Privacy Policy

Last updated: October 2026

1. Information We Collect

When you create an account, we collect your email address and display name from your OAuth provider (Google, GitHub, Apple, or Facebook). We also collect:

2. How We Use Your Information

3. Data Sharing

We do not sell your personal data. Aggregate statistics are shown only to signed-in people who have shared their demographic details (see section 4), and never for a group of fewer than 25 people. Your individual results are private unless you explicitly share them via our sharing features.

4. Demographic details and statistics

Giving your gender, sex, age range, and country with state or province is a condition of access to the statistics pages. Statistics are made of these details, so they are available to people who contribute them. Nothing else on the site requires them: quizzes, results, the journal and videos work the same without them. Where your country has no states or provinces, none is asked for.

Lawful basis. We process these details because they are necessary to provide the statistics service you ask to use (GDPR Article 6(1)(b)). Your results are only ever counted into group figures, and a group is shown only once it holds at least 25 people.

Ethnicity is optional and carries no condition. You can give it or not, and you see exactly the same statistics either way. Because it is special-category data, we process it only with your explicit, separate consent (GDPR Article 9(2)(a)), which you can withdraw on its own at any time without affecting anything else.

What withdrawing costs. You can remove your details at any time from your settings. If you remove the required details, you lose access to the statistics pages within 60 seconds, and your contribution leaves the figures other people see within 1 hour. Removing only your ethnicity costs nothing.

5. Data Retention

Free-tier users: quiz results are retained for 12 months. Pro users: results are retained indefinitely. You may export or delete your data at any time from your profile settings.

6. Your Rights (GDPR)

You have the right to:

7. Cookies

We use essential cookies for authentication and session management. We use third-party cookies for advertising (free-tier users only). Pro users do not see advertisements.

8. Security

We use industry-standard security measures including encrypted connections (HTTPS), secure authentication (OAuth 2.0), and parameterized database queries.

9. Diagnostics we collect from your browser

To find faults we could not otherwise see, the site reports a small amount of anonymous technical information: which page template you were on (for example /quizzes/{slug} — never which quiz), the name and first line of a JavaScript error, how long pages took to become usable, and the operation name and status of a failed request to our API. Each visit is given a random reference so those reports can be read together. That reference is held in memory, is discarded when you close the tab, and is not connected to your account.

We never collect your identity, your email address, which quizzes you took, your answers, your results, the full address of a page you visited, or anything you typed. We do not store your IP address with these reports.

One exception, stated plainly rather than glossed over: when a request to our API fails, the report about it is sent with that request’s exact address, which for a quiz page contains that quiz’s slug. Our server converts that address into a generic operation name (for example, “fetch a quiz”) before anything is written to a log, and only that generic name is ever kept. So the address, and the slug inside it, is sent but never retained.

If you turn on Diagnostics in Settings, your visit reports the same categories in more detail, and shows you the reference so you can include it in a bug report. It is off unless you turn it on.

One more thing worth being plain about: when a request to our API fails, the report includes that request’s identifier so we can find the matching server record. Someone with access to both sets of logs could follow that link to a server record containing a one-way scrambled form of your account id. So these reports are not linked to you in themselves, but they are not beyond linking by us.

10. Reading aloud and answering by voice

Quizzes can be read aloud to you, and on some browsers you can answer by speaking. Both run entirely on your own device. Your browser turns speech into text locally; we never receive your audio and never store it, and the microphone is only ever opened after you ask for it, once per visit. If your browser cannot transcribe speech on the device itself, we turn answering by voice off rather than send your voice to another company to be transcribed. The only thing that reaches us is the answer you confirm, which is the same answer a tap or a keypress would have sent.

We do count how these features behave, and the counts are tallies only — no identifier, no page, no visit reference, and nothing you said. There are four: what your browser reported when we checked whether it could transcribe on the device; whether you accepted or declined the microphone; how often speech did not match any answer, kept per language so we can tell a wrong word list from a noisy room; and why listening stopped — you, silence, a withdrawn permission, or leaving the page.

One of those deserves saying out loud rather than leaving for you to work out. Choosing to answer by voice can suggest something about you — that reading is hard, that a pointer is hard, that you use a screen reader. The accept-or-decline count means the decision itself is counted, as a running total and nothing more. It is not attached to your account, your visit or anything else, and we cannot tell from it who accepted. But a total of people who said yes is still a total about a choice that carries that inference, and you are entitled to know we keep one before you make it.

11. Contact

For privacy-related inquiries, contact us at [email protected].