Privacy Policy

What we process: hosts and accounts

If you create an account, we store your email address, a cryptographic hash of your password (we never store or see the password itself), the quizzes you create, and your subscription status. If you subscribe to the Host Plan, the subscription itself is managed by Stripe — on our side we only record whether your plan is active.

You can also create quizzes without an account. Those quizzes are tied to an anonymous device cookie, and if you later sign up or log in on the same device they are merged into your account.

What we process: players

Players never create accounts. When you join a game we process only your nickname, your answers, and your scores. We do not ask for — and do not want — your email address, real name, or any other contact details.

All game data, including nicknames, answers, and results, is automatically deleted from our servers 24 hours after the game is created.

Cookies

ZappyQ uses two first-party cookies, both strictly functional: a device cookie (a random httpOnly identifier that keeps your anonymously created quizzes available on your device and lets players reconnect to a game without losing their score) and a session cookie for logged-in hosts. That is the complete list. There are no advertising cookies, no cross-site tracking, and no third-party analytics on ZappyQ.

AI question generation

When a host uses the AI generator, the topic or text they submit is sent to OpenAI's API to generate quiz questions. Only the host's prompt is sent — no player data of any kind ever goes to an AI service.

Payments

Host Plan subscriptions are processed by Stripe. Your card details are entered on Stripe's secure checkout pages and never touch our servers. Stripe processes payment data under its own privacy policy.

Emails

When you request a password reset or email verification, we send the email through Resend, an email delivery service. We do not send newsletters or marketing emails.

Service providers (sub-processors)

We use the following providers to run ZappyQ. They process data on our behalf and under our instructions.

• Vercel: hosting and content delivery; our application servers run in Stockholm, Sweden (EU).
• Upstash: the Redis database that stores accounts, quizzes and live game state.
• OpenAI:AI question drafts. Only the host's prompt is sent; it is processed in the United States under standard contractual clauses.
• Stripe: payments.
• Resend: transactional email (password reset and email verification).

Children and classroom use

ZappyQ is designed so that children can play without giving us any personal data: players join anonymously with a nickname, and we never collect children's contact details. Under Article 8 GDPR the age of digital consent in Sweden is 13, but because players do not create accounts and provide no contact data, joining a quiz does not rely on that kind of consent.

Teachers and other hosts are responsible for what they choose to display on shared screens — for example, whether to show a leaderboard with student nicknames to the whole room.

How long we keep data

• Games: deleted automatically 24 hours after creation, including all player nicknames, answers, and scores.
• Accounts: kept until you delete your account or ask us to erase it.
• Downloaded results:a CSV file a host downloads exists outside our servers and is the host's responsibility. If a school downloads student results, the school is the data controller for that file.

Your rights

You have the right to access, correct, and erase your personal data, to restrict or object to our processing, and to receive your data in a portable format. Email privacy@zappyq.com and we will respond without undue delay.

You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY, imy.se) or the supervisory authority in your own country.

Changes to this policy

If we change this policy, we publish the new version on this page and update the date at the top. Significant changes are announced on the site.