Privacy Policy

1. Information We Collect

Account Information (via Google OAuth)

When you sign in with Google, we receive and store your name, email address, and profile avatar URL. We do not receive your Google password or any other Google account data beyond what you authorize during the OAuth flow.

Usage and Game Data

We collect data about how you use the platform: game sessions you host or join (room codes, player names, scores, session duration), question sets you create or publish, knowledge base content you upload, and AI generation requests you make. This data is used to operate the platform and is associated with your account.

Payment Information

All payment processing is handled by Paddle, our Merchant of Record. We do not store credit card numbers, bank account details, or any raw payment data. We receive from Paddle only the information necessary to manage your subscription or pass status: transaction IDs, subscription tier, billing period, and whether a payment succeeded or failed.

2. How We Use Your Information

• Account management: We use your name and email to identify your account, communicate with you about your subscription, and respond to support requests.
• Service delivery: Game session data, question sets, and settings are stored to provide the core platform functionality — hosting games, persisting your library, and resuming sessions after disconnection.
• Payments via Paddle: We share the minimum necessary data with Paddle (email, subscription intent) to initiate checkout sessions and process webhooks confirming payment outcomes.
• AI generation via Anthropic: When you use AI question generation, your topic, difficulty, language preferences, and any knowledge-base content you provide are sent to the Anthropic Claude API to generate questions. This data is subject to Anthropic's privacy policy and is not used by Anthropic to train models without opt-in.
• Service improvement: Aggregate, anonymized usage statistics help us understand which features are used and where the experience can be improved. We do not build individual behavioral profiles for advertising.

3. Data Sharing

We do not sell, rent, or trade your personal data to third parties. We share data only with the following service providers, strictly for operating Quizcade:

• Paddle — payment processing and Merchant of Record services. Paddle's privacy policy governs how they handle your payment data.
• Google — OAuth authentication provider. Your use of Google Sign-In is subject to Google's Privacy Policy.
• Railway — cloud hosting and infrastructure provider. Your data is stored on Railway's servers (PostgreSQL database and application runtime).
• Anthropic — AI question generation via the Claude API. Only the content you submit for generation is sent; no account-identifying information is included in API requests.

We may disclose your information if required by law, regulation, or valid legal process, or to protect the rights, property, or safety of Quizcade, our users, or the public.

4. Data Retention

Your account data (profile, question sets, knowledge bases, credit balance, subscription status) is retained for as long as your account is active. If you request account deletion, we will remove your personal data within 30 days, except where retention is required by law (e.g., financial records related to Paddle transactions).

Game session data (room state, player scores, session logs) is retained for 90 days after a session ends, after which it is automatically purged. Game reports you explicitly save to your analytics dashboard are retained until you delete them.

5. Your Rights

All users can:

• Request account deletion by emailing tsuf.barkai@gmail.com. We will confirm and process the deletion within 30 days.
• Export your question sets at any time via the question editor — content you created belongs to you.
• Update your display language or locale preference via the language switcher; this is stored locally in your browser.

For users in the European Economic Area (EEA)

If you are located in the EEA, you have additional rights under the General Data Protection Regulation (GDPR). We process your personal data on the following legal bases: performance of a contract (providing the service you signed up for), legitimate interest (service improvement and security), and consent (where applicable, such as optional AI generation using your knowledge-base content).

Under the GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — request deletion of your personal data (subject to legal retention requirements).
• Restriction — ask us to limit how we process your data in certain circumstances.
• Data portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interest.
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing.
• Lodge a complaint — file a complaint with your local data protection supervisory authority.

For any privacy-related request, contact us at tsuf.barkai@gmail.com and we will respond within 30 days.

6. Cookies & Local Storage

Quizcade does not use third-party tracking cookies or advertising cookies of any kind. We use browser localStorage for two purposes only:

• quizcade:token — your JWT authentication token, used to keep you signed in between sessions.
• quizcade:locale — your chosen display language (e.g., "en", "he", "es").

Both values are stored only in your own browser and are not transmitted to any analytics or advertising platform. You can clear them at any time by clearing your browser's local storage or by signing out.

7. Contact

For privacy questions, data requests, or concerns, contact us at: tsuf.barkai@gmail.com