Privacy, in plain words.

In short

• Players need no account. They give a game PIN, a nickname and a character.
• An account is an email address. Card numbers go to Stripe and never reach Questy.
• No adverts, no advertising cookies, no selling of information, no profiles of players.
• You can delete a quiz, a game's results or your whole account yourself, and it is erased when you do.

Players

To play, a person enters a game PIN, a nickname and a character. Questy does not ask players for an email address, a password, a real name or an age.

The nickname, the answer given to each question, the time taken and the score are kept with the game's results, so that the person who ran the game can review them. A game assigned to be played in your own time keeps the same things, and remembers your place on your own device so that you can come back to it. What a player types for a typed-answer question is only marked right or wrong: the words themselves are not kept and are not shown to anyone.

If you run games for children, ask them to choose nicknames that do not identify them. We do not knowingly collect any other personal information from children.

People who run games

An account is an email address. If you choose to add a password, only a salted, keyed hash of it is stored, never the password itself.

When an account is created, the people who run Questy get an email saying which address joined.

Questy stores the quizzes you write, with any pictures you add to their questions, your game history and your settings so that you can use them again. It also stores which plan the account is on, your invitation link and who invited you, and how many AI drafts you have used.

If you ask for help from Settings, Help, your message is stored with your account and emailed to the people who run Questy, who answer by email. A message sent through the contact page is emailed to them and is not stored by Questy.

How long things are kept

Email we send

Sign-in codes and links, password resets, a short results summary after a game you ran with two or more players, and an answer when you write to us. The results summary can be switched off in Settings. We do not send marketing email. If you buy a plan, Stripe sends its own receipts.

Things Questy works out

Schools: Questy looks at the part of your email address after the @ to notice when several people at one school or organisation run games. When that happens those accounts are given Plus for a time, and the people who run Questy are told, so that the school can be offered a licence. Addresses at public mail services are never counted.

Invitations: if you join through someone's invitation link, that is recorded, so that both of you can be given what the invitation promises. The person who invited you sees a count, not your name.

Cookies and what your browser stores

Questy sets one cookie, when you sign in, to keep you signed in for up to 30 days. Scripts cannot read it and it is sent only to questy.io. There are no advertising or tracking cookies, and no adverts.

Your browser also remembers a few things on your own device: the character you last picked, the game you are in so that you can rejoin, a draft quiz you have not saved yet, and an invitation or shared quiz you arrived with.

The AI quiz maker

When you use the AI quiz maker, your description and the text of any files you upload are sent to an AI model run by Cloudflare to write the questions. Questy does not keep your files afterwards. Cloudflare states that it does not use this content to train models or to improve its services (Cloudflare: your data and Workers AI).

Take pupils' names and marks out of anything you upload.

Other companies involved

Two: Cloudflare runs the site and stores its data, and Stripe takes payments on its own pages. What each one receives is set out on the page about the companies that help run Questy. The typeface, the pictures and the scripts are all served from questy.io.

Some forms (joining a game, signing in by email, the contact page) first check that a person is using them. That check is run by Cloudflare in your browser.

Where it is kept

Questy's data is stored by Cloudflare in the United States. Cloudflare handles each visit at a data centre near the visitor.

Your choices

• See or correct what is held: your quizzes, results and settings are in your account. Settings, Privacy, Save a copy of my account gives you one file with your details and settings, every quiz, and every game with its players' names and scores. You can ask us for anything else.
• Take your results with you: every game's results can be saved as a CSV file from its page in History.
• Delete a quiz: Delete, next to the quiz. Delete a game's results: Delete these results, on the game's page in History. That works the same for a game you assigned, and removes its link too.
• Delete your account: Settings, Privacy, Delete my account. Everything stored for the account is erased at once, every device is signed out, and a paid plan is stopped. Stripe keeps its own record of payments already made.
• Have old results erased by themselves: Settings, Privacy, Erase game results after 12 months.
• Stop results emails: Settings, Email me the results.

If you cannot sign in, or want something removed that you cannot remove yourself, write to us through the contact page from the email address of the account. We act on a request within 30 days.

Depending on where you live you may have further rights over your information, such as the right to ask what is held, to have it corrected or removed, and to complain to a regulator.

Security

Questy is served only over an encrypted connection. Passwords are never stored, only a salted, keyed hash. Access to stored data is limited to the people who run Questy. If something goes wrong that puts your information at risk, we will tell you.

What Questy does not do

It does not sell information, show adverts, or build profiles of players.

Changes to this page

We will post changes here, and email account holders before a change that matters takes effect. The agreement for using Questy is on the terms page.