Privacy Policy

Last updated: 28 August 2026

1. Who we are

This Privacy Policy explains how the website kwiz.ly ("Kwizly", "we", "us" or "our"), collects, uses, and protects personal data when you use the Kwizly website, applications and related services (the "Service"). For questions about this policy or your data, contact us at privacy@kwiz.ly.

2. What data we collect

If you create an account (host):

  • Email address, a display name and, optionally, an avatar image;
  • If you sign up with an email and password, a securely hashed password (we never store your password in plain text);
  • If you sign in with Google, Microsoft or GitHub, the email, display name and avatar shared with us by that provider;
  • Billing information if you subscribe to a paid plan (see Section 5) - we never see or store your full card details;
  • The quizzes, questions and media you create or upload.

If you join a quiz as a player:

  • The display name you choose when joining a session (capped in length and automatically filtered);
  • A randomly generated session identifier used to track your participation and score for the duration of the quiz;
  • Your display name, answers and scores are retained as part of the quiz's results, which the host who ran the session can access after it ends. They are deleted when the host deletes those results or deletes their account.

Playing as a guest doesn't require an account, and we don't ask players for their email address or real name - please don't submit one as your display name.

3. How we use your data

  • To provide, operate and maintain the Service, including running live quiz sessions and showing results;
  • To create and secure your account, and to communicate with you about it (for example, email verification and password reset emails);
  • To process payments and manage subscriptions;
  • To detect, prevent, and respond to fraud, abuse, or security incidents;
  • To improve and maintain the Service.

We don't use your data for advertising, and we don't sell personal data to third parties.

4. Legal bases for processing

Where the UK/EU GDPR applies, we rely on the following legal bases: performing our contract with you (running the Service you signed up for), our legitimate interests (such as keeping the Service secure), your consent (where we ask for it), and compliance with legal obligations.

5. Who we share data with

We share personal data with the following third-party service providers, only as needed to run the Service:

  • Stripe - payment processing and subscription billing;
  • Resend - sending transactional emails (account verification, password reset);
  • Google, Microsoft, GitHub - if you choose to sign in using one of these providers;
  • Google Cloud Storage - hosting images and media you upload;
  • PostHog - product analytics, processed on their EU infrastructure;
  • Cloudflare - website hosting, content delivery, and privacy-first web analytics.

These providers only process data on our behalf and under their own privacy and security commitments. We don't share your data with anyone else except where required by law.

6. International data transfers

Some of the providers listed above may process data outside your country of residence, including in the United States. Where this involves a transfer out of the UK/EEA, we rely on appropriate safeguards such as Standard Contractual Clauses.

7. How long we keep your data

We keep account data for as long as your account is active. If you delete your account - or ask us to delete it - we remove your email address, avatar, password and connected sign-in methods, and replace your display name with "Kwizly User".

We also delete your private quizzes, questions and question packs, the media used only by them, and the results and session history of the quizzes you hosted - including the player display names recorded in those results.

Content you chose to make public - your public quizzes, questions and question packs - is retained by Kwizly and stays on the Service, but it is no longer linked to you by name. If you'd rather it wasn't kept, make it private before deleting your account. We also retain billing records where we need them to comply with a legal obligation. Email verification and password reset tokens are short-lived and stored as one-way hashes, not the original token.

8. Cookies and local storage

Kwizly doesn't use cookies or advertising trackers. We store your sign-in token in your browser's local storage, purely so the Service can keep you signed in and reconnect you to a session. This data stays on your device and is removed when you sign out or clear your browser storage.

9. Analytics

We use PostHog in the app at app.kwiz.ly to understand how the Service is used and where people run into trouble. It is configured to write nothing to your browser - no cookies, no local storage - and session recording is switched off.

We record page views and a small set of actions: creating a quiz, starting to host one, joining a session as a player, generating questions, and beginning a checkout. Once you are signed in, these are linked to your account identifier, so that we can tell how many people did something rather than how many times it happened. Quiz join codes are stripped from any web address before it is sent. This data is processed on PostHog's EU infrastructure.

On the marketing site at kwiz.ly we use Cloudflare Web Analytics, which counts page views and referrers without cookies, without storing your IP address, and without following you between websites. It records no information that identifies you personally.

10. Your rights

Depending on where you live, you may have the right to:

  • Access the personal data we hold about you;
  • Correct inaccurate data;
  • Request deletion of your data;
  • Object to or restrict certain processing;
  • Receive a copy of your data in a portable format;
  • (California residents) Know what personal information is collected, request its deletion, and not be discriminated against for exercising these rights - we don't sell personal information.

To exercise any of these rights, contact us at privacy@kwiz.ly. If you're in the EU/UK, you also have the right to lodge a complaint with your local data protection authority.

11. Children's privacy

Kwizly accounts are intended for people aged 16 or over. The Service can be used to run quiz sessions with younger participants (for example, in a classroom) where the host - such as a teacher - is responsible for obtaining any consent required by their organization or local law, and for making sure players don't submit real names or other identifying information as their display name.

12. Security

We use industry-standard measures to protect your data, including password hashing and account lockouts after repeated failed sign-in attempts. No method of transmission or storage is completely secure, so we can't guarantee absolute security.

13. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we'll notify you by email or through the Service before they take effect.

14. Contact us

If you have questions about this Privacy Policy or how we handle your data, contact us at privacy@kwiz.ly.