Privacy notice
Last changed 2 November 2026
Draft: this text is being reviewed and may change before it applies.
Who is responsible
Kvisso is responsible for the personal data in Kvisso.
- Email: login@kvisso.com
We keep as little as we can. There are no ads and no tracking cookies.
Hosts
| What | Why | Legal basis |
|---|---|---|
| Name, email, password (stored only as a scrambled hash) | Your account and logging in; login links you ask for | Our agreement with you (GDPR art. 6(1)(b)) |
| Whether the account is personal, a company's or a school's (we set it with you) | A school account plays every quiz in safe mode | Our agreement with you |
| Your plan, packs and passes, when your free trial ends, what you have paid, Stripe's customer and subscription numbers | Opening what you paid for, receipts, bookkeeping | Agreement; the Bookkeeping Act (art. 6(1)(c)) |
| Gift cards you bought (with the code until it is redeemed) or redeemed, and time they gave you | Giving the time to whoever redeems the card | Our agreement with you |
| Your invite code; whether someone invited you, and the friends who joined through your link and whether they paid | "Give a month, get a month"; stopping abuse | Our agreement with you |
| Quizzes, pictures and sounds you upload, your games and their scores | Running your quiz nights and showing your results | Our agreement with you |
| Quizzes you publish in Community, and ratings and reports you give other hosts' quizzes | Showing them to other hosts, keeping Community fair | Our agreement with you |
| Questions you save to My questions, and which quiz each came from | Reusing them in your other quizzes | Our agreement with you |
| If you are in a team: the team, your role, and invites you send (the address, until it is used or expires) | Sharing quizzes and seats with your team | Our agreement with you |
| Ideas and feature requests you send us, with our reply | Reading and answering them | Our agreement with you |
| What we do to your account by hand (access given, a login link made, the account kind set), with when. Kept a year | Answering for what we changed | Our legitimate interest in a record (art. 6(1)(f)) |
| If you sign in with Google or Microsoft: which one, its id for you, and the email it gave | Logging you in with it | Our agreement with you |
| A login cookie | Keeping you logged in | Strictly necessary; no consent needed |
| A cookie with your light or dark pick, and one with your app language (My account, front page) | Showing the look and language you chose | A setting you asked for; no consent needed |
Players
Players don't make an account. When you join a game we keep:
- the nickname and emoji you pick, your team, your answers and scores, and chat lines if the host has the chat on: to run the game and show its results to the host;
- a cookie on your phone that lets you rejoin the same game if your browser closes;
- a selfie, only if you choose to take one and the host has the feature on. It is held in the server's memory for that game only, shown only on that game's screens, never saved to disk, and gone when the game ends.
This is done to deliver the game the host has invited you to (our legitimate interest, GDPR art. 6(1)(f), and the host's). The results are kept with the host's games until the host deletes that game or their account. Use a nickname, not your full name, if you prefer. In a game in safe mode you get a name from a neutral list instead.
After the game, the recap page shows the nicknames, emojis, places and awards (no written answers, only number guesses) to anyone with its link, which is random and unguessable. The host and the players get the link; search engines are asked not to list it. It stops working after 30 days, or at once when the host turns it off or deletes the game.
Security logs
The server sees your IP address on each request. We use it to limit how often someone can try to log in or join, and our server logs keep it for a short time to find faults and stop abuse (legitimate interest). We don't build profiles.
Error reports
When something breaks, the server, or the browser on the TV, a phone or a host’s page, sends an error report to Sentry, so we can find and fix the fault. A report says what went wrong and where in the code, and may carry the page's address, the browser type, an IP address and, for a host, the account's id. We leave out passwords, cookies and the links that log someone in or open a TV. Reports are kept for at most 90 days (legitimate interest).
Counting visits
To learn whether the site works for people, our server counts a few steps without any cookie: a visit to a front page, an answer in the demo, a sign-up, a confirmed email, a quiz made, a game started and a payment. A visitor is never identified. For a host, the count carries a scrambled code made from the account, never the name, email or IP address, so we can see how far people get, not who they are (legitimate interest). The counts are kept for at most a year.
Who helps us
| Who | What for | Where |
|---|---|---|
| Fly.io | Runs the app, its database and uploaded files | EU |
| Cloudflare (R2) | Holds the backups (R2); DNS | EU; transfers under the Data Privacy Framework and standard contractual clauses |
| Sentry | Error reports (above) | EU (Frankfurt) |
| PostHog | Counting visits (above), without cookies | EU (Frankfurt) |
| Resend | Sending login links and account emails | USA; under the EU–US Data Privacy Framework and standard contractual clauses |
| Stripe (Stripe Payments Europe Ltd.) | Taking payments, receipts; holds the card details | EU; transfers under Stripe's standard contractual clauses |
If you sign in with Google or Microsoft: which one, its id for you, and the email it gave | Logging you in with it | Our agreement with you | | A login cookie | Keeping you logged in | Strictly necessary; no consent needed | | A cookie with your light or dark pick, and one with your app language (My account, front page) | Showing the look and language you chose | A setting you asked for; no consent needed |
Players
Players don't make an account. When you join a game we keep:
- the nickname and emoji you pick, your team, your answers and scores, and chat lines if the host has the chat on: to run the game and show its results to the host;
- a cookie on your phone that lets you rejoin the same game if your browser closes;
- a selfie, only if you choose to take one and the host has the feature on. It is held in the server's memory for that game only, shown only on that game's screens, never saved to disk, and gone when the game ends.
This is done to deliver the game the host has invited you to (our legitimate interest, GDPR art. 6(1)(f), and the host's). The results are kept with the host's games until the host deletes that game or their account. Use a nickname, not your full name, if you prefer. In a game in safe mode you get a name from a neutral list instead.
Security logs
The server sees your IP address on each request. We use it to limit how often someone can try to log in or join, and our server logs keep it for a short time to find faults and stop abuse (legitimate interest). We don't build profiles.
Error reports
When something breaks, the server, or the browser on the TV, a phone or a host’s page, sends an error report to Sentry, so we can find and fix the fault. A report says what went wrong and where in the code, and may carry the page's address, the browser type, an IP address and, for a host, the account's id. We leave out passwords, cookies and the links that log someone in or open a TV. Reports are kept for at most 90 days (legitimate interest).
Counting visits
To learn whether the site works for people, our server counts a few steps without any cookie: a visit to a front page, an answer in the demo, a sign-up, a confirmed email, a quiz made, a game started and a payment. A visitor is never identified. For a host, the count carries a scrambled code made from the account, never the name, email or IP address, so we can see how far people get, not who they are (legitimate interest). The counts are kept for at most a year.
Who helps us
| Who | What for | Where |
|---|---|---|
| Stripe (Stripe Payments Europe Ltd.) | Taking payments, receipts; holds the card details | EU; transfers under Stripe's standard contractual clauses |
| Resend | Sending login links and account emails | USA; under the EU–US Data Privacy Framework and standard clauses |
| PostHog | Counting visits (above), without cookies | EU (Frankfurt) |
| Our server provider | The server the app and its backups run on | EU/EEA |
If you sign in with Google or Microsoft, that company tells us your name, email and an id for you, and is responsible for its own login under its own privacy policy. We don't get your password there, your contacts or anything else.
Each of them works under a data processing agreement and may use the data only for us. We never sell personal data. Companies, schools and other organisations that run quizzes for their own people can read our data processing agreement, which lists the same helpers.
How long we keep it
- Your account and what's in it: until you delete it. When you ask, you are logged out and the account is erased for good 14 days later (log in before then to keep it, or choose to delete everything at once). Erasing removes your quizzes, files, games, Community listings and login; copies in our backups are gone within 30 days after that. Copies of your quizzes that other hosts already added from a share link or Community stay theirs. A gift card you bought and nobody has redeemed yet keeps working for whoever has its code, without your name on it.
- Free trial: a one-way fingerprint of your email address (a hash; the address itself can't be read back from it) and the day your trial ended stay after your account is erased, so the same address doesn't get a second free trial.
- Invites: if you joined through a friend's invite, one-way fingerprints of your email address and of the card that paid for your plan (hashes; neither can be read back) stay after your account is erased, so the same address or card doesn't get a second free month.
- Error reports: at most 90 days.
- Payment records (what was bought, when, the amount): five years after the year of sale, because the Bookkeeping Act (bokføringsloven) requires it. Stripe keeps the receipts.
- Players' data: with the host's game, as above. Selfies: only while the game runs. Recap pages: 30 days.
- Login links expire after an hour, login cookies after 12 hours without use.
Your rights
You can ask to see the data we have about you, have it corrected or deleted, have its use restricted, object to it, and get it in a form you can take elsewhere. As a host you can do most of this yourself on My account: change your name, download your data (one zip with everything, your pictures and sounds too), and delete your account. A player can ask the host to delete a game, or write to us at login@kvisso.com.
If you think we handle your data wrongly, tell us; you can also complain to the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no).
Children
Hosts must be 18 or older. Players of any age may join a game the host invites them to; we only ask for a nickname.
Changes
We update this notice when what we do changes, and change the date at the top. Hosts are emailed about changes that matter.