Effective: September 13, 2026
Version 2.0 — replaces the version of July 2, 2026 (see the change log at the end)
Quizia ("we," "our," or "us") is a real-time multiplayer quiz game available on mobile devices. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use the Quizia application ("the App") and this website.
We are the data controller for that data:
Developer: Luan Bajrami
Postal address: Zajas bb, Kicevo, Republic of North Macedonia
Email: support@playquizia.com
Before you can play, the App shows you this policy and the Terms of Service and asks you to confirm that you have read them (Section 2.1 describes what we record when you do). If you do not agree, please do not use the App.
| Data Type | Details | Required? |
|---|---|---|
| Email address | Used for account creation and authentication. Provided by you directly, or by Google/Apple when you choose social sign-in. Stored in a private area of our database readable only by you (and us). Not collected if you sign in as a guest. | No |
| Password | Hashed by Firebase Authentication; never stored in plain text; never visible to us. Not collected for guest accounts or Google/Apple sign-in. | No |
| Username | 3–16 characters, visible to other players and, on leaderboards, to the public. Auto-generated for guest accounts. | Yes (auto-generated for guests) |
| Display name | Visible to other players and, on leaderboards, to the public. Auto-generated for guest accounts; pre-filled from your Google/Apple profile name if you use social sign-in (you can change it). | Yes (auto-generated for guests) |
| Country | ISO country code, manually selected by you (not determined by IP or GPS) | No |
| Avatar | Selected from pre-made options within the App | No |
| Year of birth | Entered on the acceptance screen so we can check the minimum age of 13 (Terms §4). We store the year only — never a full date of birth. | Yes |
| Legal acceptance record | When you tap "Agree & continue" we record the versions of the Terms and this policy you accepted, the time (server clock), your year of birth, the App version, your device platform and operating system version, the App language, and the IP address and user agent of the request. This is our proof that you agreed (see Section 5 for retention). | Yes |
| Blocked players | The list of players you have blocked, so the App can hide them from you. Visible only to you. | No |
Sign in with Google / Apple: if you choose one-tap sign-in, Google or Apple shares your account email address and name with us to create or access your account. We do not receive your Google/Apple password, contacts, or profile photo. Apple's "Hide My Email" relay addresses are fully supported. We store only the email and the display name you confirm during profile setup.
You may also sign in as a guest (anonymous authentication). Guest accounts do not require an email address or password but have limited functionality (no access to friends, challenges, or the full leaderboard features).
Guest account conversion: you may later convert your guest account to a full account by linking an email address and password, or a Google or Apple account. When you do this, all your existing game data (match history, ratings, XP, achievements, coins) is preserved and transferred to your full account. No new account is created — your existing anonymous account is upgraded in place.
Important: signing out of a guest account is irreversible. Because guest accounts use anonymous authentication, there is no way to sign back in — so guest sign-out permanently deletes the account and its data through the same deletion process described in Section 10.
| Data Type | Details | Visibility |
|---|---|---|
| Match history | Game results, scores, accuracy, average answer time, timestamps | Visible to other players (on your profile) |
| ELO ratings | Competitive skill ratings per quiz topic, calculated server-side | Leaderboards (public) |
| Statistics | Win/loss/draw records, accuracy, XP, level, achievements | Visible to other players (on your profile) |
| Topic progress | Per-topic XP, level, games played, and performance stats | Visible to other players (on your profile) |
| Coins & cosmetics | In-game currency balance ("Owls"), earned rewards, and purchased cosmetic items (avatars, frames) | Equipped cosmetics visible in matches |
| Online status | Whether you are online, in a match (and the topic being played), or offline — see Section 4.1. Can be turned off in Settings → Privacy → Show Online Status. | Friends (if enabled) |
| Social data | Friend list, pending friend requests, challenge invitations, blocked players | You and your friends (block list: only you) |
| Leaderboard and season entries | Display name, avatar, country, ELO rating, rank, and monthly wins | Public — readable without a Quizia account, including through the App's public leaderboard links |
Note: we do not keep your individual quiz answers. During and briefly after each match, a temporary processing record (the questions asked and each player's selected answers) exists on our servers so results, ratings, and statistics can be computed; these records are not visible to other players and are automatically deleted within roughly 24 hours of the match. Only aggregated statistics (accuracy percentage, average answer time) are retained long-term.
AI opponents: to ensure quick matches when no human opponent is immediately available, some matches may be played against computer-controlled opponents that appear as regular players. They do not represent real users and do not generate or process personal data.
The third-party SDKs we use for core functionality and product analytics automatically collect certain technical data:
| SDK | Data Collected Automatically | Purpose |
|---|---|---|
| Firebase Authentication | IP address (retained a few weeks for security), user agent string, device metadata (OS version, device model) | Account security and fraud detection |
| Firebase Crashlytics | Crashlytics Installation UUID, IP address (at time of crash), stack traces, device model, OS version, RAM, app version | Crash reporting and bug fixes |
| Firebase Cloud Messaging | Firebase Installation ID, device push token, app version, device model, OS version, language, timezone | Delivering push notifications |
| Firebase Analytics (Google Analytics for Firebase) | Firebase Installation ID, app instance ID, your Firebase user ID (so we can measure retention per account), coarse country derived from IP at request time (IP is not stored), device model, OS version, app version, language, screen views, session start/end, and the in-app events we explicitly log (e.g., sign_up, login, tutorial_complete, game_started, game_completed, guest_converted, and shop/quest events such as shop_purchase or quest_completed — always with item/topic identifiers, never personal data). We also set two user properties: whether the account is a guest or registered, and the account's in-game level. | Measuring installs, daily/monthly active users, retention cohorts (D1/D7/D30), and which parts of the game players use. Used solely to improve the product. |
| Google Sign-In SDK (optional — only if you use "Sign in with Google") | Your Google account email and name, shared at your direction when you complete the Google sign-in prompt | Account creation and sign-in without a password |
| Sign in with Apple (optional — only if you use it, iOS) | Your Apple ID email (or a "Hide My Email" relay address) and name, shared at your direction on first authorization | Account creation and sign-in without a password |
This data is collected and processed by Google LLC as part of the Firebase platform. We do not have direct access to most of this data (e.g., IP addresses logged by Firebase Auth).
Firebase Analytics — what we do not do: we do not use Firebase Analytics for advertising, we have not linked our Analytics property to Google Ads or any ad network, we do not enable Google Signals or cross-device tracking, and we never log quiz answers, passwords, email addresses, display names, or chat messages as event parameters.
Opt out: you can turn off Firebase Analytics for your account at any time in the App via Settings → Privacy → Share Usage Data. When disabled, no further analytics events are sent from your device.
| Purpose | Data Used | Legal Basis (GDPR) |
|---|---|---|
| Account creation and authentication | Email, password, username | Contract performance |
| Matchmaking and gameplay | User ID, display name, avatar, country, level | Contract performance |
| Scoring, ratings, and leaderboards | Match results, ELO calculations | Contract performance |
| Friend system, challenges and blocking | Friend list, challenge invitations, block list | Contract performance |
| Age check | Year of birth | Legal obligation (child-protection rules) and legitimate interest in enforcing the Terms' minimum age |
| Proof that you accepted the Terms and this policy | Legal acceptance record (Section 2.1) | Legitimate interest — establishing, exercising, or defending legal claims; legal obligation to demonstrate your consent where consent is the basis |
| Push notifications — social (friend requests, challenges) | Device push token | Consent (opt-in after first game) |
| Push notifications — reminders (streak at risk, new daily challenge; max one per day) | Device push token, streak/daily-activity status | Legitimate interest — you can turn these off at any time via Settings → Notifications → Streak & Daily Reminders, or by revoking notification permission in your device settings |
| Crash reporting and bug fixes | Crash data, device info | Legitimate interest |
| Product analytics (installs, retention cohorts, feature usage) | Firebase Installation ID, app instance ID, user ID, device/OS/app version, coarse country, screen views, in-app events listed in section 2.3 | Legitimate interest — measuring and improving the App. You may opt out at any time via Settings → Privacy → Share Usage Data. |
| Abuse prevention, user reports and blocking | Report content, user IDs, block list, rate-limit counters | Legitimate interest |
We do not sell, rent, or share your personal data with third parties for marketing or advertising purposes.
Certain data is visible to other Quizia users as part of the game experience — and leaderboards are public:
Your email address, year of birth, legal acceptance record, block list and push notification tokens are never visible to other players. You can turn off online status sharing at any time via Settings → Privacy → Show Online Status.
We use the following services to operate the App:
| Service | Purpose | Data Processing Location |
|---|---|---|
| Firebase Authentication (Google LLC) | Account creation and sign-in | United States only |
| Cloud Firestore (Google LLC) | Database for all user and game data, including legal acceptance records | EU (europe-west3, Frankfurt, Germany) |
| Firebase Realtime Database (Google LLC) | Live online status (online / in a match / offline) | EU (europe-west1, Belgium) |
| Cloud Functions (Google LLC) | Server-side game logic and data processing | EU (europe-west1, Belgium) |
| Railway Corporation | Hosting for our real-time game server (matchmaking and live matches). During a match it processes your user ID, display name, avatar, country, level, and the answers you select; its operational logs may briefly include display names and user IDs for debugging. | EU (Amsterdam, Netherlands) |
| Firebase Crashlytics (Google LLC) | Crash reporting | Google global infrastructure |
| Firebase Analytics (Google Analytics for Firebase, Google LLC) | Product analytics — installs, retention, feature usage | Google global infrastructure (United States) |
| Firebase Cloud Messaging (Google LLC) | Push notifications | Google global infrastructure |
| Firebase Hosting (Google LLC) | Hosting this website | Google global CDN |
| Google Cloud Logging (Google LLC) | Diagnostic logs from Cloud Functions execution (errors, request metadata) for debugging and abuse prevention. Logs do not contain quiz answers, passwords, or email addresses. | EU (europe-west1, Belgium) |
Google's privacy policy: policies.google.com/privacy
Google's data processing terms: firebase.google.com/terms/data-processing-terms
Railway's privacy policy: railway.com/legal/privacy
We do not share your data with any third parties other than the infrastructure service providers listed above, who process it solely on our behalf to run the game. We do not use advertising SDKs or social media SDKs, and we never sell your data. The only analytics service we use is Firebase Analytics, as described above, and you may disable it at any time.
We may disclose personal data where the law requires it — for example to comply with a court order, or to establish, exercise or defend legal claims — and, in that case, only what is necessary.
| Data Category | Retention Period | After Account Deletion |
|---|---|---|
| Account data (email, username, profile) | While your account is active | Permanently deleted immediately (typically within seconds) |
| Game statistics (ratings, XP, achievements, coins, cosmetics) | While your account is active | Permanently deleted immediately (typically within seconds) |
| Friend list, block list and social connections | While your account is active | Permanently deleted; removed from friends' lists (a daily server sweep acts as a safety net) |
| Leaderboard and season entries | While your account is active | Permanently deleted immediately (a daily server sweep acts as a safety net) |
| Username reservation | While your account is active | Freed immediately; may be claimed by another user |
| Online status (Realtime Database) | While your account is active; switches to "offline" within seconds of closing the App | Deleted with your account |
| Match processing records (questions asked + selected answers) | Deleted automatically ~24 hours after the match (records from failed processing are kept up to 30 days for debugging) | Purged on the same schedule |
| Match history (your records) | While your account is active | Permanently deleted with your account |
| Match history (in opponents' records) | Indefinite | Anonymized: your name and avatar are replaced with "Deleted Player." Game data (scores, topic, date) is preserved for the other player's history. No personally identifiable information is retained. |
| Legal acceptance records (Section 2.1, including year of birth, IP address and user agent) | While your account is active | Kept for 5 years after deletion, then deleted. They are our proof that you accepted the Terms and this policy and are retained solely to establish, exercise or defend legal claims (GDPR Art. 17(3)(e)). They are never used for any other purpose. |
| User reports (abuse reports) | While relevant for moderation | Reports about you are deleted; reports you filed are anonymized (your user ID is removed) |
| Rate-limit counters (abuse prevention) | Up to 24 hours | Expire automatically |
| Push notification tokens | Until you uninstall or delete your account | Deleted with your account |
| Crash reports (Crashlytics) | 90 days (managed by Google) | Automatically purged by Google after 90 days |
| Firebase Analytics events | Event-level data: 2 months (Google default). User-level data tied to your Firebase user ID: 14 months (Google default, the maximum allowed for the standard tier). | The analytics identifier on your device is reset when you delete your account, so future events cannot be linked to it. User-level data already collected expires within Google's retention window (at most 14 months). Aggregate, non-identifying statistics may remain. |
| IP address logs (Firebase Auth) | A few weeks (managed by Google) | Automatically purged by Google |
| Local cache (on your device) | 1–24 hours (auto-expires) | Cleared when you uninstall the App |
| Guest account data | While the guest session is active | Deleted on sign-out. Signing out of a guest (anonymous) account permanently deletes the account and its data through the same deletion process as a full account. We recommend converting to a full account to preserve your progress. |
We implement the following measures to protect your data:
While we implement industry-standard security measures, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.
Data breaches: if a personal-data breach is likely to put your rights and freedoms at risk, we will notify you and the competent supervisory authority without undue delay and, where the law requires it, within 72 hours of becoming aware of the breach.
Regardless of your location, you have the following rights regarding your personal data:
How to exercise your rights:
We will respond to all data requests within 30 days. We may ask you to verify your identity (for example by writing from the email address on the account) before acting on a request.
If you are located in the European Economic Area (EEA), the following applies:
The rights and safeguards in Section 8.1 apply equally to you. Transfers to Google are governed by the UK Addendum to the Standard Contractual Clauses and the UK-U.S. Data Bridge. We have not appointed a UK representative, relying on the corresponding exemption in Art. 27(2) UK GDPR. You may complain to the Information Commissioner's Office (ICO).
We do not currently meet the California Consumer Privacy Act applicability thresholds. However, we are committed to honoring data access and deletion requests from all users regardless of location. California residents may contact us at support@playquizia.com to exercise their rights.
We do not sell personal information. We do not share personal information for cross-context behavioral advertising.
By using the App you understand that your data is processed in the locations listed in Section 4.2, which may be outside your country. Wherever you are, the rights in Section 7 are available to you.
Quizia is not directed at children under the age of 13, and the App asks for your year of birth before you can play — an answer indicating that you are under 13 is refused and no account is created. We do not knowingly collect personal data from children under 13.
If you are a parent or guardian and believe your child has created a Quizia account, please contact us at support@playquizia.com. We will promptly delete the account and all associated data.
You may delete your account at any time. When you request account deletion:
Guest accounts: signing out of a guest account triggers this same deletion process — see Section 2.1.
Account deletion is irreversible. You would need to create a new account to use Quizia again.
For instructions, visit our Account Deletion page.
We may update this Privacy Policy from time to time. Each new version is posted on this page with a new effective date and a summary in the change log below.
For changes that affect how we process your data, the App asks you to review and accept the new version at your next launch before you continue playing; that acceptance is recorded as described in Section 2.1. Corrections and clarifications that do not change how your data is processed take effect when posted.
If you have questions about this Privacy Policy, your data, or wish to exercise any of your rights, contact us at:
Developer: Luan Bajrami
Postal address: Zajas bb, Kicevo, Republic of North Macedonia
Email: support@playquizia.com
We aim to respond to all inquiries within 30 days.
Version 2.0 — September 13, 2026: added the in-app acceptance screen and the data it records (year of birth, acceptance record with IP address and user agent) and their 5-year post-deletion retention (Sections 1, 2.1, 3, 5, 10); added the block list as a data type; clarified that leaderboards are publicly readable without an account (2.2, 4.1); corrected the Firestore region to Frankfurt, Germany (4.2); added a lawful-disclosure sentence (4.3), a breach-notification commitment (6), the right to restriction and identity verification (7), the developer's own access from North Macedonia, the EU-representative position, and UK and other-country sections (8); contact email changed to support@playquizia.com; postal address added (Zajas bb, Kicevo).
Version 1.0 — July 2, 2026: first published version.