Privacy Policy
Last updated: 8 August 2026 · Türkçe
QQuiz is a trivia game playable in English and Turkish. This policy describes what data is processed when you use the app and the qquiz.app website.
In short: you do not need to sign in to play — the app opens an anonymous account for your device on first launch. You may optionally sign in with Google — and on the web version, with an email address and password; only if you choose that is your email address stored. We use no third-party analytics service and we never sell your data. The Android app does show Google AdMob ads — the web version shows none — and serving one means Google processes your device's advertising ID. See section 7.1.
The one thing to be aware of is your username: it is generated for you and you can change it, and other players see it on the daily contest leaderboard and in any duel room you join. See section 3.
1. Data controller
Selim Derbent — derbentselim@gmail.com. Write to this address with any privacy question or request.
2. Your account
The first time the app opens it generates a random identifier (UUID) on your device and creates an anonymous server-side record keyed to it. That identifier is not your device's hardware serial, IMEI, MAC address or advertising ID; it is a random string the app makes up for itself. Uninstalling and reinstalling produces a new one.
That anonymous account is enough to play. If you want to carry your progress to another device, Settings offers two optional sign-in methods. Both attach to the same account rather than creating a new one:
| Method | Stored | Not stored |
|---|---|---|
| Sign in with Google | Your Google account's permanent identifier and your email address | Your profile picture, your contacts, any other Google data. The ID token Google issues is only verified; no Google service is ever accessed on your behalf. |
| Email and password web version only |
Your email address and a bcrypt hash of your password | The password itself. Passwords are never stored in clear text and cannot be recovered. We email a six-digit code to confirm your address; that code is stored only as a hash too. |
Your email address is used only to recognise your account and to send the verification code. We send no marketing email and add your address to no list. If you use none of these methods, your email address is never asked for. Email and password registration exists on the web version only; in the Android app on the Play Store, Google is the only way to sign in.
3. Your username — the one thing others see
Your account is given a username automatically the moment it is created (something like "Player4821"). It is stored on the server and is unique across all players — the game's leaderboards cannot show a player who has no name. You can replace it with one of your own from the home screen at any time; you are never required to.
That name is visible to other players, in three places:
- The daily contest leaderboard: everyone who plays that day's contest sees every other entrant's username, avatar icon and score. The board is open to all players of the same language.
- Duel rooms: when you join a room, the other players in it see your username and avatar. Rooms are not public — only people who know the five-character room code or the invite link can join.
- Friends lists: a friends list is opt-in on both sides and needs a signed-in account. Adding someone is by typing their exact username — there is no directory and no search, so nobody can browse for you. Once you have added each other, they see your username and an indicator of whether you are around or in a game; they never see what you are playing, who you are playing with, or the code of the room you are in. Anyone who sends you a request sees your username on it, because they typed it. You can remove or block anybody at any time, and a block stops requests, room invites and that person taking a seat in a duel room you are in — even if they got hold of the code from somewhere.
- Friends-only rooms: when you open a duel room you can limit it to your own friends. With that on it does not matter who ends up holding the room code — nobody who is not your friend can take a seat.
For that reason you do not have to use your real name, and we recommend you don't. You can change it at any time in Settings. The name you choose is screened server-side against an offensive-content filter, and invisible Unicode marks that change the direction of text are stripped.
4. Data processed
| Data | Why | Where |
|---|---|---|
| Anonymous device identifier (UUID) and session token | To avoid asking you the same question twice and to keep your progress | Server |
| Your username and avatar number | To show you on leaderboards and in duel rooms (see section 3) | Server — visible to other players |
| Your email address and the bcrypt hash of your password — only if you choose email/password sign-in on the web version (the Android app does not offer it) | To recognise your account, let you sign in, and send the code that confirms your address | Server |
| Your Google account identifier and email address — only if you choose Google sign-in | To recognise your account and let you reach the same progress on another device | Server |
| Language preference (e.g. "en") | To serve questions in the right language — the server decides which language's questions you are shown | Server |
| Which questions you have seen, whether you got them right, and when | To avoid repeating questions | Server |
| Your thumbs-up / thumbs-down votes on questions | To retire bad questions from the pool. Tied to your account so the same question cannot be voted on twice and so you can undo a vote; no other player ever sees your vote | Server |
| Question reports you send (the reason and your optional note) | To fix the quality of the question pool | Server |
| Players you report — only if you report one: who you reported, the reason, your optional note, and the username that account had at the time | To review offensive usernames and behaviour. The person reported is never told who reported them. If you delete your account your note is deleted with it; the report itself stays, because it is about somebody else's account — a complaint that vanished when you left would only suit the account you complained about | Server |
| Your daily contest and duel results (score, rank, number correct, time, and the username you had at the time) | To build the leaderboard and keep your record | Server — your leaderboard row is visible to other players |
| Usage statistics: which screen you opened, which control you pressed, which mode you played, whether you finished a round, which errors you saw; plus your device platform (Android/web) and the app version | To understand which parts of the app work and where you get stuck, and improve it. These records stay with us; no third-party analytics service (Google Analytics, Firebase, etc.) is used. What you type — your custom topic, your username — is not included; only which action you took | Server |
| Server logs: IP address, request time and path | Security, abuse and fault diagnosis | Server, at most 30 days |
| Your coins, level, energy, badges and per-category records | Your game progression | On your device only — never sent to the server |
| Advertising ID, approximate location (country/city, from your IP), device and app information — Android app only | To serve and measure ads (Google AdMob). See section 7.1 | Google — never reaches us |
| A single-use record of a rewarded ad you watched: your account id, which reward, and when | To stop the same reward being claimed twice | Server |
| Friend links — only if you add friends: the two account ids, whether the link is requested, accepted or blocked, which side asked, and which side blocked | To show your friends list, to let you be invited into a friend's room, and to keep a block working. Deleted when either of you removes the other, and with your account if you delete it | Server |
| That you were recently active, and whether you are in a duel room — plus any room invite waiting for you | So your friends can see who is around to play. Held in the server's memory only, never written to the database, and gone when the server restarts | Server (memory) |
5. When you create your own category
On the "My Topic" tab of the category screen you can type your own subject. When you do, that text is sent through the AI provider OpenRouter to language-model providers so questions can be written for it. Your anonymous identifier, your username and your email address are not attached to that request — only the text you typed is sent.
Playing a ready-made category makes no AI call at all; those questions come from the existing pool.
6. Where data is held
The server and database are hosted on Google Cloud infrastructure. All traffic between the app and the server is encrypted with TLS (HTTPS), and the app forbids unencrypted HTTP connections outright at the operating system level. Verification-code emails are sent through the configured SMTP provider.
7. Sharing
We do not sell your data and we share it with nobody for marketing. The technical services involved are: Google Cloud for hosting; OpenRouter for question generation, only when you type your own topic; the SMTP provider that carries the verification code, only when you register by email; and Google, only when you sign in with Google, to verify your identity. Information may be given to authorities where legally required.
Separately from that, your username and avatar are shown to other players (see section 3). That is not a transfer to a third party; it is the game itself.
7.1 Ads (Android app only)
The Android app shows ads through Google AdMob. They pay for the AI question generation that runs when you write your own topic. A full-screen ad only ever lands at the end of a solo round, and only every few rounds; duels and the daily contest never show one, and nothing interrupts a round in progress. Rewarded ads play only when you ask for one. The web version (qquiz.app) has no ads at all.
To serve an ad, Google processes your device's Advertising ID, approximate location (country/city level, from your IP address), and device and app information, under its own privacy policy. None of that reaches us — it is collected and processed by Google directly. See How Google uses information from sites or apps that use our services.
There are two kinds: an occasional full-screen ad between rounds, and an entirely optional rewarded ad (for energy, coins, or another AI topic). Watching a rewarded ad is always your choice, and declining it closes off no part of the game.
Players in the European Economic Area, the UK and Switzerland are shown Google's consent form before any ad is requested. You can change that decision at any time under Settings → Ad privacy settings. If you decline personalisation, ads continue to be shown, non-personalised.
The only thing our own server keeps about an ad you watched is a single-use record that stops the reward being claimed twice: your account id, which reward it was, and when. What the ad contained, what you saw and what you tapped never reach us.
8. Retention
Your account and the game history attached to it are kept until you delete them. Server access logs are deleted after at most 30 days. An unverified email registration and its code hash become invalid when the code expires.
9. Deleting your data
In the app, go to Settings → Privacy and Data → "Delete my account and data". It takes effect immediately and cannot be undone: your server-side account record is deleted in full — including your email address, your Google link, your username, your question history, your votes, your reports and your contest results — and your on-device progress is reset.
The one exception is usage statistics: counter rows of the form "a player opened this screen" are not deleted, but their link to you is permanently severed — the account field on the row is emptied and nothing pointing at you remains. The reason is that deleting one account must not retroactively change totals for past months.
You do not have to delete your account to have your data erased. The row above it, "Erase my data, keep my account", removes your question history, your votes, your reports, your contest and duel results, your streak and your on-device progress, while your username, your sign-in and your friends list stay. Your friends list, the people you have blocked, reports other players filed about you, and records of rewarded ads you watched are kept — the reasons are set out on the data deletion page.
If you have already uninstalled the app, see the data deletion page.
10. Your rights
Under GDPR (and Turkey's KVKK) you have the right to access, correct or erase your data. Send requests to derbentselim@gmail.com. If you play anonymously, include your anonymous identifier so the right record can be found; you can copy it from Settings → Privacy and Data. If you signed in with Google or email, writing from the address attached to your account is enough.
11. Children and teenagers
The app is intended for players aged 13 and over. It is not directed to children under 13 and does not knowingly collect data from them. The target age groups declared on the Google Play listing are 13-15, 16-17 and 18+.
Because the audience includes players under 18, the ads shown in the Android app are capped at the "G" content rating -- suitable for general audiences: alcohol, gambling, dating and adult-themed ads cannot be shown in this app. Ads come from Google AdMob and from no other ad network; what they collect is set out in section 7.1. There are no in-app purchases.
Questions the AI writes from a topic a player typed are generated to the same age limit, and the topic itself is checked for suitability first; a topic that fails that check produces no questions.
There is no free-form messaging between players: the only things players can see about each other are the username and avatar they chose themselves and, between friends, whether the other is around or in a game. Nothing a player types is ever shown to another player.
12. Changes
If this policy changes, the "last updated" date above is refreshed. Significant changes are announced in the app.