Privacy Policy

Who is the controller

The data controller is Richard Gosnay, trading as GozQuiz. Contact richard@gosnay.co.uk for privacy requests. We have not appointed a separate data-protection officer. Use that email for those requests.

What we collect

• Account. Email address, display name, and, if you use Google sign-in, the name and profile photo Google shares with us. On iOS you can also use Sign in with Apple. Apple may share a name and an email address, or a private relay address. A password is handled by Firebase Authentication; we do not store the password ourselves.
• Profile. Badges, stats, Pro status, package unlocks, and quiz-creation credits.
• Purchases. What you bought, when, and the customer and subscription identifiers our payment processor returns. We do not store your full card number.
• Game history. Rooms you played or hosted, scores, and answers, on our servers and, for recent games, in your browser.
• Rooms and nicknames. Room codes, room settings, and the nickname a player types. Nicknames are chosen by the player and can be seen by others in that room.
• Quizzes you create. Titles, questions, and answers, including text you send to the AI generator (topic, difficulty, and similar instructions).
• Device and analytics. If Google Analytics is switched on for this deployment, page paths, approximate location derived from IP, and device or browser data. Server logs may also include IP address and user agent for security.
• Browser storage. localStorage and sessionStorage for the host tour, on-device game history, host drafts, and (in demo mode) a local profile. Firebase Authentication keeps the sign-in session in the browser. See the Cookie notice for cookies.
• Support. If you message us on WhatsApp, we receive the message you choose to send, including your WhatsApp number as shown to us by WhatsApp.

Guest play can be limited to a nickname and the room. Creating an account links later play to that account.

The Android and iOS apps

The GozQuiz apps load this website. They also use the following, which the website on its own does not.

• Push notification tokens. If you allow notifications, the app stores a Firebase Cloud Messaging token with your account. We use it to tell you about a room you are hosting, for example that the lobby is open or that the quiz is starting. The token is deleted when the account is deleted.
• In-app purchases. Pro and packages bought in the app are in-app purchases through Google Play or the App Store. They are processed by RevenueCat, our in-app purchase processor. We store the product, the store, and when access ends. We do not receive your card number.
• Camera. The camera is used only to scan a join QR code. The picture stays on the device long enough to read the code. It is not stored or uploaded.
• Sign in with Apple. On iOS, Sign in with Apple is an alternative to email or Google. We keep the identifier Apple gives us, and an email address if you choose to share one, so you can sign in again.
• Cancelling Pro bought in the app. A Pro subscription bought in the app is managed by Google Play or the App Store. Cancel it in your Google Play subscriptions or your App Store subscriptions. Deleting your GozQuiz account does not cancel that store subscription.
• Deleting your account. How to delete a GozQuiz account and the data that goes with it is explained on the delete account page. You do not need to be signed in to read it.

Why we use it, and the lawful basis

• Contract. To create your account, run rooms, save history, unlock a package you bought, and provide Pro.
• Legitimate interests. To keep the service secure, prevent abuse, understand which pages are used (analytics, when enabled), and send ourselves a notice when a new account is created. You can object to analytics and to non-essential processing.
• Legal obligation. To keep purchase records where tax or accounting law requires it.
• Consent. Where a non-essential cookie needs consent. See the Cookie notice.

We do not sell personal data. We do not use it to build advertising profiles.

Processors and subprocessors

These organisations process personal data for us. They are the ones the product actually uses.

• Google Firebase and Google Cloud — hosting (Firebase App Hosting), authentication, Cloud Firestore, Realtime Database, Cloud Storage, and Firebase Cloud Messaging for app notifications.
• RevenueCat — our in-app purchase processor for Google Play and App Store purchases. Website card payments use a separate secure payment provider.
• Secure payment provider — card payments, subscriptions, and the billing page you open from Manage billing.
• AI provider — prompts you submit to generate a quiz are sent to the AI provider.
• Google Analytics — page-view measurement, only after you accept analytics and only when a measurement ID is configured. It does not load before that. It is part of Google.
• SMTP email provider — verification emails and account notices are sent with standard SMTP. The code does not hard-code a particular email company; whoever operates the configured mail server processes the recipient address and the message.
• Meta (WhatsApp) — only if you choose to contact support on WhatsApp. That chat is not stored in the GozQuiz database.

International transfers

Richard Gosnay operates GozQuiz under the law of Gibraltar. Google and the secure payment provider process data in the United States and other countries. Where a processor is outside Gibraltar and the UK, we rely on an adequacy regulation or on appropriate safeguards such as the UK International Data Transfer Agreement or Standard Contractual Clauses, plus any transfer tool the processor publishes for its service.

How long we keep it

Account, profile, and personal quiz data are kept while your account is open. When you delete the account we remove the sign-in, the profile, personal quizzes, your game history, and any push notification tokens stored for that account. Purchase and payment records are kept for as long as tax and accounting law requires, with your name and email removed. Shared catalogue quizzes, packs, and packages are not deleted. A nickname already showing in a live room can remain until that room ends. Browser storage stays on your device until you clear it. If you have accepted analytics, that data is kept for the retention period configured in Google Analytics.

Your rights

Under UK GDPR and Gibraltar GDPR you can ask to access, correct, erase, or restrict your personal data, and to receive a portable copy of data you provided. You can object to processing based on legitimate interests. Where we rely on consent, you can withdraw it. You can also complain to the Gibraltar Regulatory Authority or, if you live in the UK, the Information Commissioner’s Office.

You can delete your own account from Profile. The steps, including what to do if you are not signed in, are on the delete account page. Type DELETE to confirm. We cancel an active Pro subscription with the secure payment provider before anything is removed. A Pro subscription bought in the app has to be cancelled in Google Play or the App Store. We then delete the Firebase Authentication user, the profile, personal quizzes stored on that profile, game history, and push notification tokens for that account. Purchase and payment records are kept for accounting and the name and email on them are removed. Public result links you created have the name replaced. Shared catalogue quizzes, packs, and packages are not deleted. Admin accounts cannot be deleted from Profile.

For any other request, email richard@gosnay.co.uk from the address on the account and put “Privacy request” in the subject. We may need to confirm it is you before we act. We aim to reply within one month.

Children

GozQuiz is not directed at children. You must be 16 or older to create an account. Under-16s may play only with a parent or guardian, in a family setting. We do not knowingly create accounts for children. If you believe a child has given us personal data without an adult, email richard@gosnay.co.uk and we will delete it.

Security

The site is served over HTTPS. Access to production data is limited to the operator account and Firebase security rules. Card numbers are handled by the secure payment provider, not stored onGozQuiz servers. No online service is perfectly secure; please use a unique password.

Cookies

Essential sign-in state, room drafts, and the host tour use browser storage and do not wait for consent. Google Analytics does not load, and does not set cookies, until you accept analytics. You can change that from Cookie settings in the footer or on the Cookie notice. Consent Mode starts with analytics and advertising storage denied.

Changes

We will post any change on this page and update the date at the top. The Terms of Service explain the rules for using the product.