Cookie Policy

1. What Are Cookies?

Cookies are small text files placed on your device by a website. They allow the site to remember information about your session and preferences. We also use a related browser technology called localStorage, which stores data locally on your device without transmitting it to us.

2. Cookies We Use

2a. Essential Cookies (Cannot Be Disabled)

These cookies are strictly necessary for the service to function. The site cannot operate without them.

• Supabase session cookie (sb-…-auth-token) — Set on kwizzy.online by our authentication provider Supabase. Stores your login session so you remain signed in while navigating the dashboard. Expires when you sign out or after the session period.
• Stripe fraud prevention — Stripe sets cookies (__stripe_mid, __stripe_sid) to detect and prevent fraudulent payment activity. Required for any page where billing is initiated. These are first-party cookies scoped to kwizzy.online and are compliant with PCI-DSS requirements.
• CSRF protection tokens — Short-lived tokens that protect form submissions from cross-site request forgery attacks. Session-scoped only.

2b. Local Storage

Kwizzy does not store anything about players in cookies or localStorage. The only thing a player's browser keeps is a sound on/off preference (the music and sound-effects mute buttons), saved in localStorage on that device and never sent to us. Signed-in teachers also get one small first-party cookie, kz_lang, that remembers the language they chose for the teacher pages (it holds only a language code and lasts a year); players and visitors never receive it, because for them the language is part of the web address. Solo play runs in memory in your browser, and your authentication provider may keep session data in your browser while you are signed in.

2c. Analytics

Kwizzy uses PostHog for privacy-conscious product analytics: a small number of events such as “a quiz was started” or “a quiz was finished”, with the score and which questions were missed. We do not use analytics cookies or browser storage for this, we turn off automatic click capture and session recording, we do not record IP addresses, and we never send names, question text or anything a person typed. Players are never identified. Signed-in teachers are linked to an anonymous account ID (not their email or name) so we can understand how teacher features are used. Analytics are switched off if your browser sends a Do Not Track signal. We do not use Google Analytics, Facebook Pixel or Hotjar.

2d. Page performance measurement

Kwizzy does not show advertising on its pages. To evaluate how our pages perform, the Kwizzy website and the signed-in teacher pages can load the Google tag, but only after you accept it in the cookie banner. Until then nothing from Google is loaded. If you accept, it may set cookies and send Google your page address, browser details and IP address; see how Google uses data from sites that use its services. You can change your mind at any time with “Cookie settings” in the footer: declining removes the cookies the tag set. Your choice is stored in this browser only (localStorage, key kz_consent) and is never sent to us. The tag and the banner are never loaded on the screens students use (joining, live games, the Big Screen, homework and solo play), and the tag is switched off if your browser sends a Do Not Track signal. We do not sell your data.

3. Third-Party Cookies

The following third-party services may set cookies when you interact with their components embedded in Kwizzy:

• Supabase and your chosen sign-in provider (Google, Apple or Facebook) — Authentication. See Supabase Privacy Policy; the sign-in provider's own cookies apply on its sign-in page.
• Google (Google Ads tag) — Page performance measurement, only if you accept it. Not loaded for students. See Google Privacy Policy.
• Rytedesk — Support chat on the Kwizzy website and the signed-in teacher pages. It may set cookies or use browser storage to keep a conversation going. Not loaded for students.
• Stripe — Payment processing fraud prevention. See Stripe Privacy Policy. Stripe cookies are loaded only on pages where a payment action is initiated (e.g., the Pricing page).

Note: Players using the live game interface (/play/, /join/), homework and solo play receive no cookies from Kwizzy or any third-party service. The player experience is cookie-free by design.

4. How to Manage or Delete Cookies

You can control cookies through your browser settings. Instructions for major browsers:

• Google Chrome
• Mozilla Firefox
• Apple Safari
• Microsoft Edge

Note: Disabling essential cookies (Supabase session cookie) will prevent you from signing in to your account. Playing library quizzes and joining games are not affected.

5. GDPR Lawful Basis for Cookies

Under the EU's ePrivacy Directive and GDPR, we rely on the following legal bases:

• Strictly necessary cookies (Supabase session, Stripe fraud): No consent required. These are necessary for the performance of our contract with you.
• Google tag (page performance measurement): Consent. It loads only after you accept it in the cookie banner, and you can withdraw consent at any time with “Cookie settings” in the footer.

6. Changes to This Policy

We may update this Cookie Policy as we add new features or services. The "Last Updated" date at the top of this page will reflect any changes. Material changes will be communicated via email to registered accounts.

7. Contact

Questions about our cookie practices? Email us at support@kwizzy.online.