Privacy Policy

This policy describes how Quizelo collects, uses and protects your personal data, in line with the GDPR (Regulation (EU) 2016/679).

Data controller

The data controller is Mehdi GRAR, sole trader doing business under the trading name "Quizelo". Contact details are listed in the legal mentions.

Data we collect

We only collect the data strictly necessary to operate the Service:

• Identifiers: email, handle, password (hashed via scrypt).
• Game profile: ELO, match history, ranking.
• Payment: Premium status, Stripe customer ID (card data is handled exclusively by Stripe, never by us).
• Technical logs: IP, user-agent (security purposes, kept for 30 days).
• Device data (mobile app): advertising identifier, device model and operating system, and push notification token if you enable notifications.
• Diagnostic data: crash and performance reports, for app stability purposes.

Processing purposes

• Provide the Service (matchmaking, ranking, gameplay).
• Manage Premium billing and refunds.
• Prevent fraud and abuse (anti-cheat, anti-spam).
• Communicate about the Service (email verification, security alerts).
• Fund the free service through rewarded ads (mobile app), with your consent where required.

Legal basis

Processing is based on contract performance (article 6.1.b GDPR) for account and gameplay data, and on your consent (article 6.1.a) for non-essential cookies.

Sub-processors

We share strictly necessary data with the following sub-processors:

• Stripe Inc. (payments) — United States, GDPR safeguards via Standard Contractual Clauses.
• Resend (transactional emails) — EU.
• Hosting: Vercel Inc. (website), Fly.io Inc. (API), Neon Inc. (database) — USA / European Union depending on the service, safeguarded by Standard Contractual Clauses (see legal notice).
• Google Ireland Ltd / Google LLC — AdMob advertising and measurement (mobile app). Transfers outside the EU are covered by the Data Privacy Framework and/or Standard Contractual Clauses.
• Google (Firebase Crashlytics) — mobile app crash reporting — USA.
• Sentry (Functional Software, Inc.) — technical error monitoring — USA, Standard Contractual Clauses.
• Plausible Analytics — cookieless website analytics — European Union.

Advertising and identifiers

The mobile app offers rewarded ads (watch a short video to unlock an extra game). They are served through Google AdMob, which may process an advertising identifier and device data to deliver and measure ads. No ads are served on the website. The Premium subscription removes ads.

In the European Economic Area, a consent screen lets you accept or refuse personalized ads; if you refuse, non-personalized ads are served instead. On iOS, the “App Tracking Transparency” permission is also requested. You can reset your advertising identifier or limit tracking at any time in your device settings.

Retention period

Account data is kept as long as your account is active. On deletion, personal information is anonymised immediately (right to erasure). Technical logs are kept for 12 months max.

Your rights

You have the following rights regarding your personal data:

• Right of access: get a copy of your data.
• Right to rectification: correct inaccurate data.
• Right to erasure: delete your account (immediate from /settings).
• Right to portability: receive your data in a structured format.
• Right to object and to restriction of processing.

Cookies

See the dedicated /legal/cookies page for the full list and the option to update your consent at any time.

Minors

The Service is intended for people aged 16 or older. We do not knowingly collect personal data from children under 16; if you believe such an account exists, email us at contact@quizelo.app so we can delete it.

Contact

To exercise your rights or ask a question: contact@quizelo.app. You can also file a complaint with the CNIL (cnil.fr) or your local supervisory authority.