Last updated: July 2, 2026
Quizia ("we," "our," or "us") is a real-time multiplayer quiz game available on mobile devices. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use the Quizia application ("the App").
By creating an account or using the App, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the App.
Developer: Luan Bajrami
Contact: luanbajrami68@gmail.com
| Data Type | Details | Required? |
|---|---|---|
| Email address | Used for account creation and authentication. Provided by you directly, or by Google/Apple when you choose social sign-in. Stored in a private area of our database readable only by you (and us). Not collected if you sign in as a guest. | No |
| Password | Hashed by Firebase Authentication; never stored in plain text; never visible to us. Not collected for guest accounts or Google/Apple sign-in. | No |
| Username | 3–16 characters, publicly visible on leaderboards and in matches. Auto-generated for guest accounts. | Yes (auto-generated for guests) |
| Display name | Publicly visible to other players. Auto-generated for guest accounts; pre-filled from your Google/Apple profile name if you use social sign-in (you can change it). | Yes (auto-generated for guests) |
| Country | ISO country code, manually selected by you (not determined by IP or GPS) | No |
| Avatar | Selected from pre-made options within the App | No |
Sign in with Google / Apple: if you choose one-tap sign-in, Google or Apple shares your account email address and name with us to create or access your account. We do not receive your Google/Apple password, contacts, or profile photo. Apple's "Hide My Email" relay addresses are fully supported. We store only the email and the display name you confirm during profile setup.
You may also sign in as a guest (anonymous authentication). Guest accounts do not require an email address or password but have limited functionality (no access to friends, challenges, or leaderboards).
Guest account conversion: you may later convert your guest account to a full account by linking an email address and password, or a Google or Apple account. When you do this, all your existing game data (match history, ratings, XP, achievements, coins) is preserved and transferred to your full account. No new account is created — your existing anonymous account is upgraded in place.
Important: signing out of a guest account is irreversible. Because guest accounts use anonymous authentication, there is no way to sign back in — so guest sign-out permanently deletes the account and its data through the same deletion process described in Section 10.
| Data Type | Details | Visibility |
|---|---|---|
| Match history | Game results, scores, accuracy, average answer time, timestamps | Visible to other players (on your profile) |
| ELO ratings | Competitive skill ratings per quiz topic, calculated server-side | Leaderboards (public) |
| Statistics | Win/loss/draw records, accuracy, XP, level, achievements | Visible to other players (on your profile) |
| Topic progress | Per-topic XP, level, games played, and performance stats | Visible to other players (on your profile) |
| Coins & cosmetics | In-game currency balance ("Owls"), earned rewards, and purchased cosmetic items (avatars, frames) | Equipped cosmetics visible in matches |
| Online status | Whether you are online, in a match (and the topic being played), or offline — see Section 4.1. Can be turned off in Settings → Privacy → Show Online Status. | Friends (if enabled) |
| Social data | Friend list, pending friend requests, challenge invitations | You and your friends |
| Leaderboard entries | Display name, avatar, country, ELO rating, rank | Public |
Note: We do not keep your individual quiz answers. During and briefly after each match, a temporary processing record (the questions asked and each player's selected answers) exists on our servers so results, ratings, and statistics can be computed; these records are not visible to other players and are automatically deleted within roughly 24 hours of the match. Only aggregated statistics (accuracy percentage, average answer time) are retained long-term.
AI opponents: to ensure quick matches when no human opponent is immediately available, some matches may be played against AI-controlled bots that appear as regular players. Bots do not represent real users and do not generate or process personal data.
The third-party SDKs we use for core functionality and product analytics automatically collect certain technical data:
| SDK | Data Collected Automatically | Purpose |
|---|---|---|
| Firebase Authentication | IP address (retained a few weeks for security), user agent string, device metadata (OS version, device model) | Account security and fraud detection |
| Firebase Crashlytics | Crashlytics Installation UUID, IP address (at time of crash), stack traces, device model, OS version, RAM, app version | Crash reporting and bug fixes |
| Firebase Cloud Messaging | Firebase Installation ID, device push token, app version, device model, OS version, language, timezone | Delivering push notifications |
| Firebase Analytics (Google Analytics for Firebase) | Firebase Installation ID, app instance ID, your Firebase user ID (so we can measure retention per account), coarse country derived from IP at request time (IP is not stored), device model, OS version, app version, language, screen views, session start/end, and the in-app events we explicitly log (e.g., sign_up, login, tutorial_complete, game_started, game_completed, guest_converted, and shop/quest events such as shop_purchase or quest_completed — always with item/topic identifiers, never personal data). We also set two user properties: whether the account is a guest or registered, and the account's in-game level. | Measuring installs, daily/monthly active users, retention cohorts (D1/D7/D30), and which parts of the game players use. Used solely to improve the product. |
| Google Sign-In SDK (optional — only if you use "Sign in with Google") | Your Google account email and name, shared at your direction when you complete the Google sign-in prompt | Account creation and sign-in without a password |
| Sign in with Apple (optional — only if you use it, iOS) | Your Apple ID email (or a "Hide My Email" relay address) and name, shared at your direction on first authorization | Account creation and sign-in without a password |
This data is collected and processed by Google LLC as part of the Firebase platform. We do not have direct access to most of this data (e.g., IP addresses logged by Firebase Auth).
Firebase Analytics — what we do not do: we do not use Firebase Analytics for advertising, we have not linked our Analytics property to Google Ads or any ad network, we do not enable Google Signals or cross-device tracking, and we never log quiz answers, passwords, email addresses, display names, or chat messages as event parameters.
Opt out: you can turn off Firebase Analytics for your account at any time in the App via Settings → Privacy → Share Usage Data. When disabled, no further analytics events are sent from your device.
| Purpose | Data Used | Legal Basis (GDPR) |
|---|---|---|
| Account creation and authentication | Email, password, username | Contract performance |
| Matchmaking and gameplay | User ID, display name, avatar, country, level | Contract performance |
| Scoring, ratings, and leaderboards | Match results, ELO calculations | Contract performance |
| Friend system and challenges | Friend list, challenge invitations | Contract performance |
| Push notifications — social (friend requests, challenges) | Device push token | Consent (opt-in after first game) |
| Push notifications — reminders (streak at risk, new daily challenge; max one per day) | Device push token, streak/daily-activity status | Legitimate interest — you can turn these off at any time via Settings → Notifications → Streak & Daily Reminders, or by revoking notification permission in your device settings |
| Crash reporting and bug fixes | Crash data, device info | Legitimate interest |
| Product analytics (installs, retention cohorts, feature usage) | Firebase Installation ID, app instance ID, user ID, device/OS/app version, coarse country, screen views, in-app events listed in section 2.3 | Legitimate interest — measuring and improving the App. You may opt out at any time via Settings → Privacy → Share Usage Data. |
| Abuse prevention and user reports | Report content, user IDs | Legitimate interest |
We do not sell, rent, or share your personal data with third parties for marketing or advertising purposes.
Certain data is publicly visible to other Quizia users as part of the game experience:
Your email address and push notification tokens are never visible to other players. You can turn off online status sharing at any time via Settings → Privacy → Show Online Status.
We use the following services to operate the App:
| Service | Purpose | Data Processing Location |
|---|---|---|
| Firebase Authentication (Google LLC) | Account creation and sign-in | United States only |
| Cloud Firestore (Google LLC) | Database for all user and game data | EU (europe-west3, Belgium) |
| Firebase Realtime Database (Google LLC) | Live online status (online / in a match / offline) | EU (europe-west1, Belgium) |
| Cloud Functions (Google LLC) | Server-side game logic and data processing | EU (europe-west1, Belgium) |
| Railway Corporation | Hosting for our real-time game server (matchmaking and live matches). During a match it processes your user ID, display name, avatar, country, level, and the answers you select; its operational logs may briefly include display names and user IDs for debugging. | EU (Amsterdam, Netherlands) |
| Firebase Crashlytics (Google LLC) | Crash reporting | Google global infrastructure |
| Firebase Analytics (Google Analytics for Firebase, Google LLC) | Product analytics — installs, retention, feature usage | Google global infrastructure (United States) |
| Firebase Cloud Messaging (Google LLC) | Push notifications | Google global infrastructure |
| Firebase Hosting (Google LLC) | Hosting this website | Google global CDN |
| Google Cloud Logging (Google LLC) | Diagnostic logs from Cloud Functions execution (errors, request metadata) for debugging and abuse prevention. Logs do not contain quiz answers, passwords, or email addresses. | EU (europe-west1, Belgium) |
Google's privacy policy: policies.google.com/privacy
Google's data processing terms: firebase.google.com/terms/data-processing-terms
Railway's privacy policy: railway.com/legal/privacy
We do not share your data with any third parties other than the infrastructure service providers listed above, who process it solely on our behalf to run the game. We do not use advertising SDKs or social media SDKs, and we never sell your data. The only analytics service we use is Firebase Analytics, as described above, and you may disable it at any time.
| Data Category | Retention Period | After Account Deletion |
|---|---|---|
| Account data (email, username, profile) | While your account is active | Permanently deleted immediately (typically within seconds) |
| Game statistics (ratings, XP, achievements, coins, cosmetics) | While your account is active | Permanently deleted immediately (typically within seconds) |
| Friend list and social connections | While your account is active | Permanently deleted; removed from friends' lists (a daily server sweep acts as a safety net) |
| Leaderboard entries | While your account is active | Permanently deleted immediately (a daily server sweep acts as a safety net) |
| Username reservation | While your account is active | Freed immediately; may be claimed by another user |
| Online status (Realtime Database) | While your account is active; switches to "offline" within seconds of closing the App | Deleted with your account |
| Match processing records (questions asked + selected answers) | Deleted automatically ~24 hours after the match (records from failed processing are kept up to 30 days for debugging) | Purged on the same schedule |
| Match history (your records) | While your account is active | Permanently deleted with your account |
| Match history (in opponents' records) | Indefinite | Anonymized: your name and avatar are replaced with "Deleted Player." Game data (scores, topic, date) is preserved for the other player's history. No personally identifiable information is retained. |
| User reports (abuse reports) | While relevant for moderation | Reports about you are deleted; reports you filed are anonymized (your user ID is removed) |
| Push notification tokens | Until you uninstall or delete your account | Deleted with your account |
| Crash reports (Crashlytics) | 90 days (managed by Google) | Automatically purged by Google after 90 days |
| Firebase Analytics events | Event-level data: 2 months (Google default). User-level data tied to your Firebase user ID: 14 months (Google default, the maximum allowed for the standard tier). | The analytics identifier on your device is reset when you delete your account, so future events cannot be linked to it. User-level data already collected expires within Google's retention window (at most 14 months). Aggregate, non-identifying statistics may remain. |
| IP address logs (Firebase Auth) | A few weeks (managed by Google) | Automatically purged by Google |
| Local cache (on your device) | 1–24 hours (auto-expires) | Cleared when you uninstall the App |
| Guest account data | While the guest session is active | Deleted on sign-out. Signing out of a guest (anonymous) account permanently deletes the account and its data through the same deletion process as a full account. We recommend converting to a full account to preserve your progress. |
We implement the following measures to protect your data:
While we implement industry-standard security measures, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.
Regardless of your location, you have the following rights regarding your personal data:
How to exercise your rights:
We will respond to all data requests within 30 days.
If you are located in the European Economic Area (EEA), the following applies:
We do not currently meet the California Consumer Privacy Act (CCPA) applicability thresholds. However, we are committed to honoring data access and deletion requests from all users regardless of location. California residents may contact us at luanbajrami68@gmail.com to exercise their rights.
We do not sell personal information. We do not share personal information for cross-context behavioral advertising.
Quizia is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13.
If you are a parent or guardian and believe your child has created a Quizia account, please contact us at luanbajrami68@gmail.com. We will promptly delete the account and all associated data.
You may delete your account at any time. When you request account deletion:
Guest accounts: signing out of a guest account triggers this same deletion process — see Section 2.1.
Account deletion is irreversible. You would need to create a new account to use Quizia again.
For instructions, visit our Account Deletion page.
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. For significant changes that affect how we process your data, we may provide additional notice through the App.
Your continued use of the App after changes are posted constitutes acceptance of the updated policy. We encourage you to review this page periodically.
If you have questions about this Privacy Policy, your data, or wish to exercise any of your rights, contact us at:
Developer: Luan Bajrami
Email: luanbajrami68@gmail.com
We aim to respond to all inquiries within 30 days.