Privacy Policy

This policy describes how Quizelo collects, uses and protects your personal data, in line with the GDPR (Regulation (EU) 2016/679).

Data controller

The data controller is Mehdi GRAR, sole trader doing business under the trading name "Quizelo". Contact details are listed in the legal mentions.

Data we collect

We only collect the data strictly necessary to operate the Service:

• Identifiers: email, handle, password (hashed via scrypt).
• Game profile: ELO, match history, ranking.
• Payment: Premium status, Stripe customer ID (card data is handled exclusively by Stripe, never by us).
• Technical logs: IP, user-agent (security purposes, kept for 30 days).
• Device data (mobile app): advertising identifier, device model and operating system, and push notification token if you enable notifications.
• Diagnostic data: crash and performance reports, for app stability purposes.
• Profile photo (optional): the picture you choose to represent yourself, taken with the camera or picked from your gallery. It is visible to other players.

Processing purposes

• Provide the Service (matchmaking, ranking, gameplay).
• Manage Premium billing and refunds.
• Prevent fraud and abuse (anti-cheat, anti-spam).
• Communicate about the Service (email verification, security alerts).
• Fund the free service through rewarded ads (mobile app), with your consent where required.
• Represent you to other players (profile photo) and moderate published images.

Legal basis

Processing is based on contract performance (article 6.1.b GDPR) for account and gameplay data, on your consent (article 6.1.a) for non-essential cookies and for the profile photo, which you are never required to provide, and on our legitimate interest (article 6.1.f) in keeping the service safe for the moderation of published images.

Sub-processors

We share strictly necessary data with the following sub-processors:

• Stripe Inc. (payments), United States, GDPR safeguards via Standard Contractual Clauses.
• Resend (transactional emails), EU.
• Hosting: Vercel Inc. (website and profile-photo storage), Fly.io Inc. (API), Neon Inc. (database), USA / European Union depending on the service, safeguarded by Standard Contractual Clauses (see legal notice).
• Google Ireland Ltd / Google LLC, AdMob advertising and measurement (mobile app). Transfers outside the EU are covered by the Data Privacy Framework and/or Standard Contractual Clauses.
• Google (Firebase Crashlytics), mobile app crash reporting, USA.
• Sentry (Functional Software, Inc.), technical error monitoring, USA, Standard Contractual Clauses.
• Plausible Analytics, cookieless website analytics, European Union.
• Sightengine SAS (automated profile-photo moderation), France, European Union.

Advertising and identifiers

The mobile app offers rewarded ads (watch a short video to unlock an extra game). They are served through Google AdMob, which may process an advertising identifier and device data to deliver and measure ads. No ads are served on the website. The Premium subscription removes the ads served between games; some optional in-app features remain available in exchange for a rewarded ad.

In the European Economic Area, a consent screen lets you accept or refuse personalized ads; if you refuse, non-personalized ads are served instead. On iOS, the “App Tracking Transparency” permission is also requested. You can reset your advertising identifier or limit tracking at any time in your device settings.

Profile photo

The profile photo is entirely optional: the Service works without one, using a character from our catalogue. If you add one, it becomes VISIBLE to other players — in games, on the leaderboard, on your profile and in messages — and it may appear on a share card, that is a public page anyone with the link can open.

We automatically screen profile photos to filter out inappropriate images, using an image-moderation service (Sightengine). The analysis looks at image content, identifies no one and serves no other purpose; it produces no biometric data. It runs periodically, within twelve hours of publication. An image flagged by that service or by a player is hidden while it is reviewed: your catalogue character is shown instead.

You can remove your photo at any time from the settings: the file is then deleted from our servers. When you delete your account, your photo and the share cards you published are deleted, not merely unlinked.

Retention period

Account data is kept as long as your account is active. On deletion, personal information is anonymised immediately (right to erasure); the profile photo and any published share cards are erased outright. Technical logs are kept for 12 months max.

Your rights

You have the following rights regarding your personal data:

• Right of access: get a copy of your data.
• Right to rectification: correct inaccurate data.
• Right to erasure: delete your account (immediate from /settings).
• Right to portability: receive your data in a structured format.
• Right to object and to restriction of processing.

Cookies

See the dedicated /legal/cookies page for the full list and the option to update your consent at any time.

Minors

The Service is intended for people aged 16 or older. We do not knowingly collect personal data from children under 16; if you believe such an account exists, email us at contact@quizelo.app so we can delete it.

Contact

To exercise your rights or ask a question: contact@quizelo.app. You can also file a complaint with the CNIL (cnil.fr) or your local supervisory authority.