Privacy Policy
Last updated: August 29, 2026
1. Data controller
The controller of personal data processed in the Quizzy service (quizzyplace.pl, the "Service") is Anton Merkulau, a private individual running the Service on a non-commercial basis. In all matters concerning personal data you can contact the controller at support@quizzyplace.pl.
This policy fulfils the information duties under Articles 13–14 of the GDPR. It is available in five languages; in case of discrepancies, the Polish version prevails.
2. What data we process, why, and for how long
| Process | Data | Purpose & legal basis | Retention |
|---|---|---|---|
| Account | Name, username, email address, password (stored only as a hash), avatar, preferred language | Providing the account and the Service — Art. 6(1)(b) GDPR (contract) | Until you delete your account |
| Email verification | Email address, verification token | Confirming ownership of the address — Art. 6(1)(b) and (f) GDPR | Until verified; tokens expire automatically |
| Telegram sign-in | Telegram identifier and name received from Telegram during sign-in | Account creation and login — Art. 6(1)(b) GDPR | Until you delete your account |
| Passkeys | For every passkey you add: its public key and identifier, the name you or your device gave it, what kind of device holds it and whether it is synced, and when it was added and last used. A passkey's private key never leaves your device and is never sent to us. | Signing in without a password — Art. 6(1)(b) GDPR (contract) | Until you remove the passkey in Settings → Connections, or delete your account |
| Telegram notifications | The identifier of your chat with our bot, saved when you open that chat from Settings → Connections, and whether the bot can currently reach you (for example, that you blocked it). The link that connects the chat can be used once and expires after ten minutes. | Delivering the notifications you chose to receive in Telegram — Art. 6(1)(a) GDPR (consent) | Until you disconnect Telegram or delete your account |
| Teams | Team name, roster (member accounts), team images | Team functionality — Art. 6(1)(b) GDPR | Until the team or account is deleted |
| Quiz registrations | Team name, number of players, contact name, contact handle or phone number, comment | Handling the registration and passing it to the quiz's organizer — Art. 6(1)(b) GDPR | As part of the quiz history, until deletion of the team or on request |
| Saved contact | Contact name and either a Telegram or Instagram username or a phone number, saved by you on your account or by a team's captains as the team's registration defaults | Filling the registration form in for you — Art. 6(1)(a) GDPR (consent) | Until you change or clear it, or delete your account |
| Absence records | Team name or contact handle, number of players, the quiz and its date, the date the note was made | Where a party booked a place and did not arrive without telling the organizer, the organizer may record it. They see a count when the same party books with them again — Art. 6(1)(f) GDPR (legitimate interest in not holding tables for parties that do not come) | Until the organizer withdraws the note, or on request |
| Cancellation records | Team name or contact handle, number of players, the quiz and its date, when the sign-up was made and when it was withdrawn | Where a sign-up is withdrawn before the quiz — by you or by the organizer — the sign-up itself is deleted and this note is kept. Organizers see how often places are given back, as counts rather than as a list of parties — Art. 6(1)(f) GDPR (legitimate interest in planning how many tables to hold) | Until the organizer withdraws the note, or on request |
| Results & ratings | Team results of quizzes, computed rating points | Public leaderboards and team statistics — Art. 6(1)(f) GDPR (legitimate interest in providing the core rating functionality) | For the operation of the Service |
| Achievements | Which milestone was earned, when, and by whom it was earned — your account, a team or an organizer. The badge's own name and picture come from the catalogue, not from you. | Showing what has been earned on profiles and team pages — Art. 6(1)(f) GDPR (legitimate interest in providing the core rating functionality) | For the operation of the Service. Achievements earned before an account is deleted are not removed with it: they belong to results that were published at the time, and the deleted account is no longer named beside them. |
| Notifications | Notification content and delivery data (in-app, Telegram) | Informing about quizzes, teams and registrations — Art. 6(1)(b) GDPR | Until read/expired or account deletion |
| Seat alerts | Which quiz you asked to be told about when a place opens up, your account, and when you asked. No one else is shown that you are waiting. | Sending the alert you asked for — Art. 6(1)(b) GDPR | Until you withdraw the alert, register for that quiz, or delete your account — whichever happens first |
| Quiz ratings & comments | Score, comment, author account, rated quiz | Feedback to organizers and quality of the Service — Art. 6(1)(f) GDPR | For the operation of the Service or until removal |
| Support & reports | Correspondence, reporter email in illegal-content reports | Handling requests and content reports — Art. 6(1)(f) and (c) GDPR (Digital Services Act obligations) | As long as needed to handle the matter, then up to 12 months |
| Security | IP address, request metadata, technical logs, rate-limiting counters | Security, abuse and fraud prevention — Art. 6(1)(f) GDPR | Short-lived; no longer than 12 months |
| Deletion records | The internal identifiers of the deleted records and the names of the deleted files, with the date of the deletion — no names, addresses or contact details | Making a deletion permanent, including after a backup is restored — Art. 6(1)(c) GDPR (the duty to erase under Art. 17 GDPR) and Art. 6(1)(f) GDPR | For as long as a backup made before the deletion could still be restored |
| Analytics (Google Analytics) | Pseudonymous usage statistics: pages visited, device and browser information, approximate location, and what was done on the Service — searches and filters and how many results they returned, which quiz was opened and from which list, the steps of a registration and how it ended, signing up and signing in and by which method, and the star rating left with a review. Numbers are sent in ranges (for example a party of “4-6”), never exactly, and free text is never sent — with one exception, the search phrase itself, which is shortened and is dropped entirely if it looks like an email address or a phone number. The text of a review, contact details and the names of teams and people are never sent. Some of these events are sent by our own server rather than by your browser; see the Cookie Policy. | Understanding how the Service is used — Art. 6(1)(a) GDPR (your consent given in the cookie banner) | Per the shortest available Google Analytics retention setting; consent can be withdrawn at any time |
Providing data is voluntary, but without the data marked as required in the forms we cannot provide the given functionality (e.g. an account cannot be created without an email address or a Telegram account).
3. Sharing data with organizers
When a team registers for a quiz, the registration data (team name, number of players, contact name and handle or phone number, comment) is made available to the organizer of that quiz so that they can run the event. The organizer is an independent controller of the data received and processes it in accordance with their own obligations; the rules binding organizers are described in the Organizer Terms.
An organizer may also record that a party which booked a place did not arrive and did not tell them beforehand. Only that case is recorded — a party that withdraws, at any point before the quiz starts, leaves nothing behind. When the same team or contact books with that organizer again, the organizer sees how many times it has happened. It is visible to that organizer only, never publicly and never to other organizers, and it is included in the copy of your data you can download in Settings → Privacy. You may ask the organizer to withdraw a note, or us to remove it.
4. Recipients of data
Data is processed with the help of the following categories of recipients:
- the hosting provider of the Service's infrastructure;
- the email (SMTP) provider used to send service messages;
- Telegram (when you choose to sign in via Telegram, and when you connect the notification bot — the content of the notifications we send you is transmitted to Telegram; Telegram acts under its own terms);
- Google (when analytics consent is given — Google processes Google Analytics data on the controller's behalf. Part of that data reaches Google from your browser and part is sent by our own server, which reports events only it can see, such as a registration being recorded; calendar integrations use Google services for event data).
5. Transfers outside the EEA
Data is stored within the European Economic Area. When Google Analytics is enabled with your consent, data may be transferred to Google LLC in the United States on the basis of the EU–US Data Privacy Framework; where the framework does not apply, Standard Contractual Clauses are used. This covers both the data sent from your browser and the events our own server reports; without your consent neither is sent.
Signing in via Telegram, and the notifications delivered to you there, involve Telegram, which operates outside the EEA. That transfer happens only for the channel you chose to use, and covers only what signing you in or delivering the message requires — Art. 49(1)(a) and (b) GDPR.
6. Your rights
You have the right to:
- access your data and receive a copy of it;
- rectify inaccurate data;
- have your data erased;
- restrict processing;
- data portability;
- object to processing based on legitimate interest;
- withdraw consent at any time (e.g. for analytics cookies — via the cookie settings in the footer), without affecting the lawfulness of processing before withdrawal.
Deleting your account takes effect after the grace period shown when you ask for it. Your name, username, email address, Telegram connection, avatar and saved contact are deleted, together with your notifications, your quiz ratings and the alerts you asked for when a quiz was full. The account itself stays behind as an empty record holding nothing but an internal identifier: other teams' results and registrations refer to it, and removing it would damage their records. A team you were the only admin of passes to the member you name, and an organizer left without an admin is marked as no longer operating.
Two things stay on purpose. The contact details on a registration stay with that registration — they are the contact the party gave for that event, which is not always the person who filled the form in, and the organizer needs them to run it; write to us and we will remove the ones you gave. Absence and cancellation notes stay as described in section 3. The rest is gone and stays gone: we keep backups of the Service for up to six months, and a deletion we have confirmed to you is carried out again after any restore, so a backup cannot bring the data back.
To exercise your rights, write to support@quizzyplace.pl. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO, ul. Stanisława Moniuszki 1A, 00-193 Warsaw, uodo.gov.pl).
7. Automated decision-making
The Service does not make automated decisions that produce legal effects concerning you or similarly significantly affect you. Team ratings are simple arithmetic computed from publicly uploaded quiz results, as described in the appendix to the Terms of Service.
8. Cookies
The cookies and similar technologies used by the Service, including the analytics category that requires your consent, are described in the Cookie Policy. You can change your choices at any time via the cookie settings available in the footer.
9. Changes to this policy
This policy may be updated, in particular when the Service's functionality changes (e.g. when analytics is enabled). The current version with its date is always available on this page.