privacy@quizzas.com. General enquiries: hi@quizzas.com. Our legal notice and terms also identify the service operator.

This policy covers the app, quizzas.com and communications with us. The applicable framework includes the EU General Data Protection Regulation (GDPR), Spain’s Organic Law 3/2018 (LOPDGDD) and Law 34/2002 (LSSI).

2. Data we receive and its sources

  • Account and sign-in. Email address, display name, internal player ID, friend code, account dates and sign-in records. Email registration sends your password securely to our server for hashing; we store a password hash, not the readable password. Google or Apple sign-in supplies a provider identifier and email address (which may be an Apple relay address). We do not receive your Google or Apple password.
  • Profile, play and social features. Avatar, owned and equipped items, answers and server receipt times, match results, XP, levels, rankings, streaks, friends, friend requests, blocks, room invitations and connection/presence information. These come from your actions and the game’s operation.
  • Purchases. Player and purchase-provider identifiers, store, product and transaction identifiers, purchase dates, verification/refund status and entitlements, received from the store and RevenueCat. We do not receive your full card details.
  • Support and moderation. Messages you send us, reports submitted by you or other players, reported account identifiers, reasons, optional notes and moderation decisions. Please do not include unnecessary sensitive information.
  • Technical and usage information. IP addresses seen by our servers and providers, app/device identifiers, device model, operating system, app version, language, network requests and errors, performance measurements, app interactions and crash diagnostics. Diagnostics can contain identifiers and contextual information.

3. Purposes and legal bases

  • Provide the service — contract (GDPR Article 6(1)(b)). Authenticate you, operate matches and social features you use, calculate progression and rankings, verify purchases, deliver entitlements and answer service requests. Account and gameplay information needed for these functions is required to play; purchases and social features are optional.
  • Security, fair play and reliability — legitimate interests (Article 6(1)(f)). Prevent fraud and abuse, investigate reports, protect accounts, diagnose faults and maintain a reliable service. These interests must be balanced against your rights, particularly for younger players. You may object as explained below.
  • Legal duties — legal obligation (Article 6(1)(c)). Keep records required by applicable tax/accounting rules, handle statutory consumer and privacy requests, and comply with binding legal requests. Establishing or defending legal claims can also be based on legitimate interests.
  • Consent where required (Article 6(1)(a)). Optional marketing or non-essential access to information on your device requires the applicable consent before it starts. Accepting terms or reading this policy is not consent to optional processing. Consent can be withdrawn without affecting earlier lawful processing.

4. What other players can see

Players can see your display name, avatar and equipped items, shared-match scores and public profile statistics, including levels and rankings. Accounts can be found through display-name search or a shared friend code. Accepted friends can see whether you are online.

Check your display name before playing. For Google or Apple sign-in, the initial name is derived from the part of your email address before @. Your full email address is not shown as a profile field, but that initial name may identify you. You can change it in your profile.

5. Providers and other recipients

We do not sell personal data or share it with advertising networks. Providers receive the data needed for their role:

  • Fly.io: application hosting and PostgreSQL database hosting, including account, gameplay and connection data.
  • Tigris: delivery of images and other game assets; asset requests expose connection information such as IP addresses.
  • RevenueCat: purchase validation and entitlement management using your Quizzas player ID, purchase information and SDK technical data.
  • New Relic: mobile and server diagnostics, performance monitoring and app interaction/usage events. Monitoring in configured app builds starts when the app starts; it is not limited to crash reports. App response-body capture and print-event capture are disabled.
  • Apple and Google: sign-in when selected and payment processing through their stores. They also act as independent controllers for their own account, store, fraud-prevention and legal purposes, under their privacy notices.
  • Website delivery and email providers: website request information and the messages needed to deliver support and privacy correspondence. Authorised personnel and professional advisers may access information needed for support, compliance or legal claims; competent authorities may receive it when lawfully required.

6. International processing

Providers may process information outside the European Economic Area, including in the United States. An EU hosting region alone does not exclude overseas support access or other international processing.

Transfers must meet GDPR Chapter V requirements, such as an applicable adequacy decision or the European Commission’s Standard Contractual Clauses with any necessary additional safeguards. Contact privacy@quizzas.com for information about the destinations and safeguards applicable to your data and a copy of relevant safeguards.

7. Retention and account deletion

  • Active account records: retained while your account exists to provide your profile, progression, history and social features. In-app deletion removes the account and its related records from the live game database, including sign-in identities, sessions, answers, progression, friendships and reports associated with it.
  • Purchase ledger: retained separately after account deletion, with the link to your player record removed. Store transaction identifiers remain and may still be traceable through the store or purchase provider; this is not a promise of irreversible anonymisation. Retention is governed by applicable accounting/tax duties and the time needed for refunds, chargebacks or legal claims.
  • Support, security logs and diagnostics: retention depends on the time needed to resolve the request, incident or dispute and the provider’s configured retention. Backup copies follow their separate retention cycle; deleting a live account does not instantly erase every backup or provider record.
  • Legal restrictions: where retention or blocking is legally required, only the necessary information should remain for the applicable limitation period, restricted to that purpose, and be deleted when the obligation ends.

Use Profile → Delete Account in the app or write to privacy@quizzas.com. The account-deletion page explains the process and its limits. You do not have to reinstall the app to request deletion.

Account deletion does not delete an Apple or Google account or their independent transaction records. Requests covering information held by our service providers require handling beyond the live database deletion.

8. Your rights and how to use them

Contact privacy@quizzas.com or the postal address above. Subject to the conditions in the GDPR, you can request:

  • access to your personal data and a copy of it;
  • correction of inaccurate data and erasure of data that no longer has a lawful reason to be kept;
  • restriction of processing in the circumstances provided by law;
  • portability of data you provided where automated processing is based on consent or a contract;
  • objection, based on your particular situation, to processing based on legitimate interests, and objection to direct marketing at any time;
  • withdrawal of consent where processing relies on it.

We respond without undue delay and within one month of receiving your request. If complexity or the number of requests requires up to two additional months, we will explain the extension within the first month. Requests are normally free; only the GDPR’s limited exceptions allow a reasonable fee or refusal.

We may ask for proportionate information to verify your identity if there is reasonable doubt. Do not send a copy of your identity document unless we explain why it is needed. If we cannot fulfil a request, we will explain why and how to challenge that decision.

You may complain directly to the Agencia Española de Protección de Datos (AEPD), including through its electronic office, or to the competent authority in your country of residence, work or the alleged infringement. Contacting us first is not a prerequisite.

9. Automated game functions

Matchmaking, scoring, levels and rankings are calculated automatically from game activity. These are game functions; we do not use them to make decisions with legal or similarly significant effects on you. Reports can be reviewed by a moderator. You may contact support to challenge a moderation decision.

10. Age requirements

The service is intended for people aged 14 or older. Players under 18 need a parent or guardian’s permission to enter the agreement and make purchases where required. A store’s content age rating is not permission to create an account below our minimum age.

Spain’s age threshold of 14 concerns a minor’s own consent to data processing; it does not automatically give full contractual capacity. If you believe an under-14 child is using the service, write to privacy@quizzas.com so we can investigate and address the account and data.

11. Website cookies and device storage

This static website does not set analytics or advertising cookies or use tracking pixels. Its language redirect reads your browser’s language preference. Fonts and artwork are served from this website rather than loading Google Fonts from a third-party server. The website delivery provider still receives technical request information, including your IP address.

The app is separate: it stores sign-in credentials securely and saves settings such as language and sound on your device. Purchase and monitoring SDKs also process device information. Necessary storage for a service you request is treated differently from optional analytics; any non-essential device access must meet the applicable consent requirements.

12. Security and policy updates

We use encrypted connections, password hashing and restricted access to protect data. No system is risk-free. Where a breach requires notification, we will notify the supervisory authority and affected people as required by the GDPR.

We will update the revision date when this policy changes and provide appropriate notice of material changes. A policy update does not itself authorise a new incompatible purpose or replace consent where consent is required.