quizzie.

Privacy policy

Last updated: 17 October 2026

This Privacy Policy explains how Hatchgrid Private Limited ("Hatchgrid", "we", "us", "our") collects, uses, shares, and protects information when you use Quizzie (the "App") — our quiz-based mobile and web application.

By creating an account or using Quizzie, you agree to the practices described here. If you don't agree, please don't use the App.

1. Who we are

Hatchgrid Private Limited is a company incorporated in India, with its registered office in Gurugram, Haryana. We are the data fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act") for personal data processed through Quizzie.

Contact: help@quizzie.app

2. What information we collect

We collect only what we need to run Quizzie:

From you, directly

• Account identifier — your email address, your Google account (via Google OAuth), or your Apple ID (via Sign in with Apple), used only to sign you in and recover access. If you use Sign in with Apple and choose Hide My Email, Apple gives us a private relay email address instead of your real one; we use that relay address the same way we'd use any email.
• Profile — your chosen username (public on leaderboards and to friends/tribes) and your avatar (an illustration you select from a set we provide, also public).
• Age — your age (the number), collected during onboarding to determine eligibility (Quizzie is 13+) and to age-appropriate features. Stored privately on a separate access-restricted table; we never display it to other users.
• Your vibes — during onboarding, you select 3–5 topics or themes that interest you (e.g., Bollywood, cricket, sci-fi). We use these to personalize the quizzes and content we suggest to you.
• Tribe waitlist entries — if you join a waitlist for a tribe feature, we keep your user record on that list so we can notify you when access opens.

From your use of the App

• Gameplay data — your quiz scores, the answers you select, how long you take per question, total XP, and which categories you've played.
• Social connections — the friends you add, the tribes you join, the challenges you send and receive.
• Question reactions — if you tap dislike, love, or bookmark on a quiz question, we store which reaction you applied to which question. Used to learn what content lands well; not displayed to other users.
• Blocks — the users you've blocked. Visible only to you and used by our backend to filter them out of your search results, leaderboards, and challenges. Other users cannot see who has blocked them.
• Content reports — if you flag a question (e.g., wrong answer, inappropriate), we store the question, the reason you selected, and any free-text you add.
• User reports — if you report another user for harassment, abuse, or another safety reason, we store who you reported, the reason, and any context.
• Safety records — internal logs of safety-relevant events (specifically: user blocks, user reports, and friend-request patterns). These are stored in access-restricted tables separate from your primary account data, are pseudonymized, and are processed strictly to maintain platform integrity, investigate policy violations, and detect patterns of misuse across Quizzie. See §6 for retention details.
• Moderation state — if your account is suspended for violating our Terms of Service, we record when and why on your profile so we and you can see your account's standing.

Purchases (Quizzie Infinity)

If you subscribe to Quizzie Infinity (see Terms §8), the payment is made through Apple's App Store or Google Play — we never see or store your card, UPI or bank details. To provide the subscription we keep or receive:

• Subscription status — whether Infinity is active on your account and when the current period ends, stored with your account on our servers so they can apply it.
• Purchase records — which plan you bought, the store (App Store or Google Play), transaction and order identifiers, purchase/renewal/expiry/refund dates, and the price and currency charged. These come from Apple or Google via our subscription-management provider, RevenueCat, and are linked to a random billing identifier — pseudonymous, though we can re-link it to your account through a mapping we hold — that our servers use to apply your subscription to your account.

The RevenueCat component is active for every signed-in user of a version of the App that offers Quizzie Infinity, so that a subscription can be confirmed or restored on any device. If you never buy Infinity, RevenueCat holds that random billing identifier, basic device and app information (such as app version, operating system and store country) and an empty purchase history; like any online service, it also sees your IP address when the App connects to it. It never receives an advertising identifier.

From your device, automatically

• Push notification token — if you enable notifications, a token from Apple/Google that lets us send you alerts (stored on a separate access-restricted table; only our backend reads it).
• Technical metadata — IP address, device model, OS version, app version, and basic logs needed to operate the service. This is captured by our infrastructure provider (Supabase) when you connect to our servers.
• Approximate country — when you sign in, our server reads the IP address of your connection and sends it to ipinfo.io (a third-party geolocation provider) to determine your country — country level only, never your city, GPS position, or any precise location. We store only the resulting two-letter country code; we do not retain the IP address for this lookup. Your country is set once and does not update automatically as you travel. We use it to show a small country flag beside your avatar in competitive parts of the App (see §4), as part of offering Quizzie to a worldwide audience.
• Device language — we read your device's language setting to format dates correctly and, in future, to offer localized content. This is stored privately against your account and is never shown to other users.
• Time zone — we record the time zone your device is in when you play a quiz, attached to that game-history entry so we can show you when you played. It is never shown to other players.

What we don't collect

• We do not collect your full name, postal address (other than what you provide if you contact us by post), full date of birth (we ask your age, from which we derive and store your birth year — not a full DOB), or any government-issued ID.
• We do not access your contacts, photos, precise device location (GPS), or microphone. We derive only your approximate country from your IP address, as described above — never fine-grained location.
• We do not collect payment card, UPI or bank details. In-app purchases are processed entirely by Apple or Google; we receive only the purchase records described above.

3. How we use your information

We use the information above to:

• Run the App — sign you in, calculate your scores, render leaderboards, and let you challenge friends or join tribes.
• Communicate with you — send notifications about challenges, friend requests, and results. You can disable push notifications in your device settings at any time.
• Send you product updates and offers — we may occasionally send you emails or push notifications about new features, content, or Quizzie Infinity offers. You can opt out at any time via the unsubscribe link in any marketing email, by disabling push notifications in your device settings, or by emailing us at help@quizzie.app. (v1.x note: a dedicated in-app marketing-preferences toggle is on our roadmap; until it ships, the opt-out channels above are the supported ways to stop marketing communications.)
• Improve the App — analyze aggregated usage patterns to fix bugs, improve content, and design new features. We use Sentry (an error-tracking service) to collect crash reports and basic device info when something goes wrong; this helps us fix the bug. For debugging context, Sentry also captures recent app activity (navigation, console output, network calls), with personal identifiers (UUIDs, emails, phone numbers, tokens) automatically stripped before upload. We use Mixpanel (a product analytics service) to understand how features are used — for example, which quiz modes are most popular or where users drop off during onboarding. Mixpanel receives only named events we explicitly send (e.g., "quiz_started", "quiz_completed") with properties like mode and score — and whether a subscription purchase or restore succeeded and which plan (monthly/annual) was chosen, never prices, order IDs or payment details; we have disabled IP-based geolocation in our Mixpanel configuration. Both services process data in accordance with their own privacy commitments.
• Provide Quizzie Infinity — confirm your subscription status, unlock its features on every device you sign in to, restore purchases, answer billing and refund questions, and detect subscription fraud (for example, a refunded purchase still being used).
• Keep the App safe — detect cheating, abuse, spam, or violations of our Terms of Service. Audit logs and moderation state described in §2 are used for this purpose.
• Meet our legal obligations — comply with applicable Indian law, respond to lawful government requests, and enforce our Terms.

Local storage and cookies

The mobile App stores some data locally on your device — your sign-in session, your theme preference, and recent app state — using your operating system's secure local storage. This is essential to keep you signed in and to make the App work offline. This local data does not leave your device unless and until you sign in (in which case the sign-in session is sent to our servers for authentication).

If you use the web version of Quizzie, our authentication provider (Supabase) sets a session cookie on your browser to keep you signed in across page reloads. This is a strictly necessary cookie — it has no advertising, tracking, or analytics purpose. We do not use third-party tracking or advertising cookies.

4. Who we share information with

We don't sell your data. We share it only with:

Service providers ("Data Processors" under DPDP Act)

These providers process data on our behalf under contracts that require them to protect it:

We periodically review these vendors and require them to maintain appropriate security and privacy standards.

App Store and Google Play purchases. When you buy Quizzie Infinity, Apple or Google processes the payment as the seller, under its own terms and privacy policy, and keeps its own transaction records. We receive only the purchase records described in §2. The Meta SDK in the App also records a Quizzie Infinity purchase as an advertising-measurement event — details of the purchase such as the plan, price, currency and time — never your name, email address, Quizzie account or payment details. Who this applies to, by platform and age, is set out in §5. No other advertising partner receives your purchases.

Other Quizzie users

Some of your information is, by design, visible to other users:

• Your username and avatar appear on leaderboards, friend search results, and inside tribes you join.
• Your scores and streaks appear on leaderboards and to friends/tribe members.
• Your country flag — a small flag indicating your country appears beside your avatar during matchmaking, gameplay, and result screens, on your Friends match cards, and on category leaderboards, where it may be visible to other players including those you have not directly matched with. Only the flag is shown — your IP address, city, and precise location are never shown. You will be able to turn your country flag off; this control takes effect with our worldwide launch. In the meantime you can register a request by emailing help@quizzie.app with your username, and we will action it within 3 working days.
• Your friend requests and challenges are visible to the recipient.

Your phone/email, IP address, push token, and content reports are never visible to other users.

Legal disclosures

We may disclose information when required by Indian law, a court order, or a government request that we have a legal obligation to comply with. We will tell you about such requests where we are legally permitted to do so.

Business transfers

If Hatchgrid is acquired, merged, or sells assets, your data may transfer with the business. Before any such transfer takes effect, we'll give you reasonable advance notice (typically at least 30 days, where practical) and the option to delete your account so that your data doesn't transfer. Any successor entity will be bound by this Policy (or one at least as protective). If they want to change material terms, they must give you fresh notice and the chance to opt out under the new terms.

5. Advertising measurement

We use the Meta (Facebook) SDK to measure how well our ads work. What we send to Meta is never linked to your Quizzie account: we never send your name, email address, username, age, or full gameplay history or profile.

What is sent, by platform and age:

We never share an advertising identifier, registration, or quiz activity for users under 19 or whose age we don't know. On Android, the install, app-open, app-session and in-app purchase events above are sent for all users, without an advertising identifier.

You can change your iOS tracking choice anytime in Settings → Privacy & Security → Tracking. On Android, you can delete or reset your advertising ID in Settings → Google → Ads (or Settings → Privacy → Ads on some devices). For how Meta handles this data, see https://www.facebook.com/privacy/policy.

6. How long we keep your information

• Active accounts: for as long as you keep your account.
• Gameplay data: retained while your account exists. Aggregated anonymous statistics (e.g., "average score on quiz X") may be kept indefinitely after personal identifiers are removed.
• After you delete your account: your personal data is removed from our active systems immediately. Our database provider (Supabase) keeps rolling daily backups for up to 7 days; after this window passes, no personal data of yours remains in backup either. (The backup window depends on our database infrastructure tier; if we move to a tier with different retention, we'll update this Policy.) When you delete your account, we automatically submit a deletion request to Mixpanel for your event history. Sentry crash data is stored against a pseudonymous identifier (not your account ID), so post-deletion correlation is not possible without your account record. Mixpanel processes deletion requests within their published SLA (~30 days). Residual or backup data at these processors is governed by their respective privacy policies and is typically purged within 30–90 days.
• Purchase records: when you delete your Quizzie account, your subscription status is deleted with your profile, but your purchase records are kept by our subscription-management provider (RevenueCat) for up to 2 years after your account is deleted, to handle refunds, chargebacks and payment disputes and to prevent fraud, and are then deleted. You can ask us to delete them sooner by emailing help@quizzie.app. Apple and Google keep their own transaction records under their own policies. Deleting your account does not cancel a subscription — cancel it in your App Store or Google Play account (see Terms §8.4).
• Safety records: as noted in §2, we retain pseudonymized safety records (user blocks, user reports, friend-request patterns) for a period of up to two years under the lawful basis permitted by Section 17(1)(c) of the DPDP Act, 2023, to prevent and investigate violations of our community safety policies and applicable Indian law. After two years, records are reviewed for continued necessity and deleted unless an active investigation requires them. Where required by a lawful order from a competent authority, we may also disclose these records under §17(2) and other applicable provisions of Indian law. These records are isolated from our primary app interface and are never used to make product decisions about active users.
• Legal hold: in rare cases where we're legally required to retain specific data (e.g., for a regulatory request), we'll keep only what's required and only for as long as required.

You can delete your account at any time from Profile → Delete Account in the App.

7. Your rights under the DPDP Act, 2023

As a Data Principal under the DPDP Act, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to fix data that's wrong or out of date.
• Erasure — delete your account (the in-app Delete Account flow is the fastest path, or use our web deletion page at https://quizzie.app/delete-account) or ask us to delete specific data we hold.
• Grievance redressal — contact our Grievance Officer if you believe we've mishandled your data.
• Withdraw consent — opt out of marketing communications, push notifications, or any non-essential processing at any time.
• Nominate — appoint someone to exercise these rights on your behalf in the event of your death or incapacity.

To exercise any of these rights, email help@quizzie.app with your username and the request. We'll respond within 30 days as required by law.

Grievance Officer

Name: Rituraj
Email: ritu@quizzie.app
Response time: within 30 days of receiving a grievance

8. Children's privacy

Quizzie is intended for users aged 13 and above. Indian law (DPDP Act, 2023) treats anyone under 18 as a child, requiring verifiable parental consent for processing their personal data.

Our current position:

• By creating an account, you confirm that you are at least 13 years old.
• If you are under 18, you confirm that your parent or legal guardian has reviewed this Policy and given consent for you to use Quizzie.
• We do not knowingly collect data from anyone under 13. If you believe we've inadvertently collected data from a child under 13, contact help@quizzie.app and we will delete it.
• We do not show personalized advertising to any user, and we do not target advertising to users we know to be under 18.
• For users under 19 (or whose age we don't know), we never share an advertising identifier, and never share registration or quiz activity, with any advertising partner. On Android only, the App's install, app-open and app-session events — and, if a purchase is made, an in-app purchase event — are sent to Meta for all users, including users under 18, without an advertising identifier and without any link to your account, solely to measure our ads (see §5). On iOS, nothing is sent for users under 19.
• Country flags for minors: for users under 18, a country flag will not be shown on public leaderboards by default, consistent with data-minimization expectations for children (including the UK Age Appropriate Design Code and similar standards); this takes effect with our worldwide launch. In the meantime, any user under 18 (or their parent/guardian) may register a request to suppress their country flag by emailing help@quizzie.app, which we will action within 3 working days.

Users under 18 may buy Quizzie Infinity only with a parent's or guardian's permission (Terms §8.7). The purchase records we and RevenueCat hold are used only to provide the subscription and prevent fraud. Separately, the in-app purchase event described in §5 is sent to Meta to measure our ads (on Android for all users, on iOS for adults only).

We are actively working on a verifiable parental consent flow for users under 18, in line with the DPDP Act. Until that ships, the responsibility for ensuring parental consent rests with the user/parent.

9. Security

We protect your data with measures appropriate to the sensitivity of the information:

• Row-level security (RLS) on every database table, enforced at the Postgres level — users can only read/write rows they're authorized to.
• Column-level access controls on sensitive fields (e.g., correct answers, push tokens) — kept readable only to our backend.
• HMAC-signed session tokens to prevent timing-based cheating on scoring.
• Service-role keys (the most powerful database credentials) live only on our backend Edge Functions — never in the mobile app.
• HTTPS for all client-server traffic.
• Encrypted backups with rolling purges.

No system is 100% secure. If a security breach affects your data, we will notify you and the relevant authorities as required by Indian law.

10. Marketing and opt-out

We may send you marketing communications about Quizzie — product updates, new feature announcements, or special offers (e.g., Quizzie Infinity offers) — by email or push notification.

You can opt out of marketing at any time. In v1.x of the App, opt-out is supported through these channels:

• Email: click the unsubscribe link in any marketing email.
• Push: turn off notifications in your device's system settings.
• Direct: email help@quizzie.app with the subject "Stop marketing" and your username; we will action the request within 3 working days.

A dedicated in-app marketing-preferences toggle is on our roadmap and will be added in a later release. When it ships, we'll update this Policy.

Opting out of marketing does not affect transactional messages essential to using Quizzie (e.g., OTP codes, friend-request alerts, your challenge results).

11. Cross-border transfers

Some of our service providers (Supabase, Expo, Sentry, Mixpanel, Meta, Google, ipinfo.io, RevenueCat) are based outside India and may process your data on servers located outside India. By using Quizzie, you acknowledge that your data may be transferred to and processed in countries other than India for the purposes described in this Policy. We require all such providers to apply protections at least equivalent to those required by Indian law.

12. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices, the App, or applicable law. When we make material changes, we'll notify you in the App or by email. Where a change materially reduces your privacy protections, we'll give reasonable advance notice before it takes effect.

The "Last updated" date at the top of this page shows when this Policy was last revised. Your continued use of Quizzie after the effective date constitutes acceptance of the updated Policy.

13. Contact us

Questions, requests, or grievances about your data:

• Email: help@quizzie.app
• Postal address: Hatchgrid Private Limited, C-042C, 4th Floor, Desk 05, Supermart-1, Galleria DLF-IV, Gurugram – 122009, Haryana, India

If we don't respond to your grievance within 30 days, or you're not satisfied with our response, you may complain to the Data Protection Board of India under the DPDP Act, 2023.