Privacy Policy

Last updated: 2026-05-23 Effective date: Upon app launch on the Apple App Store

This Privacy Policy explains how QuizVibe (“we”, “us”, “the app”) collects, uses, and protects your information when you use our mobile application. We’ve tried to write it in plain English with the legal anchor points clearly marked.

QuizVibe is operated by Peter Björklund, an individual residing in Sweden. For any privacy-related questions or requests, contact us at: infoquizvibe@gmail.com.

TL;DR (the short version)

We collect the minimum information needed to make the app work: your player name, avatar choice, birth year, region preference, and game scores.
We use Supabase (EU-hosted in Ireland) as our backend database, and YouTube IFrame Player to play video clips inside the app.
We do not sell your data, do not show ads, and do not track you across other apps or websites.
You can delete your account at any time directly in the app (Profile → tap your name in the top-right → Delete Account).
The app is intended for users 13 years or older.

The rest of this document is the full version.

1. Who we are and how to contact us


Operator	Peter Björklund, individual residing in Sweden
Contact email	infoquizvibe@gmail.com
App name	QuizVibe
Platforms	Apple App Store (iOS)

We are not a registered company; QuizVibe is currently operated as a personal project. If this changes, we will update this policy and notify users via the app.

For data protection requests, complaints, or questions about how we handle your information, email us at infoquizvibe@gmail.com. We aim to respond within 30 days as required by GDPR Article 12.

2. What information we collect

2.1 Information you give us directly

When you register an account or join a game as a guest, we collect:

Player name — the name you chose for the game. You pick it; we don’t generate it from anything else.
Avatar selection — which avatar icon you picked.
Birth year — used to calculate your “Competition Age” (which affects gameplay difficulty calibration) and to enforce age-appropriate restrictions.
Region preference — Sweden / Nordics / Europe / Global, used to filter quiz content. This is not your physical location — it’s your content scope choice.
Email and password (registered users only) — for account authentication.

Guests do not provide email/password. Guests are identified by an anonymous session ID that we delete when you leave.

2.2 Information generated by using the app

Game history — your scores, dates, settings used (Game Era, response time, assistance level). Stored on your device and synced to our backend.
Lobby state — which room codes you’ve joined or created, who else is in the room. Auto-deleted after 24 hours.
Anonymous user ID — guests are assigned a temporary UUID for state persistence. No personal information attached.

2.3 Information we automatically collect

In-app actions for analytics — e.g., “user registered”, “game completed”, “purchase made”. We log event names, not personal content.

2.4 What we do NOT collect

Your physical location (no GPS, no IP-based geolocation for marketing).
Your contacts, photos, microphone, or camera — the app doesn’t ask for these permissions.
Cross-app tracking data — no advertising IDs, no SDK that follows you across apps.
Behavioral profiles — we don’t infer interests, demographics beyond your stated birth year/region, or political/religious/health information.

3. How we use your information

We use the information above for these specific purposes:

Purpose	Information used	Legal basis (GDPR)
Run the game (matchmaking, leaderboards, scores)	Player name, avatar, scores, lobby state	Contract (Article 6(1)(b))
Calculate Competition Age + content age-tuning	Birth year	Contract (Article 6(1)(b))
Filter quiz content to your region/era	Region preference, birth year	Contract (Article 6(1)(b))
Authenticate registered users	Email, password	Contract (Article 6(1)(b))
Improve the app (fix bugs, balance gameplay)	Anonymous analytics events, crash logs	Legitimate interest (Article 6(1)(f))
Process in-app purchases	Apple StoreKit handles this — we only receive purchase confirmations	Contract (Article 6(1)(b))
Prevent abuse (bot signups, profanity in names)	IP address (rate-limit only, not stored long-term), player name	Legitimate interest (Article 6(1)(f))

We do not:

Sell or rent your data to anyone.
Use your data for advertising (we don’t show ads).
Profile you for marketing purposes.
Train AI models on your data.

4. Third-party services

QuizVibe uses these external services to function:

4.1 Supabase (backend database and authentication)

We use Supabase (https://supabase.com) to store account data, game history, and lobby state. Our Supabase project is hosted in the EU (Ireland, eu-west-1), so your data stays in the EU.

Supabase has its own privacy policy: https://supabase.com/privacy

4.2 YouTube IFrame Player (video playback)

Quiz questions include embedded YouTube video clips (songs, movie scenes, sport events). When a video plays, your device communicates directly with YouTube’s servers to stream the content. This means Google receives information about your device (IP address, browser-like info, the video being watched) per their own data collection practices.

We do not send YouTube any of your QuizVibe account information. The YouTube player runs in a sandboxed view inside the app.

Google’s Privacy Policy applies to YouTube embeds: https://policies.google.com/privacy YouTube Terms of Service: https://www.youtube.com/t/terms

4.3 Apple StoreKit (in-app purchases)

In-app purchases (credit packs, themed packages, subscriptions) are processed entirely by Apple StoreKit. We never see your credit card, Apple ID password, or billing address. Apple sends us only a transaction confirmation indicating which product you bought.

Apple’s Privacy Policy: https://www.apple.com/legal/privacy/

4.4 GitHub (source code, hosting this Privacy Policy)

Our app’s source code and this Privacy Policy document are hosted on GitHub (https://github.com). This doesn’t process user data from the app itself — it’s just where the code lives.

GitHub’s Privacy Policy: https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement

5. How long we keep your data

Data type	Retention period
Registered user account (profile, history)	Until you delete it. Delete in-app via Profile → tap your name → Delete Account. Email infoquizvibe@gmail.com if you need help.
Guest anonymous session	Until you leave the game (immediate) or 30 days of inactivity.
Lobby state (room codes, player list)	Auto-deleted 24 hours after the lobby was created.
Analytics events (anonymized)	90 days, then aggregated and de-identified for long-term retention.
IP addresses (rate-limit tracking)	1 hour, then automatically purged.
In-app purchase records	7 years (Swedish accounting law requirement for businesses; even though we are a personal project, we follow this conservatively).

If you are in the EU, EEA, or UK, you have the following rights regarding your personal data:

Right to access — request a copy of all data we hold about you.
Right to rectification — correct inaccurate data.
Right to erasure (“right to be forgotten”) — delete your account and associated data. You can do this yourself in-app: Profile → tap your name in the top-right → Delete Account. Server-side data is removed automatically. Email infoquizvibe@gmail.com if you need help.
Right to restrict processing — pause our use of your data.
Right to data portability — get your data in a machine-readable format (JSON export).
Right to object — object to processing based on legitimate interest.
Right to withdraw consent — where we rely on consent (currently we don’t, but if that changes you can withdraw).

To exercise any of these rights, email infoquizvibe@gmail.com with the subject “GDPR Request” and describe what you want. We will respond within 30 days.

You also have the right to lodge a complaint with a supervisory authority. In Sweden, that’s the Integritetsskyddsmyndigheten (IMY): https://www.imy.se

7. Age restrictions and children’s privacy

QuizVibe is intended for users 13 years of age or older.

The app enforces this by limiting the birth-year picker in registration to dates corresponding to a minimum age of 13. Users cannot register or play as a guest with a birth year that would make them younger than 13 at the time of registration.

We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child under 13 has somehow registered (e.g., by misrepresenting their age), contact infoquizvibe@gmail.com and we will delete their account and associated data.

For users between 13 and 16 in the EU: under GDPR Article 8 (and Swedish implementation), processing of personal data based on consent for users under 16 requires parental authorization. QuizVibe currently relies on Contract and Legitimate Interest as legal bases (Article 6(1)(b) and (f)) — not Consent — for its core processing. This means parental authorization is not strictly required to use the app’s normal features. However, we still recommend that parents are aware of and approve of their teenager’s app usage.

8. How we protect your data

We use these security measures:

HTTPS/TLS for all data transmitted between the app and our backend (Supabase enforces TLS 1.2+).
Password hashing via bcrypt (handled by Supabase Auth) — we cannot see your password.
Row-Level Security (RLS) in our database — users can only access their own data via authenticated queries.
Per-IP rate limiting on anonymous signups to prevent bot abuse.
No raw user data in source code — the app is open source, but credentials and data live in the backend.

Despite these measures, no system is 100% secure. If a data breach occurs that affects your personal information, we will notify you and the supervisory authority (IMY in Sweden) within 72 hours as required by GDPR Article 33.

9. International data transfers

Our backend (Supabase) is hosted in the EU (Ireland). Your data does not leave the EU for storage.

The YouTube IFrame Player communicates with Google’s global infrastructure, which may include servers outside the EU. Google relies on Standard Contractual Clauses (SCCs) for these transfers under GDPR. We have no control over Google’s infrastructure, but their compliance is documented at https://policies.google.com/privacy

GitHub (where this Privacy Policy document is hosted) is operated by Microsoft and includes US-based infrastructure. GitHub relies on Standard Contractual Clauses for EU data transfers.

10. Cookies and tracking technologies

The app does not use cookies (it’s a mobile app, not a website). We do not use:

Advertising identifiers (IDFA, AAID).
Third-party analytics SDKs that track behavior across apps.
Cross-site tracking pixels.

We use AsyncStorage on your device to persist your preferences (login session, profile, game history). This is local-only and is not transmitted to us unless required for app functionality (e.g., syncing scores).

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we do:

The “Last updated” date at the top of this document will change.
For material changes (changes that affect your rights or how we handle your data), we will notify you via an in-app message and require you to acknowledge before continuing.
For minor changes (typo fixes, clarifications), we will not actively notify but the updated version will be available at the same URL.

Your continued use of the app after a policy change constitutes acceptance of the new policy. If you don’t agree with the changes, please delete your account before continuing.

12. Disputes

If you have a dispute with us about privacy that we cannot resolve through email, the dispute will be governed by Swedish law and subject to the jurisdiction of Swedish courts (Stockholms tingsrätt as the court of first instance).

13. Contact

For all privacy-related inquiries:

Email: infoquizvibe@gmail.com Subject line: Please prefix with “Privacy:” for faster routing (e.g., “Privacy: data export request”)

For non-privacy support (gameplay questions, bug reports, feature requests), the same email works — just use a different subject line.

This Privacy Policy is provided in English. A Swedish translation may be added in a future version.