Skip to content
Log in Sign up

Privacy

This notice explains what personal data we collect through the quizzes.gg website, the iPhone and iPad app and the Apple TV app, why we collect it, how long we keep it, and what rights you have over it. We collect what the service needs in order to function and nothing further. There is no analytics script and no analytics provider in any part of the service.

The service is funded by advertising, and where advertising is displayed it is provided by Google: Google AdSense on the website and Google AdMob in the iPhone and Apple TV apps. Google is an independent controller of the data it collects for that purpose. Where you are in the United Kingdom or the European Economic Area, you are asked for your consent before any advertising cookie or advertising identifier is used, in the manner described under Cookies below, and a refusal is honoured. A paid subscription removes advertising from every part of the service.

Last updated 13 September 2026.

Who is responsible for your data

The data controller is Quizzes.gg. The UK General Data Protection Regulation and the Data Protection Act 2018 govern our processing of your data.

Using the service without an account

You may use the service without creating an account. If you do, we do not learn your email address, and your scores are held against a random token on the device you used rather than against an identified person. Those scores do not transfer to another device.

What we collect

Your email address

If you create an account, we store the email address you register. We do not use passwords and none will be introduced, so the address is the account. It is used to send sign-in messages and for correspondence you initiate. We do not operate a mailing list and we do not send marketing.

Sign in with Apple

If you sign in with Apple, Apple gives us a stable identifier for your Apple Account and the email address you chose to share, which may be an Apple private relay address. We store both, and we treat the address as the account's email address. Apple's own privacy policy governs what Apple collects when you use Sign in with Apple.

Sign-in links and codes

Each sign-in message contains a link for use on the website and a six character code for use in the apps. The link's token is stored only as a SHA-256 hash, so the stored record can verify a link presented to it but cannot be used to reconstruct a working link. Both the link and the code expire after 15 minutes, both may be used once, and the record is deleted a day after it was created.

Session tokens

Signing in creates a session token. The token is issued to you once and we store only its SHA-256 hash, so a copy of our database contains no usable session. Sessions on the website last 30 days and sessions in the apps last 90 days, each extending while in use. We record the client type against each session so that you are able to distinguish your own sign-ins from one another.

Records of play

Each attempt records the quiz played, the answer selected for each question, whether that answer was correct, approximately how long it took, and the experience points awarded. These records are what your score, streak, achievements, activity feed and leaderboard positions are calculated from. Attempts made without an account are held against a random token rather than against a person.

Profile information

A display name, a handle and an avatar, where you have set them. The avatar is stored as a key such as avatar-07, referring to an image supplied with the app. Users cannot upload images.

IP addresses

Sending email carries a cost and unthrottled senders are blocklisted, so we record the IP address from which a sign-in request was made and count the requests received from it within the preceding hour. The address is stored alongside the sign-in record and is deleted with it a day later. We also record the IP address from which each quiz or puzzle is started, stored with the record of that play, so that scores submitted by a script rather than a person can be identified and removed. Rate limits on submitting answers are counted against a hashed key rather than a readable address.

Our web server maintains an access log, as web servers ordinarily do. It is used for diagnosing faults and identifying abuse. It is not used to build a profile of any user.

Subscriptions

If you subscribe, we store the fact of the subscription, the platform it was purchased on and the date it expires. Payment is processed by Apple. We do not receive or store card details.

Why we are allowed to process it

We rely on two lawful bases under Article 6 of the UK GDPR. Processing your email address, sign-in records, session tokens, profile and records of play is necessary to perform the contract between us, namely to provide the service you have asked for. Processing IP addresses for rate limiting, and retaining server access logs, is necessary for our legitimate interests in keeping the service secure, available and affordable to run.

Cookies

The website sets three cookies. All three are ours and all three are strictly necessary:

  • qgg_session keeps you signed in. It is marked HttpOnly, so that it cannot be read by any script, and Secure, so that it is never transmitted unencrypted.
  • qgg_csrf holds a random value used to confirm that a request changing your data was submitted from our own site.
  • qgg_guest holds a random value that counts how many quizzes and puzzles have been started without an account, so that the daily allowance on the free service can be applied. It is created only when you start one, it is stored here as a one-way hash rather than as the value itself, it is never joined to an account, and it is read for no other purpose. The apps carry the same value for the same reason.

We set no other cookies ourselves. There is no analytics cookie in any part of the service.

All three cookies above are strictly necessary for a service you have asked for, which is why they need no consent under regulation 6 of the Privacy and Electronic Communications Regulations. Advertising cookies are not strictly necessary, and neither are the device identifiers AdMob uses. Google therefore asks you, on our behalf and before any of them is used, through a consent management platform certified by Google and registered with the IAB Europe Transparency and Consent Framework. It records your answer, and a refusal is honoured: it means that you continue to see advertising, but that it is not personalised and that no advertising cookie or identifier is read from or written to your device for that purpose. You can change your answer at any time through the Privacy options link that the same platform places on the page.

Who else processes your data

Three processors act on our behalf, each for a defined purpose:

  • SMTP2GO delivers our sign-in messages, and therefore processes your email address and the contents of those messages.
  • Cloudflare provides content delivery and protection in front of the site, and therefore processes requests made to it.
  • Stripe takes payment for subscriptions bought on the website, and therefore processes your email address and your payment details. Your card details are given to Stripe and never reach us. Apple takes payment for subscriptions bought in the apps and tells us only that a purchase exists.

Google is not a processor for us. Where advertising is displayed, Google decides for itself what it collects and why, and is an independent controller of it. Its own privacy notice governs that data, and the consent described under Cookies is what permits it.

There are no others. We do not sell personal data and we use no analytics provider. Our fonts are served from our own server rather than from a font network, so that loading a page does not disclose your visit to a third party.

How long we keep it

  • Sign-in links and codes: deleted a day after creation.
  • Apple TV pairing codes: expire after 10 minutes, deleted a day later.
  • Sessions: deleted on expiry.
  • Rate limit counters: deleted at the end of their window.
  • Abandoned attempts made without an account: deleted after a day.
  • Abandoned attempts made on an account: deleted after a week.
  • Completed attempts, experience points and achievements: retained for the life of the account, being the record the account consists of.

Deletion is carried out by a nightly scheduled task.

Your rights

Under the UK GDPR you have the right to be told what personal data we hold about you and to receive a copy of it, to have inaccurate data corrected, to have your data erased, to restrict or object to our processing of it, and to receive it in a portable form. Requests should be sent to [email protected] from the address registered to the account. We will respond within one month. There is no charge.

If you are not satisfied with how we have handled a request, you may complain to the Information Commissioner's Office, whose details are at ico.org.uk. We would ask that you raise the matter with us first.

Deleting your account

Email [email protected] from the address registered to the account and we will delete it. Deletion removes the account record and, by database cascade, every session, attempt, answer, achievement, activity record and subscription record associated with it, leaving nothing orphaned. Deletion cannot be reversed. If you would like a copy of your data beforehand, ask in the same message.

Children

An account requires the user to be 13 or over. Younger users may use the service without an account, which requires no email address and creates no record identifying them. We do not profile users ourselves and we do not knowingly direct the service at children. A parent or guardian who wishes an account to be removed should write to the address above.

International transfers

Our server is located in the United Kingdom. Our processors may handle data outside the United Kingdom in the course of delivering email and routing requests. Where that occurs, the transfer is covered by the standard contractual clauses or an equivalent safeguard permitted under the UK GDPR.

Changes to this notice

We may amend this notice. The amended version will be published on this page and the date at the top updated. Where a change is material, such as the addition of a processor or a new category of data collected, we will state that change on this page.

Contact

Enquiries about this notice, or about the personal data we hold, should be sent to [email protected]. Our terms of use govern your use of the service.