Privacy notice

Who is responsible

Kvisso is responsible for the personal data in Kvisso.

Email: [email protected]

We keep as little as we can. There are no ads and no tracking cookies.

Hosts

What	Why	Legal basis
Name, email, password (stored only as a scrambled hash)	Your account and logging in; login links you ask for	Our agreement with you (GDPR art. 6(1)(b))
Whether the account is personal, a company's or a school's (we set it with you)	A school account plays every quiz in safe mode	Our agreement with you
Your passes, packs and team plan, when your free trial ends, what you have paid, Stripe's customer and subscription numbers	Opening what you paid for, receipts, bookkeeping	Agreement; the Bookkeeping Act (art. 6(1)(c))
Gift cards you bought (with the code until it is redeemed) or redeemed, and the pass they gave you	Giving the pass to whoever redeems the card	Our agreement with you
Your invite code; whether someone invited you, and the friends who joined through your link and whether they paid	An event pass for each of you; stopping abuse	Our agreement with you
Quizzes, pictures and sounds you upload, your games and their scores	Running your quiz nights and showing your results	Our agreement with you
Quizzes you publish in Community, and ratings and reports you give other hosts' quizzes	Showing them to other hosts, keeping Community fair	Our agreement with you
Questions you save to My questions, and which quiz each came from	Reusing them in your other quizzes	Our agreement with you
If you are in a team: the team, your role, and invites you send (the address, until it is used or expires)	Sharing quizzes and seats with your team	Our agreement with you
Ideas and feature requests you send us, with our reply	Reading and answering them	Our agreement with you
What we do to your account by hand (access given, a login link made, the account kind set), with when. Kept a year	Answering for what we changed	Our legitimate interest in a record (art. 6(1)(f))
If you sign in with Google or Microsoft: which one, its id for you, and the email it gave	Logging you in with it	Our agreement with you
A login cookie	Keeping you logged in	Strictly necessary; no consent needed
A cookie with your light or dark pick, and one with your app language (My account, front page)	Showing the look and language you chose	A setting you asked for; no consent needed

Players

Players don't make an account. When you join a game we keep:

the nickname and emoji you pick, your team, your answers and scores, and chat lines if the host has the chat on: to run the game and show its results to the host;
a cookie on your phone that lets you rejoin the same game if your browser closes;
a selfie, only if you choose to take one and the host has the feature on. It is held in the server's memory for that game only, shown only on that game's screens, never saved to disk, and gone when the game ends.

This is done to deliver the game the host has invited you to (our legitimate interest, GDPR art. 6(1)(f), and the host's). When a company, school or other organisation runs the game for its own people, that organisation is responsible for the players' data, and we handle it only for them, under our data processing agreement. The results are kept with the host's games until the host deletes that game or their account, and at most a year after the game ended. Use a nickname, not your full name, if you prefer. In a game in safe mode you get a name from a neutral list instead.

After the game, the recap page shows the nicknames, emojis, places and awards (no written answers, only number guesses) to anyone with its link, which is random and unguessable. The host and the players get the link; search engines are asked not to list it. It stops working after 30 days, or at once when the host turns it off or deletes the game.

Security logs

The server sees your IP address on each request. We use it to limit how often someone can try to log in, join or redeem a code: the server holds it in memory for the length of that limit (a minute to a day), never writes it to a database or to its logs, and forgets it on a restart (legitimate interest in stopping abuse). Our hosting provider's network sees it too, to deliver the pages. We don't build profiles.

Error reports

When something breaks on the server, or in the browser on the TV, a phone or a host's page (which tells our server), our server sends an error report to Sentry, so we can find and fix the fault. A report says what went wrong and where in the code, and may carry the page's address (without anything after its ?), the browser type and the kind of screen. We leave out IP addresses, accounts, passwords, cookies, what was typed, and the links that log someone in or open a TV. Reports are kept for at most 90 days (legitimate interest).

Counting visits

To learn whether the site works for people, our server counts a few steps without any cookie: a visit to a front page, an answer in the demo, a sign-up, a confirmed email, a quiz made, a game started and a payment. A visitor is never identified. For a host, the count carries a scrambled code made from the account, never the name, email or IP address, so we can see how far people get, not who they are (legitimate interest). The counts are kept for at most a year.

Every page also measures how fast it loaded and answered a tap (Web Vitals) and sends three numbers and the kind of page (TV, phone, host or public page) to our server, which adds them to running totals. Nothing says who or where the visitor is, not even the page's address, and nothing is stored with them (legitimate interest).

Who helps us

Who	What for	Where
Fly.io	Runs the app, its database and uploaded files	EU (Stockholm)
Cloudflare (R2)	Holds the backups (R2); DNS	EU
Sentry	Error reports (above)	EU (Frankfurt)
PostHog	Counting visits (above), without cookies	EU (Frankfurt)
Resend	Sending login links and account emails	EU (Ireland)
Stripe (Stripe Payments Europe Ltd.)	Taking payments, receipts; holds the card details	EU, with Stripe's group companies

All six are American companies or part of one (Stripe's European company is Irish), so their staff or parent company may reach the data from the USA. That is covered by the EU–US Data Privacy Framework where the company is certified, and otherwise by the EU's standard contractual clauses in its data processing agreement.

Stripe is also responsible on its own for what the law asks of a payment company (checking for fraud, money laundering rules), under Stripe's privacy policy.

If you sign in with Google or Microsoft, that company tells us your name, email and an id for you, and is responsible for its own login under its own privacy policy. We don't get your password there, your contacts or anything else.

Each of them works under a data processing agreement and may use the data only for us. We never sell personal data. Companies, schools and other organisations that run quizzes for their own people can read our data processing agreement, which lists the same helpers.

How long we keep it

Your account and what's in it: until you delete it. When you ask, you are logged out and the account is erased for good 14 days later (log in before then to keep it, or choose to delete everything at once). Erasing removes your quizzes, files, games, Community listings and login; copies in our backups are gone within 30 days after that. Copies of your quizzes that other hosts already added from a share link or Community stay theirs. A gift card you bought and nobody has redeemed yet keeps working for whoever has its code, without your name on it.
Free trial: a one-way fingerprint of your email address (a hash; the address itself can't be read back from it) and the day your trial ended stay after your account is erased, so the same address doesn't get a second free trial.
Invites: if you joined through a friend's invite, a one-way fingerprint of your email address (a hash; it can't be read back) stays after your account is erased, so the same address isn't invited twice.
Error reports: at most 90 days.
Payment records (what was bought, when, the amount): five years after the year of sale, because the Bookkeeping Act (bokføringsloven) requires it. Stripe keeps the receipts.
Games and players' data: with the host's game, and at most a year after the game ended. Selfies: only while the game runs. Recap pages: 30 days.
Login links expire after an hour (password reset links after 30 minutes), login cookies after 12 hours without use, and 30 days after you logged in at the latest.

Your rights

You can ask to see the data we have about you, have it corrected or deleted, have its use restricted, object to it, and get it in a form you can take elsewhere. As a host you can do most of this yourself on My account: change your name, download your data (one zip with everything, your pictures and sounds too), and delete your account. A player can ask the host to delete a game, or write to us at [email protected].

If you think we handle your data wrongly, tell us; you can also complain to the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no).