Privacy policy

1. Data controller

The data controller for the processing of personal data on this website is:

We are not required to appoint a data protection officer (DPO) under Article 37 GDPR.

2. What information do we collect?

When you use QuizBold, we may collect the following types of personal data:

• Account information: If you create an account, we store your name, email address and, where available, the profile picture from the social login provider (Google, Meta Platforms Inc. (Facebook) or Apple Inc.). If you use Apple’s Hide My Email feature, we only receive an anonymous relay address from Apple and not your real email address. If you create an account with email and password, we store the password only as a one-way hash, never the password itself.
• Game data: Your answers, scores, statistics and achievements in the game.
• Usage data (only with consent): Which pages and screens you visit and what you do in the games (for example that you start or finish a game), plus device type, browser or app version. If you are signed in, usage data is linked to your internal QuizBold user ID, never to your name or email address. We only collect it if you have given consent (see section 6). With your consent, when you are signed in, we also link a few events recorded by our servers to your user ID: Season Ticket purchases and cancellations, achievements you unlock, and your moves in online duels. Without consent the same events are recorded only as anonymous counts per day: without a user id, without the time of day and without which achievement or subscription it was, so they cannot be linked to you, not even by us.
• Technical information: Information about your device, browser and IP address for technical and security purposes. IP addresses are used solely for security and error logging in our own application data, and are deleted or anonymised within 30 days at the latest unless there is a specific security incident. IP addresses may also appear in technical logs held by our hosting and infrastructure providers (for example Vercel), which process that information as data processors in accordance with their own documented logging and deletion policies.
• Pseudonymised device identifier: A random identifier that tells your device apart from others when you play without signing in. On the website our server creates it and keeps it in a necessary cookie (qb_did, see section 6), and in the app it is created on your device. If your browser does not accept cookies, we derive it instead from the characteristics of your device and browser (for example the browser’s “user agent” and what are known as “client hints”). The identifier does not contain your IP address and cannot be attributed directly to you as an individual. It is used to keep track of your games in progress as a guest, to ensure fair play and to prevent abuse (for example multiple accounts), and is deleted when you delete your account. If you play without signing in, it is deleted no later than 90 days after you played.
• Push notifications in the app: If you turn on push notifications in the app, we store the token your phone’s operating system issues to the app, and whether the phone runs iOS or Android. We use it only to send the notifications you have turned on. If you sign out or turn the notifications off, we stop using it, and it is deleted together with your account.
• Cookies: We use cookies to improve your experience. See section 6 for more information.

3. Purposes of the processing

We process your personal data for the following purposes:

• To provide and improve our service
• To administer your user account
• To show your scores on leaderboards (your username and score may be visible to other users of the service, and your email address is never shown). Leaderboards are an integral part of the game experience and cannot be opted out of without deleting the account.
• To enable social features such as friend lists (when you use social features, your username and game-related data may be visible to the users you choose to interact with)
• To send in-app notifications about your achievements and activity (for example friend requests, daily highlights). These notifications are part of the service’s core functionality and are not sent by email or push without your consent.
• To analyse use of the service with PostHog (on the website and in the app) and Vercel Analytics (on the website), only with your consent
• To monitor and improve the stability of the service through error tracking (Sentry) under our legitimate interest
• To ensure fair play and prevent abuse through pseudonymised device identification under our legitimate interest

4. Legal basis

We process personal data on the following legal bases under the General Data Protection Regulation (GDPR):

• Consent (Article 6(1)(a)): For analysing how the website and the app are used, including analytics cookies on the website and equivalent storage on your device in the app, and linking a few events from our servers to your user ID (see section 2). You can withdraw your consent at any time.
• Performance of a contract (Article 6(1)(b)): To provide the service you asked for by creating an account, including recording your answers and statistics, showing scores on leaderboards, social features and in-app notifications. The use of necessary cookies to deliver the service also rests on this basis.
• Legitimate interests (Article 6(1)(f)): To improve our service, to protect against abuse (including pseudonymised device identification for anti-cheating), and to monitor the stability of the service through error tracking. Error tracking (Sentry) and device identification collect only technical information that cannot be attributed directly to an identifiable person.

5. Data retention

We retain your personal data for as long as you have an active account with us. If you delete your account, your personal data will be deleted within 30 days unless we are required by law to keep it longer.

Usage data (see section 2) is stored with PostHog. Usage data linked to your user id is deleted no later than 18 months after your latest activity. If you delete your account, or withdraw your consent while signed in, we ask PostHog to delete it together with the linked events, and we check that the deletion is complete within 30 days. Usage data from a device that is not signed in is linked only to a random id on that device, which is reset when you withdraw your consent, and is deleted when PostHog’s fixed retention period ends. As a record of your consent we keep each choice you make while signed in: yes or no, the time and the version of the text you saw. We delete that record 2 years after you withdraw your consent or delete your account.

Anonymised game data may be retained indefinitely for statistical purposes once it can no longer be attributed to an identifiable person.

You can delete your account yourself, both in the app and on the website. See the guide to deleting your data.

6. Cookies

We use cookies and (depending on the feature) similar technologies for the following purposes:

• Necessary cookies: To remember your login status and preferences (for example theme).
• Functional cookies: To save your game state and progress.
• Guest cookie (qb_did): A necessary cookie holding a random identifier that our server creates the first time you play without signing in. It ties your games in progress and your guess limits to your browser and nobody else’s, and lets you take your finished games with you when you sign in. It contains nothing about you or your device, is never used for analytics or advertising, and expires after one year.
• Analytics (only with consent): We use PostHog and Vercel Analytics to understand how the website is used, and PostHog to understand how the app is used. These tools are only activated once you have given your consent: on the website via the cookie banner, and in the app via the question it asks the first time you open it. No analytics cookies or data are collected before you have accepted, whether or not you are signed in.
• Your choice on your devices: Your answer is stored on the device you are using (in a necessary cookie on the website, or in the app’s local storage). If you are signed in, we also store it on your account together with the time of your choice and the version of the text you saw. A yes applies only on the device where you gave it: if you sign in on a new device, we ask you again. A no applies on every device where you are signed in, on the website and in the app alike, the next time they are opened. When you sign out, the device returns to the choice made on it, or asks again if none was made.
• The app’s measurement before 25 September 2026: Until 25 September 2026 the app collected usage data about signed-in users without consent, unless they switched it off on their profile. That was not valid consent, and this data has been deleted from PostHog. Since then the app measures only after a yes.

Necessary cookies are used to deliver the service and do not require consent.

You can change or withdraw your consent at any time via the switch on this page, the cookie banner, the switch on your profile on the website or in the app, or your browser settings. If you withdraw it, analytics stops at once on that device and, if you are signed in, on your other devices the next time they are opened. If you withdraw it while signed in, we also delete the usage data linked to your user id (see section 5). Analytics is only activated once you give your consent, and only on the device where you give it.

7. Security

We use appropriate technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration or misuse. This includes:

• Encryption of data in transit (HTTPS/TLS)
• Access control for databases and systems
• Regular security updates of our systems
• Use of secure authentication methods

8. Sharing of data

We share your personal data with the following categories of recipients:

Hosting providers may keep technical operational and security logs, which may contain IP addresses and which are retained in accordance with their documented log retention policies.

• Hosting providers: Our data is hosted on Supabase and Vercel, which process data in accordance with the GDPR and with whom we have entered into data processing agreements. To limit abuse (rate limiting) we use Upstash, which briefly stores counters tied to your IP address or user id and deletes them when the time window ends.
• Authentication providers: Google, Meta Platforms Inc. (Facebook) and Apple Inc., if you choose to sign in via those services.
• Email provider: Resend (Plus Five Five, Inc.), which sends the email notifications you have turned on yourself and therefore processes your email address. We do not use Resend for marketing.
• Payments on the website: If you buy Seasoncard on the website, the payment is handled by Stripe Payments Europe, Ltd. as our data processor. We give Stripe your email address and an internal QuizBold user id so the subscription can be linked to your account. Stripe itself receives the card and payment details you enter, which we never have access to.
• App stores, for purchases made in the app: If you buy Seasoncard in the QuizBold app, the payment is handled by Google (Google Play) or Apple (the App Store) under the terms of that store. The store itself receives your payment details, which we never have access to.
• Subscription management in the app: RevenueCat, Inc., which on our behalf keeps track of whether a subscription bought in a store is active. RevenueCat receives the subscription status, plan and period plus an internal QuizBold user id, not your name, your email address or your payment details.
• Push notifications: Expo (650 Industries, Inc.), which forwards push notifications from us to Apple (Apple Push Notification service) and Google (Firebase Cloud Messaging). Expo receives your phone’s push token and the text of the notification, not your email address.
• Analytics providers: PostHog (EU-hosted) and Vercel Analytics and Vercel Speed Insights, which process usage data (only with your consent). No analytics data is sent before you have given consent.
• Error tracking: Sentry (EU-hosted), which receives technical error information to help us identify and fix problems. Sentry does not collect personally identifiable information and runs under our legitimate interest in ensuring the stability of the service.

We never sell your personal data to third parties.

9. Transfers to third countries

Some of our data processors are located outside the EU/EEA (for example the USA). In those cases we ensure an adequate level of protection, typically through the European Commission’s standard contractual clauses or by using providers certified under the EU-US Data Privacy Framework.

10. Your rights

You have the following rights under the GDPR:

• Right of access: You can be told what information we process about you.
• Right to rectification: You can have inaccurate information corrected.
• Right to erasure: You can ask to have your information deleted.
• Right to restriction: You can ask us to restrict the processing of your information.
• Right to data portability: You can receive your information in a machine-readable format.
• Right to object: You can object to processing based on legitimate interests.
• Right to withdraw consent: You can withdraw a consent at any time.

To exercise your rights, please contact us at kontakt@quizbold.dk.

You can exercise the right to erasure straight away without contacting us: how to delete your data.

11. Complaints

If you are unhappy with our processing of your personal data, you have the right to lodge a complaint with:

12. Children and age limit

QuizBold is not directed at children under 13, and we do not knowingly collect personal data from children below that age. If you are a parent or guardian and become aware that your child has given us personal data, please contact us so we can delete it.

In Denmark the digital age of consent is 13.

13. Changes to this policy

We may update this privacy policy from time to time. In the event of material changes we will inform you by email or by a notice on our website. We recommend that you review this page regularly to stay up to date.

14. Contact

If you have questions about this privacy policy or our processing of your personal data, you are welcome to contact us: