Privacy Policy

Last updated: 16 July 2026

1. Data controller

The controller of the personal data collected through Quizendo is:

2. Data we collect

• Account: your username; your email address (optional); your password (stored hashed, never in clear text); an avatar (optional).
• Sign in with Google (optional): if you use "Sign in with Google", we receive your Google identifier, your email address, your name and your profile picture.
• Guest identity: if you play without an account, a random technical identifier is stored in your session to remember your progress on this device — with no registration and no email address.
• Game data: quizzes played, answers, scores, experience points (XP), level, streaks, achievements and leaderboard positions.
• Social sharing: when you share a result, a public image containing your username and score is generated.
• Technical and security data: to prevent abuse (rate limiting the number of attempts), your IP address is used but never kept in clear text: only an ephemeral cryptographic digest (HMAC) is stored temporarily.
• Audience measurement: we use Umami, a self-hosted, privacy-friendly analytics solution, without cookies and without individual profiling (aggregated data such as page views, traffic source and device type).

3. Purposes and legal bases

• Providing the game, your account and your progress — performance of the contract (Art. 6(1)(b) GDPR); for guest mode, our legitimate interest in running the game without registration.
• Leaderboards and result sharing — performance of the contract and, for sharing, your voluntary action.
• Sign in with Google — your consent and performance of the contract.
• Security and abuse prevention (rate limiting) — our legitimate interest.
• Audience measurement (Umami, cookieless) — our legitimate interest in understanding how the Service is used.

4. Cookies and trackers

Quizendo only uses cookies strictly necessary for its operation; no consent banner is therefore required.

• quizendo — session cookie (authentication and guest identity). Lifetime: 1 year. Attributes: HttpOnly, Secure, SameSite=Lax.
• Security cookie (CSRF) — protects forms against request forgery.

We use no advertising cookies and no third-party trackers. Audience measurement (Umami) works without cookies.

5. Recipients and processors

Your data is never sold. It may be processed by service providers acting on our behalf:

• Hetzner GmbH (Germany, European Union) — hosting of servers and databases.
• Cloudflare, Inc. — content delivery network (CDN), security and encryption (TLS), bot protection, and image storage (Cloudflare R2).
• Google — only if you use "Sign in with Google" (authentication).
• OpenAI — used to help create quiz content; this provider does not receive your personal player data.

6. Transfers outside the European Union

Primary hosting is located in the European Union (Germany). Some providers (Cloudflare, Google, OpenAI) may process data in the United States. Such transfers are framed by appropriate safeguards, such as the European Commission's standard contractual clauses and/or the EU-US Data Privacy Framework.

7. Retention periods

• Registered account: kept for as long as the account is active, then deleted at your request.
• Guest identity: automatically deleted after 180 days of inactivity.
• IP address digests (security): ephemeral, automatically deleted after a short period.
• Shared result cards: kept for as long as the share link exists.
• Audience statistics (Umami): kept in aggregated form.

8. Your rights

In accordance with the GDPR, you have the rights of access, rectification, erasure, restriction, portability and objection, as well as the right to withdraw your consent at any time. You can also delete your account directly from the app.

To exercise these rights: [email protected]. You may also lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr).

9. Security

We implement reasonable measures to protect your data: hashed passwords, hashed IP addresses, encryption of traffic (HTTPS) and restricted access. As no system is infallible, we cannot, however, guarantee absolute security.

10. Minors

Quizendo is intended for people aged 15 or over. Minors under the age of 15 must obtain the consent of a holder of parental authority before using the Service.

11. Changes

We may update this policy. Any change will be published on this page, whose update date will be refreshed.

12. Contact us

Privacy and GDPR: [email protected]
Publisher: Click&Mortar — [email protected]