Draft for review: this isn't in effect yet. The address is added before launch.
Privacy policy
Last updated: 8 October 2026
Quizzabit is a quiz game you play with friends. This policy explains what we collect when you use the app and the website, why, who helps us run them, and what you can do about it.
Who we are
Quizzabit is run by Alex Kotrotsios, an individual based in Greece, who is responsible for your data (the “controller” under the GDPR).
- Email: [email protected]
- Address: added before launch
What we collect, and why
Your account
- With an email address: your email and a password. We never see your password; it’s stored as a one-way hash.
- With Google: the email address, name and profile picture link Google shares with us. The game only uses the email.
- As a guest: a nickname and a random account ID, with no email.
- Your profile: your username or nickname, and the avatar you pick. Other players see these.
- Your settings: your language, whether you’ve shared usage data, and whether friends can see when you’re online.
- Your age: you confirm you’re at least 16, and whether you’re 18 or over. We don’t keep your date of birth.
We need these to run your account (the contract between us).
Games
- Lobbies and games: who played, when, the subject and settings, and each player’s score, place and number of right answers. You can see the games you played in.
- Chat: messages are only kept in the lobby’s memory while it’s open, and disappear when it closes. We only keep chat that’s part of a report (below).
- AI quizzes: when you make one, your topic, instructions and pasted notes go to Anthropic, whose Claude model writes the questions. If you only give a topic, we keep it, so the same quiz can be reused. We never keep instructions or pasted notes. We also keep a record of each AI quiz (when, how many questions, and what it cost) to apply the daily limit.
These are part of the game you asked for (contract).
Friends
- Friends and requests: who you’re friends with, and requests you send or receive, with at most 20 sent a day.
- Whether you’re around: when the app was last open, which lobby you’re in and whether you’re playing. Only your friends see it, and you can hide it in Settings → Privacy.
- Game invites: who invited whom to which lobby. Invites are deleted after 30 minutes.
- Push notifications: if you turn them on, a token for your phone, so we can tell you about game invites and friend requests. We send nothing else.
These run features you choose to use (contract). Push notifications are only sent if you allow them on your phone.
Keeping the game safe
- Reports: if someone reports a player, we keep the report, the reason, and the lobby’s last 20 chat messages, and email them to our support address. We keep reports for up to 12 months.
- Blocks: who you’ve blocked, so you don’t see each other’s messages and can’t be friends.
- Technical data: our servers see your IP address and keep short logs, to limit abuse (for example, too many attempts to join games) and to fix problems.
We do this because we have a legitimate interest in keeping players safe and the service working.
Usage data and crash reports
- Usage data: only if you agree, on first launch or in Settings. It shows us which features people use. You can change your mind at any time.
- Crash reports: when the app crashes, a report with personal details removed, so we can fix the problem (legitimate interest).
We don’t sell your data, and we don’t show ads.
Who helps us run Quizzabit
| Service | What it does | Where your data is |
|---|---|---|
| Supabase | Accounts and the database | Frankfurt, Germany (EU) |
| Fly.io | The game server | Frankfurt, Germany (EU) |
| Cloudflare | The website and our email forwarding | EU and worldwide network |
| Resend | Account emails, such as confirming your email | Sends from Ireland (EU); its account data is in the US |
| Anthropic | Writing AI quizzes | United States |
| Expo | Delivering push notifications | United States |
| Sign-in with Google, if you use it | Google’s own terms apply |
When data leaves the EU (Anthropic, Expo, and parts of Resend), it’s protected by the European Commission’s standard contractual clauses or the EU–US Data Privacy Framework. Anthropic deletes AI quiz requests within 30 days and doesn’t use them to train its models.
How long we keep it
- Your account: until you delete it. Guest accounts that aren’t used for 30 days are deleted.
- Reports: up to 12 months.
- Game invites: 30 minutes.
- Push tokens: until you sign out or turn notifications off.
- Chat: only while the lobby is open, unless it’s part of a report.
Your rights
You can:
- delete your account in the app (Settings → Account → Delete account), which deletes your profile, friends, settings and game records;
- ask for a copy of your data, or ask us to correct it, by emailing [email protected];
- object to what we do based on legitimate interest, or ask us to limit it;
- withdraw consent for usage data in Settings, and for notifications in Settings or your phone’s settings.
We answer within a month. If you’re unhappy with how we handle your data, you can complain to the Hellenic Data Protection Authority (www.dpa.gr) or to the authority where you live.
Age
Quizzabit is for people aged 16 and over. If you think someone younger has an account, tell us at [email protected] and we’ll delete it.
Changes
If we change this policy in a way that matters, we’ll tell you in the app before it applies. The date at the top shows when it last changed.