Privacy Policy

1. Who is responsible

AmoQuiz is run by Ivan Zhevakin, a sole trader (autónomo) registered in Spain with tax number (NIF) Z1820872J, whose address is Av. Diagonal, 88, 6H, Sant Martí, 08019 Barcelona, Spain (“AmoQuiz”, “we”, “us”). We are the controller of the personal data described in this policy, except where section 3 says that a host is.

For anything about your data, write to support@amoquiz.com. We have not appointed a data protection officer, because the law does not require one for what we do; your message reaches the person who runs AmoQuiz.

This policy covers the website at amoquiz.com, the AmoQuiz app at app.amoquiz.com, the pages players open on their phones to join a game, the event pages hosts publish, and the emails we send.

2. The website

The website amoquiz.com sets no cookies, stores nothing in your browser and runs no analytics or advertising scripts. It is served by Cloudflare, which processes your IP address and the details your browser sends with each request in order to deliver the pages and protect them from attacks. Our legal basis is our legitimate interest in running a secure website (Article 6(1)(f) GDPR).

3. Players, sign-ups and the host’s role

When a host runs a game or publishes an event page, the host decides what to ask players and guests, and why. For that data (the names, answers, contact details and other details a host’s game or sign-up form collects) the host is the controller and we are their processor: we store and process it on the host’s behalf and on their instructions, under the data processing terms in section 12 of our Terms of Service. If you played in a game or signed up for an event and have a question about your data, please ask the host first; we will help them answer you.

4. What we collect, and why

Your account

• What: your name, email address and password, and if you give them, a phone number. Also your interface language, the kinds of events you host (from the question we ask when you sign up), your plan, and the teams you belong to. We store your password only as a one-way hash (bcrypt).
• Why: to create your account, sign you in, keep it secure and give you the plan you chose.
• Legal basis: performing our contract with you (Article 6(1)(b) GDPR).

Your games and content

• What: the games, questions, answers, images, audio, video, themes and folders you create or upload, your game results, and any organizer or event pages you publish.
• Why: to store them, show them on the big screen and the players’ phones, and share them with the people you choose.
• Legal basis: performing our contract with you.
• Who can see them: files you upload are stored at addresses that are long and hard to guess, so anyone who has a file’s address can open it; that is how it reaches the screen and the phones during a game. Event pages you publish are public. Games you share with other registered users can be seen by them.

Players in a game

• What: the name a player types (up to 40 characters) and their team, their answers and when they gave them, buzzer presses, points they stake, reactions and scores, and a random player identifier kept on the phone so that a player who reloads the page comes back to the same place. If the host turns on cheating protection, the times a player leaves the game screen on their phone and for how long. Anything else the host’s game asks for at the start, such as an email address or a phone number.
• Who sees it: the host, and, for the name, the team and the score, everyone in the game, on the big screen and on the players’ phones.
• IP addresses: our game server holds a phone’s IP address in memory while it joins, only to limit repeated join attempts. It does not store or log them.
• Role: we process this data for the host (section 3).

Sign-ups for events

• What: the details a host’s event page asks for, the consents the guest gives, with the time they were given, and the confirmation emails we send to the host and the guest.
• Role: we process this data for the host (section 3).

AI features

• What: when you use an AI feature, we send the text it needs to our AI provider: your topic and instructions, existing questions, the text of a presentation or PDF you import, and its file name. When a host turns on AI checking, the answers players type are sent so the AI can mark them.
• Why: to draft questions, turn presentations into games, and suggest whether typed answers are right. The host always has the final say on marking.
• Legal basis: performing our contract with the host. Please don’t put personal details into an AI feature unless it needs them.

Payments

• What: our reseller Paddle sells our plans as merchant of record and is the controller of the payment details you give at checkout. We receive from Paddle what we need to give you your plan and keep our accounts: your name, email address and country, what you bought, the amounts, dates and order numbers. We never receive your card details.
• Legal bases: performing our contract with you, and our legal obligation to keep accounting and tax records (Article 6(1)(c) GDPR).
• Paddle’s own use of your data is explained in Paddle’s privacy notice.

Emails we send

• What: emails to confirm your address, reset your password, confirm a change of email address and welcome you when you sign up, and confirmations of event sign-ups. We send no newsletters or marketing emails. If we ever want to, we will ask first.
• Legal basis: performing our contract with you.

Support

• What: the messages you send us and our replies.
• Why and legal basis: to answer you, and to keep a record of what was agreed: our contract with you and our legitimate interest in giving good support.

Product analytics

• What: which pages of the app you open and which features you use, and your browser and type of device, linked to your account: your user identifier, name, email address, interface language, plan and when it ends, and the kinds of events you host.
• Only if you agree: the app asks before analytics starts. If you say no, the app sends nothing for analytics, and the only thing it keeps in your browser is your answer, so that it doesn’t ask again. You can change your answer at any time on your account page in the app.
• Why and legal basis: to understand how AmoQuiz is used, so that we can improve it. The legal basis is your consent (Article 6(1)(a) GDPR and, for what analytics stores in your browser, article 22.2 LSSI-CE).
• Analytics never runs on players’ phones.

Errors and security

• Errors: when something breaks, the app, the players’ pages and our servers send an error report with technical details (what failed, the browser and the page) to our error-monitoring service. Before a report is sent, from a browser or from our servers, it is cleaned of personal data other than the internal identifier of a signed-in host’s account.
• Spam protection: when you submit the sign-up form or an event sign-up form, Google reCAPTCHA checks your device and your IP address to tell people from bots.
• Legal basis: our legitimate interest in keeping AmoQuiz working and safe from abuse.

Signing in as you

We look inside your account only to help you when you ask, to fix a problem, or to investigate abuse of AmoQuiz.

5. Who receives your data

We use the service providers below. They process personal data only on our instructions, under data processing agreements. Paddle is the exception: for payments, it is a controller in its own right.

When a host puts a video or a sound from YouTube, Vimeo, SoundCloud or a similar service into a game, it plays from that service in the host’s browser, and that service sees the host’s IP address. Players’ phones don’t load it.

We may also disclose data when the law requires it, to protect our rights or someone’s safety, or to a successor who takes over AmoQuiz, who would keep to this policy.

We don’t sell personal data, and we don’t share it for advertising.

6. Transfers outside Europe

Some of these providers are in the United States or the United Kingdom. The United Kingdom is covered by an adequacy decision of the European Commission. For the United States, we rely on the provider’s certification under the EU-US Data Privacy Framework or, where a provider is not certified, on the Standard Contractual Clauses approved by the European Commission. You can ask us for a copy of the safeguards that apply.

7. How long we keep data

• Your account and content: for as long as your account exists. Items you delete go to the trash. After 30 days they no longer show there, but we keep them, so that we can bring a game back if you ask; tell us if you want something removed for good.
• Game results, including players’ names, answers and scores: with the host’s account, until the host’s account is deleted or the host asks us to delete them. The live game itself is held on the game server for at most 12 hours after it ends, and the game server’s own copy of its results for 30 days.
• When an account is deleted: we delete the account and everything in it, including uploaded files and game results, within 30 days. Copies in our backups are deleted as the backups expire, after 12 months at most.
• Purchase records: for as long as tax and accounting law requires, currently up to six years.
• Support emails: up to two years after the conversation ends, unless we need them for a dispute.
• Analytics: until your account is deleted, when we delete your analytics profile. If you turn analytics off, nothing more is collected.
• Error reports: up to 90 days.

8. Your rights

You have the right to:

• access the personal data we hold about you and get a copy;
• correct it if it is wrong;
• delete it, including your whole account;
• restrict how we use it;
• receive the data you gave us in a common machine-readable format, and have it sent to another service (portability);
• object to our using it on the basis of legitimate interests;
• withdraw any consent you have given, at any time.

To use any of these rights, including to delete your account, write to support@amoquiz.com from the email address on your account. We answer within one month, and we may ask you to confirm who you are first. Using your rights is free.

If you think we have mishandled your data, please tell us. You can also complain to the Spanish data protection authority, the Agencia Española de Protección de Datos, or to the authority in the country where you live or work.

9. Cookies and your browser’s storage

• amoquiz.com: nothing. The website sets no cookies and stores nothing in your browser.
• The app: your browser’s local storage keeps you signed in and remembers your preferences, such as the language, the theme and your answer about analytics; the app cannot work without it. If you agree to analytics, the analytics service also sets a cookie and keeps entries in your browser’s storage (section 4).
• Spam protection: when you submit the sign-up form or an event sign-up form, Google reCAPTCHA loads and may set its own cookies.
• Players’ phones: local storage remembers the name a player typed, their place in the game and the answers they have not sent yet, so that a reload or a lost connection doesn’t throw them out. Nothing is used for tracking.

10. Children

You must be at least 16 to create an AmoQuiz account. Anyone can play in a game, children included, and players give only a name and their answers unless the host asks for more. When children play, the host is responsible for supervising them and for any permission their parents need to give. If you believe a child has given us personal data that they should not have, write to us and we will delete it.

11. How we protect your data

Connections to the website, the app and the players’ pages are encrypted (HTTPS). Passwords are stored only as one-way hashes, the links in our emails expire, and you stay signed in for up to 30 days after you last used the app. Only the person who runs AmoQuiz has access to the servers and the data, and the database is backed up every day.

12. Automated decisions

AI can suggest whether a typed answer is right, but the host decides how answers are marked. We make no decisions about you by automated means alone that have legal or similarly significant effects.

13. Changes to this policy

We update this policy when what we do with data changes. If a change matters to you, we will tell you by email or in the app before it applies. The date at the top shows when it last changed.