Privacy Policy

Who we are

QandA.fun (“QandA”, “we”, “us”) is a live quiz service operated by Neovate s.r.o., a limited liability company registered in the Czech Republic, with its registered office at Branická 213/53, Braník, 147 00 Praha 4, Czech Republic, Company ID (IČO) 23036028, VAT ID CZ23036028, entered in the Commercial Register kept by the Municipal Court in Prague, section C, insert 420347.

Neovate s.r.o. is the controller of the personal data described in this policy: it decides why and how that data is used. We haven’t appointed a data protection officer. For anything about your privacy or your data, email [email protected] or write to us at the address above.

What we collect

We only collect what you give us or what the service needs to work:

• Account details. If you sign in with email, we store your email address and when you confirmed it. If you continue with Google, we store your email address, the fact that Google has verified it and Google’s ID for your account, so we recognise you next time. We never store your Google name or profile picture. There are no passwords.
• Sign-in emails. To sign you in, we email you a one-time link and an 8-digit code that expire after 15 minutes. The code works only together with the email address it was sent to, and wrong codes for an address are limited per hour. To limit abuse, we count sign-in emails per address using a one-way hash of the address instead of the address itself.
• Guest identity. When you first open QandA.fun, we create a random guest ID so you can join games without an account, and your browser keeps the sign-in for it. The games you join as a guest, with your nicknames and answers, are stored under that ID on our servers, but it isn’t linked to an email address or any other account details.
• Public name. If you set one, your public display name is shown with quizzes and themes you publish and with games and rooms you list publicly. It is never your email address.
• Content you create. Quizzes and their questions, answers, explanations, covers, language, category and tags; themes; folders; the images, audio and video files you upload; and links to media hosted elsewhere, such as YouTube videos.
• Game activity. The nickname and avatar you choose when you join a game or room; your answers, including any text you type into open-answer and word-cloud questions; how quickly you answered; your scores, ranks and streaks; and when your device was last connected to a game. Emoji reactions you send during a game are stored without any link to you.
• Progress. Your XP and where it came from, your level, your game history and best scores, your Quiz of the Day results and streak, and your attempts at friend challenges and assignments.
• Feedback. The star rating and the “fun” and “learned something” answers you give after a game.
• Reports about quizzes and themes. If you report a quiz or theme, or the quiz of a game or auto room you played, we store what you reported, the reason you chose (sexual content, hate or harassment, violence or dangerous acts, spam or misleading, copyright or someone else’s work, personal information, or something else), any note you add, the game you reported it from, and your account, so we can review it.
• Reports about players. If you report a player for their nickname, a host’s or room owner’s public name, or an answer or word they sent, we store the report in the same way, with the game, room, Quiz of the Day list or challenge board it is about and the reason you chose (an offensive or inappropriate name, an offensive answer or word, bullying or harassment, spam, or something else). As evidence, we also keep a copy of what was reported as it was shown when the first report arrived: the player’s nickname and avatar, where and when it was shown and, in a game with a host, up to the 10 most recent answers and words that player typed in that game, plus the answers or words reporters pointed at. That copy stays even if the player later changes their nickname or a host removes them from the game, so we can review the report, until it is deleted as described in How long we keep data: 180 days after we decide (or after the last report, if we haven’t decided by then), or with the reported player’s account. The record of our decision keeps the nickname or public name the report was about, so we can tell decisions apart, until the reported account is deleted.
• Reports about AI content. If you use Report AI content in the quiz editor, we store the reason you chose (offensive or harmful, wrong or misleading, or something else), any note you add, the text you reported (a question the AI wrote in your quiz, or a suggestion it showed you), which AI feature it most likely came from, the AI service in use when you reported it, and your account. Our moderators review it; nothing is sent to the AI service.
• We never show who sent a report, not to the person reported, not to the author and not in our moderation tools.
• Blocks. If you block an author or a player, we store that, with the title of the quiz or theme or the nickname you blocked them from (shown to you on your profile; for a player, our moderators also see that nickname and how often that person was blocked recently, never who blocked them), so we can hide their quizzes, themes and public games from you, hide their nickname on your screens where you play, and refuse their new joins to games you host (the host screen of your own game still shows the nicknames of players already in it, so you can remove them).
• AI confirmation. Before you first use Create with AI or AI suggestions, you confirm that you are 18 or older and that you agree to send the material you give to the AI service. We store that you confirmed, when, and for which AI service, so we ask again if the service changes.

We don’t ask for your real name, phone number, birthday, location or contacts, and our own code doesn’t store your IP address.

AI features

• Create with AI and AI suggestions are for adults only: you must be 18 or older, and you confirm this before you first use them. Our servers refuse these features until you have confirmed. When you ask QandA.fun to write a quiz from a text, a PDF, a web page or a topic, or to suggest options, accepted answers or a rewrite for a question, we send that material or question to Google’s Gemini API to produce the result. We attach no name, email address or account ID to it. Our code doesn’t store or log the material you give us or the model’s raw reply: only the result is saved. The quiz it writes is saved as a private quiz in your account, and suggestions are saved only if you apply them. Google processes the request under its Gemini API terms and may keep it for a limited time, for example to detect abuse. Don’t paste personal information about pupils, other children or anyone else.
• AI grading. Open-answer questions use AI grading unless the quiz’s author switches it off for that question; it is on by default, and a host can’t change it. In hosted games, auto rooms, solo play, challenges and assignments alike, an answer that doesn’t match one of the author’s accepted answers is checked by JEV (TypeSafe System One), the AI grading service we use. It receives the question, its accepted answers and the answer texts as they were typed, labelled only a0, a1 and so on. We attach no names, nicknames or IDs, but anything a player types into an answer is sent as it is, so don’t put personal information in an answer. Before you join a game, auto room, challenge or assignment with such a question, or play one solo, we tell you that some typed answers are checked by an AI service. We don’t log the answer texts or the grader’s replies.

How we use it

• To run the service: sign you in, save your quizzes and themes, run live, solo and auto-room games, grade answers, and show scores, reports, history, XP and streaks.
• To keep it safe: limit how often actions can be repeated, prevent abuse, check names, nicknames, tags and theme names against a list of blocked words, review reports about content and players, tell our moderators when a new report arrives, and enforce our Terms of Use, for example by hiding content, removing a player’s nickname and answers from a game, or suspending an account.
• To send sign-in emails. We don’t send newsletters or marketing emails.
• To understand how QandA.fun is used, from daily counts that identify no one, such as how many games were played on a day.

We don’t sell or rent your data, show ads, build advertising profiles or share your data with advertisers.

Our legal bases

Under the EU General Data Protection Regulation (GDPR), we use personal data only on these legal bases:

• Providing the service you use, as described in our Terms of Use: your account and sign-in, the quizzes and themes you create, the games you host or join, grading, scores, history, XP, challenges, the AI features you ask for, and deleting your data. This is necessary to perform our contract with you (Article 6(1)(b) GDPR).
• Running games for the people in them, where we can’t rely on a contract with a player, for example because of their age: our legitimate interest, and the host’s, in running the games people choose to join (Article 6(1)(f)).
• Keeping QandA.fun safe: rate limits, the blocked-word filter, reports about quizzes, themes and players with the evidence we keep, blocks, hiding content, removing a player’s nickname and answers, suspending accounts and telling our moderators about new reports. Our legitimate interest, and our users’, in a service free of abuse (Article 6(1)(f)), and our legal obligations where the law requires us to act on notices of illegal content (Article 6(1)(c)).
• Keeping the AI features for adults: we store your confirmation because of our legitimate interest in offering them only to users 18 or older, as our AI providers require (Article 6(1)(f)).
• Statistics and Cloudflare Web Analytics: our legitimate interest in understanding and improving how QandA.fun is used (Article 6(1)(f)). Our statistics are daily counts that identify no one.
• Answering your requests, complying with the law and handling legal claims: our legal obligations (Article 6(1)(c)) and our legitimate interest in establishing or defending legal claims (Article 6(1)(f)).

Where we rely on legitimate interests, we have weighed them against your interests and rights, including those of younger users, and you can object: see Your choices and rights.

What other people can see

• Anyone can see the quizzes and themes you publish, with your public name. Public quiz pages show the questions but not the answers, and search engines may index them. Other users can play, host and copy (Duplicate) a published quiz, and use or fork a published theme.
• In a game, the host and the other players see your nickname, avatar, score and rank. The host also sees your answers, can open a report of the game and can download it as a spreadsheet.
• Word-cloud answers appear on the host’s screen after a filter for offensive words.
• Anyone with a friend challenge link sees its board: names, avatars and scores. The owner of an assignment sees each student’s name and results.
• The Quiz of the Day top list shows the names only of players who were signed in and chose to show their name. We remove names from these results after 30 days.
• Public games and auto rooms listed on Play now show the quiz title and the host’s or room owner’s public name.
• Our moderators see what was reported to them, with the evidence we keep, and which people were blocked often recently (with the nickname they were blocked from), but never who reported or blocked them.
• If someone blocks you, your quizzes, themes and public games are hidden from them, and your nickname is hidden on their screens where they play, and you can’t join new games they host. You aren’t told.

Who helps us run QandA.fun

We use these service providers. Each receives only what it needs for its task:

• Convex: our backend. It stores the database and uploaded files and runs our server code, so everything described in this policy is stored there.
• Railway: hosts the website’s web server.
• Cloudflare: delivers the website securely and quickly, and provides Cloudflare Web Analytics, which counts page views without cookies.
• Resend: delivers sign-in emails, and short notices to our moderators that a new report is waiting. It receives the recipient’s email address and the email’s contents. A notice to our moderators contains neither the reported content nor who reported it.
• Google: Sign in with Google, if you choose it, and the Gemini API for the AI features described above.
• TypeSafe (JEV System One): grades open answers as described above.

These providers handle your IP address and technical request data, such as your browser type, when they deliver the service, and may keep it in their logs for a limited time under their own policies.

Embedded YouTube videos load from youtube-nocookie.com, YouTube’s privacy-enhanced mode. When a question shows one, your browser connects to Google, which receives your IP address and technical request data, and YouTube may store information on your device under Google’s own policy. Media an author linked from another website loads from that website, which receives your IP address and may set its own cookies under its own policy.

We may also disclose information when the law requires it, or to protect people’s safety or the service from abuse.

Cookies and browser storage

QandA.fun stores a few items in your browser so it can work. None of them is used for advertising or to track you across other websites:

• Sign-in tokens that keep you signed in, as a guest too. A sign-in lasts up to 30 days on a device.
• The qanda_language cookie and a matching browser setting, saved when you choose a language so pages open in it. The cookie lasts one year.
• Your appearance choice: light, dark or system.
• Sign-in helpers: a random value that checks a sign-in link is opened in the browser that asked for it; the email address you asked for a sign-in link or code, used for 15 minutes so a link opened in this browser can finish signing you in and so the tab you asked from still offers the code entry after it reloads; and markers that carry a Google sign-in or “Keep my identity” through the sign-in redirect. The address stays in this browser until you sign in here with that link or code, delete your account here, or open the sign-in page again after the 15 minutes; the tab’s copy also goes when you close the tab.
• A marker for the current tab that tells the website it is running inside a QandA.fun app. It is set when the QandA.fun Android app opens the site, and a tab opened from a marked tab may keep it. It holds no personal data and only changes what the page shows.
• Your last nickname and avatar, and the codes of games you joined, so you can rejoin quickly.

Cloudflare Web Analytics counts page views and visits, the pages viewed, the referring website, your country, your device type and how fast pages load. It uses no cookies and doesn’t identify you. Cloudflare may set strictly necessary security cookies when it protects the site from attacks.

How long we keep data

• Your account, public name, quizzes, themes and folders: until you delete them or your account. Deleting your account removes your sign-in at once and the rest usually within half an hour; Delete your account and data lists what is deleted, anonymised and kept.
• Games, including the players’ answers: kept so hosts can see reports and players their history. They have no automatic expiry today; they are deleted when the host’s account is deleted. When a player deletes their account, their nickname and typed answers are removed from games hosted by others; their scores and feedback ratings stay without their name.
• If you played as a guest and your guest sign-in has ended, you can’t delete those games’ data yourself. Email us with the game code, the nickname you used and roughly when you played; if that lets us find your entries, we will anonymise them in the same way.
• Your XP and its history, game history, best scores and daily streak, and the friend challenges and assignments you create: until you delete your account.
• Quiz of the Day results, the entries behind the daily top list: names are removed from them after 30 days, and they are deleted after 400 days. The game you played is kept in your game history like any other game.
• Uploaded files: deleted by a daily clean-up once they are more than a week old and nothing uses them anymore: no quiz, theme, game from the last 30 days, Quiz of the Day or challenge. Files whose upload never finished are deleted within an hour.
• Sign-in links and codes: they expire after 15 minutes, work once and are deleted by a daily clean-up. Sign-in sessions end 30 days after you sign in and are then deleted by the same clean-up.
• Sign-in requests that were never completed: the email address, and the counter that limits how many sign-in emails it can receive (kept as a one-way code of the address), are deleted within two days. For an account, that counter is deleted with the account.
• Guest identities that never joined a game or room: deleted at least 30 days after they were created. A guest who played keeps their game data like any player until they use Delete my data, which is possible only while the guest sign-in lasts (up to 30 days in that browser).
• Emoji reactions: deleted about 15 minutes after they are sent.
• Reports: kept as the record of our moderation decisions. The record of a report about a player keeps the nickname or public name it was about until the reported account is deleted. The copy of a player’s nickname, answers and words kept as evidence with a report, and the notes reporters added, are deleted 180 days after we decide on the report, or 180 days after the last report about it if we haven’t decided by then. If you delete your account, your reports are deleted, except a report on something we are still reviewing, which stays without your account and without any note you added, until we decide. Reports about you and your content, with their evidence, are deleted with your account.
• Reports about AI content: kept, also after we have handled them, until you delete your account.
• Blocks: until you unblock the author or player, or either account is deleted. A suspension: until we lift it or the account is deleted. Your AI confirmation: until you delete your account.
• Statistics that identify no one, such as daily counts: kept indefinitely.

Security

All connections to QandA.fun are encrypted with HTTPS. Only you can edit your content. Your private quizzes aren’t listed or shown on public pages; the people you play them with see their questions during the game, and only the host of a game sees its report. Uploaded files are delivered from long, hard-to-guess links, so anyone who is given such a link can open the file. Our administrators and the service providers above access data only when they need to run, support or moderate the service. No service can promise perfect security, but if a problem affects your data, we will act quickly and inform you and the authorities when the law requires it.

Your choices and rights

• Delete your account or guest data at any time. See Delete your account and data.
• See your data. Your profile shows your XP history, games, best scores and daily streak, and My quizzes shows everything you created. Email us for a copy of the rest.
• Correct your data. Change your public name from the account menu, and edit or delete your quizzes and themes whenever you like.
• Choose whether to use AI. AI writing features run only when you choose them, and only after you confirmed that you are 18 or older. Whether AI grading is used depends on the quiz’s settings, chosen by its author; before you join or play a quiz that uses it, we tell you that some typed answers are checked by an AI service, so you can choose not to play.

Under the GDPR you also have the right to:

• access the personal data we hold about you and get a copy of it;
• have inaccurate data corrected;
• have your data deleted;
• restrict how we use your data, for example while we check a complaint;
• receive the data you gave us in a structured, machine-readable format and have it passed to another service (data portability);
• object at any time, on grounds relating to your situation, to our use of your data based on legitimate interests.

To use any of these rights, email [email protected] from the address you sign in with. It’s free. We answer within one month; for complex requests we may need up to two more months, and if so we tell you within the first month.

AI grading and the blocked-word filter are automated. In a hosted game, the host sees every answer and its grade in the game’s report. If you think an automated decision about you was wrong, email us and a person will review it.

You can also complain to a data protection authority: in the Czech Republic, the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz, or the authority in the EU country where you live or work, or where you believe your rights were infringed.

Children

QandA.fun is for people aged 13 and older: you must be at least 13 to use it, as a guest player too, and at least 18 to use Create with AI and AI suggestions. It is not directed to children under 13, and we don’t knowingly collect their personal information.

If you host games for a class or group, make sure every player is at least 13, follow your school’s or organisation’s rules, and ask players to use a nickname rather than their full name.

If you believe a child under 13 has given us personal information, email [email protected] and we will delete it.

International transfers

Neovate s.r.o. is established in the European Union. Some of our service providers, or companies that help them, store or process data outside the European Economic Area, including in the United States, where data protection laws may differ from those where you live. We share with each provider only what it needs to do its job.

When personal data is transferred outside the European Economic Area, it must be protected by a safeguard the GDPR recognises, such as an adequacy decision of the European Commission (for the United States, the EU-U.S. Data Privacy Framework, for companies certified under it) or the European Commission’s Standard Contractual Clauses. Email [email protected] to ask which safeguard applies to a provider and for a copy of it.

Changes to this policy

When we change this policy, we update the date at the top. If a change significantly affects how we use your data, we will announce it on QandA.fun before it takes effect.

Contact

Questions or requests about your privacy: [email protected]. You can also reach us through our Contact page, or by post: Neovate s.r.o., Branická 213/53, Braník, 147 00 Praha 4, Czech Republic.