Volver a Kwizzy

Privacy Policy

Última actualización: October 2026

Esta página se muestra en inglés. El texto en inglés es la versión legal y es la que se aplica. Si algo no está claro, escríbanos a support@kwizzy.online.

Plain-English Summary: Hosts create accounts and own their quiz content. Players never create accounts — they play library quizzes or join games with a game code or QR code only. We do not collect any personal information from players. Quiz content you upload is processed by Google Gemini to generate questions and is never used to train AI models.

1. Who We Are

Ryteway Labs LLC ("Kwizzy," "we," "our," or "us") operates the Kwizzy platform at kwizzy.online — a quiz platform for playing and hosting quizzes, with AI-assisted quiz creation. Our contact address for all privacy matters is support@kwizzy.online.

2. Information We Collect

2a. Accounts (via Supabase Auth)

You sign in with an email link or with a Google, Apple or Facebook account. We collect through our authentication provider Supabase:

  • Email address
  • Name and profile picture, if provided by the sign-in provider you choose
  • Authentication identifiers (Supabase user ID and the provider's account ID)
  • Session tokens (stored in browser cookies)

This information is necessary to provide the service under a contract with you (Article 6(1)(b) GDPR).

2b. Billing Information (via Stripe)

For paid subscriptions, payment processing is handled entirely by Stripe. Kwizzy never sees, stores, or processes raw card numbers. We store only: your Stripe Customer ID and subscription status (Free / Pro).

2c. Quiz Content

Documents, URLs, or text you upload to generate quizzes are transmitted to Google's Gemini API for processing. We do not permanently store uploaded source documents. Generated quiz questions are stored in our database and remain your property.

2c-2. Flashcards

Flashcard sets you make (written by hand or generated from the same sources as quizzes) are stored in our database and remain your property; pictures on cards are stored with your other quiz pictures. A set is private until you turn its share link on, and you can turn the link off at any time, which stops it working immediately. Anyone with an active link can study the set without an account; studying runs in the browser or app, and we do not record who studied a set, which cards they knew or any progress.

2d. Players — No PII Collected

Players never create accounts. They join hosted games by entering a game code or scanning a QR code, and they play library quizzes without signing in. The only thing a player enters is a nickname, which is shown to the host, on the Big Screen and, for the top places, on other players' phones during the game, and is kept with the game's scores. No name, email, age, or other personally identifiable information is requested; players should be told to pick a nickname that is not their real name.

Solo play runs entirely in your browser and sends nothing to our servers.

Each player's nickname, score and the option they chose for each question are stored server-side with the game, for the leaderboard and post-game reporting, until 60 days after the game ends, when a daily job permanently deletes the game and everything stored under it. They are deleted sooner if the teacher deletes the quiz. They are not linked to an account, email address or device. Homework works the same way: a student's nickname and answers are stored with the assignment, shown to the teacher who set it, and permanently deleted 60 days after its deadline (or after the teacher closes it), or sooner if the teacher deletes it.

3. AI Processing Disclosure

Documents and URLs you submit are sent to the Google Gemini API (Google AI Studio) for quiz generation. Please be aware:

  • No training: Kwizzy uses Google's API in a mode where your data is not used to train or improve Google's AI models. See Google AI Studio Terms for details.
  • Content sensitivity: Do not upload documents containing sensitive personal data, student records, or confidential information.
  • AI accuracy: AI-generated quiz content may contain inaccuracies. Review all generated content before using.

YouTube videos

When a Max account pastes a YouTube link, we keep only the video's ID. We ask YouTube API Services whether the video is public and how long it is, and use the answer on the spot: we do not store it. The video's address is then sent to the Google Gemini API, which reads the public video itself. We do not download or store the video, and we store only the quiz questions made from it, plus a count of how many videos the account has used this month (deleted with the account). YouTube's use of data is described in the Google Privacy Policy, and by using this feature you are bound by the YouTube Terms of Service.

4. Third-Party Services

We use the following sub-processors. Each operates under its own privacy policy:

  • Supabase (supabase.com) — Database hosting, authentication and session management, real-time messaging for live quiz sessions, and storage of uploaded question images
  • Stripe (stripe.com) — Payment processing and subscription management
  • Google (Gemini API) (ai.google.dev) — AI quiz generation from uploaded content
  • YouTube API Services (youtube.com) — checks that a YouTube video you paste is public and how long it is, for Max accounts
  • Vercel (vercel.com) — Web application and API hosting, CDN, and access logs
  • Sign-in providers — Google, Apple and Facebook, if you choose to sign in with them

5. Children's Privacy

Kwizzy does not knowingly collect personal information from children. Accounts are for adults (18+) only, and players — including children — participate without providing any personal information:

  • Players do not create accounts
  • No names, emails, ages, photos, or device identifiers are requested from players; a player chooses a nickname, which is stored with the game's scores and shown on its leaderboard
  • Participation needs no account and is game-code- or QR-based only

6. Schools and Organizations

We do not collect or process education records. Game results are stored as a nickname, a score and per-question answers for each player, not tied to any real-world identity, and the teacher's report shows per-question class totals (e.g., "60% of players answered Q3 correctly"). Hosts remain responsible for their own compliance obligations. Organizations that need a Data Processing Agreement (DPA) may contact us at support@kwizzy.online.

7. Your Rights (GDPR — EEA/UK Users)

If you are located in the European Economic Area or the United Kingdom, you have the following rights under the General Data Protection Regulation:

  • Access: Request a copy of your personal data
  • Rectification: Correct inaccurate data
  • Erasure ("Right to be Forgotten"): Request deletion of your account and associated data
  • Portability: Receive your data in a machine-readable format
  • Restriction: Request that we limit processing of your data
  • Objection: Object to processing based on legitimate interests

To exercise any of these rights, email support@kwizzy.online. We will respond within 30 days.

8. Your Rights (CCPA — California Users)

California residents have the right to know what personal information is collected, the right to deletion, and the right to opt out of the sale of personal information. Kwizzy does not sell personal information to third parties. To make a CCPA request, contact support@kwizzy.online.

9. Data Retention

  • Accounts and quiz content: Retained for the lifetime of your account. You can request deletion from your Account page; we then keep everything for 90 days (to allow you to change your mind) and a daily job permanently deletes your quizzes, flashcard sets, hosted games and homework with their players and answers, uploaded pictures and sign-in account.
  • Feature requests and upvotes: A request you send to the feature requests page is stored with your account until we publish or delete it; once published, its text is shown publicly without your name or email. Your upvotes are stored with your account. When your account is deleted, your upvotes are removed and requests that were never published are deleted; published requests stay, no longer linked to you.
  • Game logs and player responses (nicknames, scores and answers), and homework attempts: 60 days after the game ends or the homework deadline passes, then permanently deleted by a daily job. We keep no statistics from them afterwards.
  • Billing records: 7 years, as required by US tax law (IRS regulations).
  • Server and access logs: Kept for the period set by our hosting providers' standard retention.

10. Security

We protect your data using industry-standard measures including TLS encryption in transit, encrypted databases at rest, and role-based access controls. However, no internet transmission is 100% secure. In the event of a data breach affecting personal information, we will notify affected users within 72 hours of discovery, as required by GDPR and consistent with best practice.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to registered accounts. The "Last Updated" date at the top of this page reflects the most recent revision. Continued use of the service after changes constitutes acceptance.

12. Contact

For all privacy inquiries, data subject requests, or DPA requests: