Privacy Policy (App)

This privacy policy applies exclusively to the mobile app of QuizBox. The privacy policy for the website can be found here.

Controller

Scope

This privacy policy explains how we process personal data when you use the QuizBox app. It applies to the app and the backend services we provide (e.g. game and user management).

Overview: What data may be processed?

Depending on how you use the app, we process in particular the following categories of data:

• Account/login data: email address, username, internal user ID, login timestamps.
• Game and profile data: progress, points, statistics, league/tournament progress, friends list, in-app currency (e.g. coins/diamonds), settings and, if voluntarily uploaded, a profile picture/avatar.
• Usage/device data: technical identifiers (e.g. app instance ID), device and app information (e.g. operating system, app version), events/interactions in the app.
• Diagnostic and error data: crash/error reports and performance data (e.g. loading times), if enabled.
• Push data: device tokens (e.g. FCM/APNs), time and status of notifications.
• Purchase/billing data: for in-app purchases, transaction/receipt data (no full payment data such as credit card numbers).
• Advertising/marketing data: IP address, device and app information, advertising identifiers where permitted (e.g. Android Advertising ID or Apple's IDFA), consent signals, ad impressions and interactions, and diagnostic data (see section "Advertising and rewarded ads").

Purposes and legal bases (GDPR)

We process personal data for the following purposes:

• Provision of app functions (account, login, gameplay, matchmaking, leagues/tournaments, statistics, rewards, friends list) - Art. 6(1)(b) GDPR (contract/pre-contract).
• Security, abuse and fraud prevention (e.g. technical logs, server logs) - Art. 6(1)(f) GDPR (legitimate interest in secure operation).
• Error analysis and stability (crash/error reports, diagnostic data) - Art. 6(1)(f) GDPR; where required also Art. 6(1)(a) GDPR (consent).
• Usage analysis/product improvement (analytics/events) - generally Art. 6(1)(a) GDPR (consent), where legally required.
• Push notifications (e.g. game updates) - generally Art. 6(1)(a) GDPR (consent via operating system permission); technically necessary notifications may also be based on Art. 6(1)(b)/(f) GDPR.
• Processing of in-app purchases (unlocking, purchase validation) - Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR (legal obligations, e.g. retention duties, where applicable).
• Advertising, ad personalization and measurement - Art. 6(1)(a) GDPR (consent), where consent is required. Access to or storage of information on the device is also based on consent where legally required. You can withdraw your consent at any time with effect for the future.

Account and login (AWS Cognito)

For registration/login we use AWS Cognito (Amazon Web Services). You can sign in via email/password, Google Sign-In or Sign in with Apple. This processes in particular identification and login data (e.g. email, username, user ID).

We generally operate our AWS services in the region eu-central-1 (Frankfurt).

Backend database (AWS DynamoDB) and game data

To provide the game functions, we store in AWS DynamoDB among other things profile and game data (e.g. username, email, internal user ID, friends list, progress/statistics, league/tournament and reward information, wallet balances).

Visibility to other players: Depending on the function, other players can see your username and certain game/profile information (e.g. avatar, status, league/statistics), for example in friends lists, opponent views or leaderboards. Which data is shown depends on the app settings and the respective function.

Profile pictures / avatars

When you select a generated avatar, our backend creates the image file from a random identifier (seed). Alternatively, you can upload your own profile picture. We process the image file and technical metadata (e.g. upload time, file format/size) and store the image in our AWS S3 storage. Depending on your settings, the profile picture may be visible to other players (e.g. in friends lists, opponent views or leaderboards).

Please note: images may contain personal data (e.g. face, name tag) and possibly embedded metadata (e.g. EXIF). We recommend not uploading sensitive information.

Server logs

When the app communicates with our servers, we process technically necessary connection data (e.g. IP address, date/time, requested endpoints, device/browser identifiers such as "user agent"). This is required to provide the services, analyze errors and ensure security.

Push notifications (Firebase Cloud Messaging / APNs)

For push notifications we use Firebase Cloud Messaging (FCM). On iOS, push messages are technically delivered via the Apple Push Notification Service (APNs). A device token is processed to deliver messages to your device. You can disable push notifications at any time in your device's system settings.

Analytics, stability and performance (Firebase & Sentry)

The app integrates the following services/SDKs:

• Firebase Analytics (usage analysis, events, reach measurement).
• Firebase Crashlytics (crash/error reports).
• Firebase Performance Monitoring (performance metrics).
• Firebase Remote Config (configuration/feature flags).
• Firebase In-App Messaging (in-app notices/campaigns, typically based on analytics events).
• Sentry (error and diagnostic data for stabilization/troubleshooting).

Depending on the service, device/app information, technical identifiers, usage events as well as error/crash details (e.g. stack traces) may be processed. Direct identification is generally not performed via names, but depending on the integration it may be possible through linking with account/session information (e.g. in support cases).

App permissions

Depending on the platform and function, the app requires certain permissions. Typical examples are: Internet (communication with our servers), Vibration (game feedback/notifications) and, where applicable, access to photos/media when you voluntarily select your own profile picture. There is no access to your photo/media library unless you select content yourself. You can manage permissions in your device's system settings.

In-app purchases

If you make in-app purchases, payment processing is handled by the respective app store provider (Apple App Store / Google Play). We typically receive transaction information (e.g. product ID, time, confirmation/receipt data), but no full payment data (e.g. credit card numbers). We may process transaction data to validate purchases and unlock content.

Advertising and rewarded ads (Google AdMob)

We use Google AdMob (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) and the Google Mobile Ads SDK to provide voluntary rewarded ads. You decide whether to start an ad. If you watch it to the required point, you receive the reward shown in the app. The app can also be used without starting a rewarded ad; in that case, the associated optional reward is not granted.

In connection with ad delivery, Google and its advertising partners may process in particular the IP address, device and app information, approximate location derived from the IP address, advertising identifiers where available and permitted, consent and privacy signals, ad requests, impressions, interactions, reward events, and diagnostic data. Depending on your choices and the available signals, personalized, non-personalized or limited ads may be delivered. Availability of an ad cannot be guaranteed.

We use Google's User Messaging Platform (UMP) to request and store legally required privacy choices. You can change or withdraw your choices for the future through the privacy options in the app settings, where required and available. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

On iOS, we also use Apple's App Tracking Transparency (ATT) prompt where applicable. If you allow tracking, the advertising identifier may be used for cross-app advertising personalization and measurement. If you decline, the app remains usable and ads without this permission may still be shown.

Further information: Google Privacy Policy, How Google uses information for advertising and Google Ads Settings.

Recipients / processors

Depending on the function, data may be transferred to the following categories of recipients:

• Amazon Web Services (AWS) (Cognito, DynamoDB, S3; hosting/backend infrastructure).
• Google / Firebase (Analytics, Crashlytics, Performance, Remote Config, In-App Messaging, Cloud Messaging).
• Google AdMob / Google Mobile Ads and advertising partners (delivery, personalization where permitted, measurement and fraud prevention for rewarded ads).
• Sentry (error/diagnostic reports).
• App store providers (Apple/Google) for download, billing and, if applicable, purchase validation.

Further information about providers (selection):

• AWS Privacy: https://aws.amazon.com/de/privacy/
• Firebase/Google Privacy: https://firebase.google.com/support/privacy
• Sentry Privacy: https://sentry.io/privacy/
• Apple Privacy: https://www.apple.com/legal/privacy/
• Google Privacy: https://policies.google.com/privacy
• Google advertising technologies: https://policies.google.com/technologies/ads

Data transfers to third countries

Depending on the provider used, processing may also take place in countries outside the EU/EEA (in particular the USA). Where required, we base transfers on appropriate safeguards, in particular EU Standard Contractual Clauses (SCC) and/or - where applicable - an adequacy decision (e.g. EU-U.S. Data Privacy Framework) for certified providers.

Retention period

We generally store personal data only as long as necessary for the purposes mentioned: account and game data typically for the duration of your account. Server logs are usually stored only for a short time for security reasons. Advertising and consent data are retained by Google and its partners in accordance with their own retention policies and legal obligations. We do not determine all retention periods used by those providers.

Local storage on the device

The app stores certain data locally to enable use (e.g. session/auth tokens and settings). These data are usually stored in the device's secure storage. You can delete local data by logging out or uninstalling the app.

Your rights

You have the right of access, rectification, erasure, restriction of processing as well as the right to data portability (where applicable) and the right to object. You can also lodge a complaint with a data protection supervisory authority.

If processing is based on your consent, you can withdraw it at any time with effect for the future.

For requests (e.g. access or deletion of your account) please contact us at hello@quizboxapp.com.

Account deletion

You can delete your account at any time in the app under Settings > Account > Delete account.

The deletion removes or anonymizes the account-related data held by QuizBox, including account, profile and game data, unless statutory retention obligations apply. Data we must retain for legal reasons (e.g. billing/transaction records for in-app purchases, if any) are stored in accordance with legal requirements and deleted afterwards.

Changes to this privacy policy

We update this privacy policy if legal requirements, app features or data processing change. The current version is always available on this page.